{{comment[2]|safe}}
`. Use of the \"safe\" tag causes flask to _not_ escape the rendered content. To remediate this, simply remove the `|safe` tag from the HTML above. No fix is is available and users are advised to manually edit their installation.", "poc": ["https://github.com/DogukanUrker/flaskBlog/security/advisories/GHSA-mrcw-j96f-p6v6", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1623", "desc": "Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24717", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Kinchin Beds24 Online Booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through 2.0.23.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34905", "desc": "FlyFish v3.0.0 was discovered to contain a buffer overflow via the password parameter on the login page. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31213", "desc": "InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating \"To update your profile, please enter your password,\" upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available.", "poc": ["https://github.com/instantsoft/icms2/security/advisories/GHSA-6v3c-p92q-prfq", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-33304", "desc": "SourceCodester Product Show Room 1.0 is vulnerable to Cross Site Scripting (XSS) via \"Last Name\" under Add Users.", "poc": ["https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-33304.md"]}, {"cve": "CVE-2024-22514", "desc": "An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file.", "poc": ["https://github.com/Orange-418/CVE-2024-22514-Remote-Code-Execution", "https://github.com/Orange-418/AgentDVR-5.1.6.0-File-Upload-and-Remote-Code-Execution", "https://github.com/Orange-418/CVE-2024-22514-Remote-Code-Execution", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-3437", "desc": "A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /Admin/add-admin.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259631.", "poc": ["https://vuldb.com/?id.259631", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/fubxx/CVE"]}, {"cve": "CVE-2024-3782", "desc": "Cross-Site Request Forgery vulnerability in WBSAirback 21.02.04, which could allow an attacker to create a manipulated HTML form to perform privileged actions once it is executed by a privileged user.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22513", "desc": "djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/dmdhrumilmistry/CVEs"]}, {"cve": "CVE-2024-25767", "desc": "nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27914", "desc": "GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-23822", "desc": "Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.", "poc": ["https://github.com/sni/Thruk/security/advisories/GHSA-4mrh-mx7x-rqjx"]}, {"cve": "CVE-2024-2008", "desc": "The Modal Popup Box \u2013 Popup Builder, Show Offers And News in Popup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.2 via deserialization of untrusted input in the awl_modal_popup_box_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30625", "desc": "Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the entrys parameter from fromAddressNat function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/fromAddressNat_entrys.md"]}, {"cve": "CVE-2024-20818", "desc": "Out-of-bounds Write vulnerabilities in svc1td_vld_elh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2856", "desc": "A vulnerability, which was classified as critical, has been found in Tenda AC10 16.03.10.13/16.03.10.20. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument timeZone leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257780. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10/V16.03.10.13/fromSetSysTime.md", "https://github.com/NaInSec/CVE-LIST", "https://github.com/Schnaidr/CVE-2024-2856-Stack-overflow-EXP", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-30600", "desc": "Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/setSchedWifi_end.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23870", "desc": "A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/stockissuancelist.php, in the delete parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32664", "desc": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, specially crafted traffic or datasets can cause a limited buffer overflow. This vulnerability is fixed in 7.0.5 and 6.0.19. Workarounds include not use rules with `base64_decode` keyword with `bytes` option with value 1, 2 or 5 and for 7.0.x, setting `app-layer.protocols.smtp.mime.body-md5` to false.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31004", "desc": "An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,mp4fragment.", "poc": ["https://github.com/axiomatic-systems/Bento4/issues/941"]}, {"cve": "CVE-2024-1801", "desc": "In Progress\u00ae Telerik\u00ae Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25978", "desc": "Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28283", "desc": "There is stack-based buffer overflow vulnerability in pc_change_act function in Linksys E1000 router firmware version v.2.1.03 and before, leading to remote code execution.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-29792", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.93.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1030", "desc": "A vulnerability was found in Cogites eReserv 7.7.58. It has been classified as problematic. This affects an unknown part of the file /front/admin/tenancyDetail.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-252303.", "poc": ["https://vuldb.com/?id.252303", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2593", "desc": "Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability\u00a0through /amssplus/modules/book/main/bookdetail_group.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30965", "desc": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.", "poc": ["https://github.com/Fishkey1/cms/commit/e9d294951ab2dd85709f1d12ad4747f25d326b1b", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0921", "desc": "A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setDeviceSettings of the component Web Interface. The manipulation of the argument statuscheckpppoeuser leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252139.", "poc": ["https://github.com/xiyuanhuaigu/cve/blob/main/rce.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21668", "desc": "react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24332", "desc": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function.", "poc": ["https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/9/TOTOlink%20A3300R%20setUrlFilterRules.md"]}, {"cve": "CVE-2024-27012", "desc": "In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: restore set elements when delete set failsFrom abort path, nft_mapelem_activate() needs to restore refcounters tothe original state. Currently, it uses the set->ops->walk() to iterateover these set elements. The existing set iterator skips inactiveelements in the next generation, this does not work from the abort pathto restore the original state since it has to skip active elementsinstead (not inactive ones).This patch moves the check for inactive elements to the set iteratorcallback, then it reverses the logic for the .activate case whichneeds to skip active elements.Toggle next generation bit for elements when delete set command isinvoked and call nft_clear() from .activate (abort) path to restore thenext generation bit.The splat below shows an object in mappings memleak:[43929.457523] ------------[ cut here ]------------[43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables][...][43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables][43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 <0f> 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90[43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246[43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000[43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550[43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f[43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0[43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002[43929.458103] FS: 00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000[43929.458107] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0[43929.458114] Call Trace:[43929.458118] >test
leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-252191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-5098", "desc": "A vulnerability has been found in SourceCodester Simple Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-265081 was assigned to this vulnerability.", "poc": ["https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20Sql%20Inject-1.md"]}, {"cve": "CVE-2024-22130", "desc": "Print preview option in\u00a0SAP CRM WebClient UI - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. An attacker with low privileges can cause limited impact to confidentiality and integrity of the appliaction data after successful exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-5361", "desc": "A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /admin/normal-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266273 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4582", "desc": "A vulnerability classified as critical has been found in Faraday GM8181 and GM828x up to 20240429. Affected is an unknown function of the component NTP Service. The manipulation of the argument ntp_srv leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-263304.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21014", "desc": "Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported versions that are affected are 19.1.0-19.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-32674", "desc": "Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0293", "desc": "A vulnerability classified as critical was found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this vulnerability is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249859. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23447", "desc": "An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in Network Drive it is visible in search applications to the user.", "poc": ["https://www.elastic.co/community/security", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4666", "desc": "The Borderless \u2013 Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21508", "desc": "Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085", "https://github.com/Geniorio01/CVE-2024-21508-mysql2-RCE", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-24739", "desc": "SAP Bank Account Management (BAM) allows an authenticated user with restricted access to use functions which can result in escalation of privileges with low impact on confidentiality, integrity and availability of the application.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26196", "desc": "Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24468", "desc": "Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_customblock.php.", "poc": ["https://github.com/tang-0717/cms/blob/main/3.md"]}, {"cve": "CVE-2024-2344", "desc": "The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticted attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "poc": ["https://gist.github.com/Xib3rR4dAr/05a32f63d75082ab05de27e313e70fa3"]}, {"cve": "CVE-2024-4917", "desc": "A vulnerability was found in Campcodes Online Examination System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file submitAnswerExe.php. The manipulation of the argument exmne_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264452.", "poc": ["https://github.com/yylmm/CVE/blob/main/Online%20Examination%20System%20With%20Timer/SQL_submitAnswerExe.md"]}, {"cve": "CVE-2024-31214", "desc": "Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is stored, full control over the file extension, and partial control over the file name. While it's not for an attacker to overwrite an existing file, an attacker can create new files with certain names and attacker-controlled extensions anywhere on the file system. This can potentially lead to remote code execution, XSS, DOS, etc. The default install of Traccar makes this vulnerability more severe. Self-registration is enabled by default, allowing anyone to create an account to exploit this vulnerability. Traccar also runs by default with root/system privileges, allowing files to be placed anywhere on the file system. Version 6.0 contains a fix for the issue. One may also turn off self-registration by default, as that would make most vulnerabilities in the application much harder to exploit by default and reduce the severity considerably.", "poc": ["https://github.com/traccar/traccar/security/advisories/GHSA-3gxq-f2qj-c8v9", "https://github.com/nvn1729/advisories"]}, {"cve": "CVE-2024-31868", "desc": "Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.The attackers can modify helium.json and exposure XSS attacks to normal users.This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.Users are recommended to upgrade to version 0.11.1, which fixes the issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30508", "desc": "Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29504", "desc": "Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview parameter.", "poc": ["https://github.com/summernote/summernote/pull/3782"]}, {"cve": "CVE-2024-5391", "desc": "A vulnerability has been found in itsourcecode Online Student Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file listofsubject.php. The manipulation of the argument subjcode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266305 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3422", "desc": "A vulnerability was found in SourceCodester Online Courseware 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/activatestud.php. The manipulation of the argument selector leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259594 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20028", "desc": "In da, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541632; Issue ID: ALPS08541687.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2216", "desc": "A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4798", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknown functionality of the file /admin/maintenance/manage_brand.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263918 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/Hefei-Coffee/cve/blob/main/sql5.md"]}, {"cve": "CVE-2024-5066", "desc": "A vulnerability classified as critical was found in PHPGurukul Online Course Registration System 3.1. Affected by this vulnerability is an unknown functionality of the file /pincode-verification.php. The manipulation of the argument pincode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264925 was assigned to this vulnerability.", "poc": ["https://github.com/BurakSevben/CVEs/blob/main/Online%20Course%20Registration%20System/Online%20Course%20Registration%20System%20-%20SQL%20Injection%20-%204.md"]}, {"cve": "CVE-2024-4726", "desc": "A vulnerability was found in Campcodes Legal Case Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/clients. The manipulation of the argument f_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263804.", "poc": ["https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_clients.md"]}, {"cve": "CVE-2024-28091", "desc": "Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via User Defined Service in managed_services_add.asp (the victim must click an X for a deletion).", "poc": ["https://github.com/actuator/cve"]}, {"cve": "CVE-2024-3167", "desc": "The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018twitter_username\u2019 parameter in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29127", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Reflected XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22526", "desc": "Buffer Overflow vulnerability in bandisoft bandiview v7.0, allows local attackers to cause a denial of service (DoS) via exr image file.", "poc": ["https://gist.github.com/GAP-dev/c33276a151c824300d68aecc317082a3"]}, {"cve": "CVE-2024-3936", "desc": "The The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtTPGSaveSettings function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with subscriber access or higher, to change the plugin's settings and invoke other functions hooked by AJAX actions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26165", "desc": "Visual Studio Code Elevation of Privilege Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-32947", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in AlumniOnline Web Services LLC WP ADA Compliance Check Basic.This issue affects WP ADA Compliance Check Basic: from n/a through 3.1.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2294", "desc": "The Backuply \u2013 Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backup_name parameter in the backuply_download_backup function. This makes it possible for attackers to have an account with only activate_plugins capability to access arbitrary files on the server, which can contain sensitive information. This only impacts sites hosted on Windows servers.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3075", "desc": "The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/450375f6-a9d4-49f6-8bab-867774372795/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2578", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-30263", "desc": "macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25503", "desc": "Cross Site Scripting (XSS) vulnerability in Advanced REST Client v.17.0.9 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script to the edit details parameter of the New Project function.", "poc": ["https://github.com/EQSTLab/PoC/tree/main/2024/XSS/CVE-2024-25503"]}, {"cve": "CVE-2024-27286", "desc": "Zulip is an open-source team collaboration. When a user moves a Zulip message, they have the option to move all messages in the topic, move only subsequent messages as well, or move just a single message. If the user chose to just move one message, and was moving it from a public stream to a private stream, Zulip would successfully move the message, -- but active users who did not have access to the private stream, but whose client had already received the message, would continue to see the message in the public stream until they reloaded their client. Additionally, Zulip did not remove view permissions on the message from recently-active users, allowing the message to show up in the \"All messages\" view or in search results, but not in \"Inbox\" or \"Recent conversations\" views. While the bug has been present since moving messages between streams was first introduced in version 3.0, this option became much more common starting in Zulip 8.0, when the default option in the picker for moving the very last message in a conversation was changed. This issue is fixed in Zulip Server 8.3. No known workarounds are available.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-4645", "desc": "A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /Admin/changepassword.php. The manipulation of the argument txtold_password/txtnew_password/txtconfirm_password leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263489 was assigned to this vulnerability.", "poc": ["https://github.com/yylmm/CVE/blob/main/Prison%20Management%20System/xss4.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2571", "desc": "A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage-admin.php. The manipulation leads to execution after redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257074 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20manage-admin.php.md", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30242", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions Contact Form to Any API.This issue affects Contact Form to Any API: from n/a through 1.1.8.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-33428", "desc": "Buffer-Overflow vulnerability at conv.c:68 of stsaz phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via the a crafted .wav file.", "poc": ["https://github.com/Helson-S/FuzzyTesting/blob/master/phiola/heap-buffer-overflow-1/heap-buffer-overflow-1.assets/image-20240420005017430.png", "https://github.com/Helson-S/FuzzyTesting/blob/master/phiola/heap-buffer-overflow-1/heap-buffer-overflow-1.md", "https://github.com/Helson-S/FuzzyTesting/blob/master/phiola/heap-buffer-overflow-1/poc", "https://github.com/Helson-S/FuzzyTesting/tree/master/phiola/heap-buffer-overflow-1", "https://github.com/stsaz/phiola/issues/29"]}, {"cve": "CVE-2024-23080", "desc": "** DISPUTED ** Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.", "poc": ["https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2024-26300", "desc": "A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.", "poc": ["https://github.com/kaje11/CVEs"]}, {"cve": "CVE-2024-24397", "desc": "Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the ReportName field.", "poc": ["https://cves.at/posts/cve-2024-24397/writeup/", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/trustcves/CVE-2024-24397"]}, {"cve": "CVE-2024-36054", "desc": "Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory (and consequently gain all privileges) via IOCTL 0x9c4064b8 (via MmMapIoSpace) and IOCTL 0x9c406490 (via ZwMapViewOfSection).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3239", "desc": "The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/dfa1421b-41b0-4b25-95ef-0843103e1f5e/"]}, {"cve": "CVE-2024-28571", "desc": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the fill_input_buffer() function when reading images in JPEG format.", "poc": ["https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-4926", "desc": "A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /intrams_sams/manage_student.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264462 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/Hefei-Coffee/cve/blob/main/sql7.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0295", "desc": "A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. This affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249861 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24857", "desc": "A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28669", "desc": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_edit.php.", "poc": ["https://github.com/777erp/cms/blob/main/10.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22911", "desc": "A stack-buffer-underflow vulnerability was found in SWFTools v0.9.2, in the function parseExpression at src/swfc.c:2602.", "poc": ["https://github.com/matthiaskramm/swftools/issues/216"]}, {"cve": "CVE-2024-35190", "desc": "Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25446", "desc": "An issue in the HuginBase::PTools::setDestImage function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a crafted image.", "poc": ["https://bugs.launchpad.net/hugin/+bug/2025037", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1256", "desc": "A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. This issue affects some unknown processing of the file /ext/collect/filter_text.do. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252995.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0920", "desc": "A vulnerability was found in TRENDnet TEW-822DRE 1.03B02. It has been declared as critical. This vulnerability affects unknown code of the file /admin_ping.htm of the component POST Request Handler. The manipulation of the argument ipv4_ping/ipv6_ping leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2222", "desc": "The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback_delete_attachment function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber access or higher, to delete arbitrary media uploads.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-2063", "desc": "A vulnerability, which was classified as problematic, was found in SourceCodester Petrol Pump Management Software 1.0. Affected is an unknown function of the file /admin/app/profile_crud.php. The manipulation of the argument username leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255378 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/profile_crud.php%20Unauthenticated%20STORED%20XSS.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24862", "desc": "In function pci1xxxx_spi_probe, there is a potential null pointer thatmay be caused by a failed memory allocation by the function devm_kzalloc.Hence, a null pointer check needs to be added to prevent null pointerdereferencing later in the code.To fix this issue, spi_bus->spi_int[iter] should be checked. The memoryallocated by devm_kzalloc will be automatically released, so just directlyreturn -ENOMEM without worrying about memory leaks.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30380", "desc": "An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS), which causes the l2cpd process to crash by sending a specific TLV.The l2cpd process is responsible for layer 2 control protocols, such as STP, RSTP, MSTP, VSTP, ERP, and LLDP.\u00a0 The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP, leading to a Denial of Service.\u00a0\u00a0Continued receipt and processing of this specific TLV will create a sustained Denial of Service (DoS) condition.This issue affects:Junos OS: all versions before 20.4R3-S9, from 21.2 before 21.2R3-S7, from 21.3 before 21.3R3-S5, from 21.4 before 21.4R3-S4, from 22.1 before 22.1R3-S4, from 22.2 before 22.2R3-S2, from 22.3 before 22.3R2-S2, 22.3R3-S1, from 22.4 before 22.4R2-S2, 22.4R3, from 23.2 before 23.2R1-S1, 23.2R2;Junos OS Evolved: all versions before 21.2R3-S7, from 21.3 before 21.3R3-S5-EVO, from 21.4 before 21.4R3-S5-EVO, from 22.1 before 22.1R3-S4-EVO, from 22.2 before 22.2R3-S2-EVO, from 22.3 before 22.3R2-S2-EVO, 22.3R3-S1-EVO, from 22.4 before 22.4R2-S2-EVO, 22.4R3-EVO, from 23.2 before 23.2R1-S1-EVO, 23.2R2-EVO.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29096", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Manning MJM Clinic.This issue affects MJM Clinic: from n/a through 1.1.22.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-25124", "desc": "Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard (`*`) while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices. The impact of this misconfiguration is high as it can lead to unauthorized access to sensitive user data and expose the system to various types of attacks listed in the PortSwigger article linked in the references. Version 2.52.1 contains a patch for this issue. As a workaround, users may manually validate the CORS configurations in their implementation to ensure that they do not allow a wildcard origin when credentials are enabled. The browser fetch api, as well as browsers and utilities that enforce CORS policies, are not affected by this.", "poc": ["http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html", "https://github.com/gofiber/fiber/security/advisories/GHSA-fmg4-x8pw-hjhg"]}, {"cve": "CVE-2024-35049", "desc": "SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590.", "poc": ["https://github.com/javahuang/SurveyKing/issues/55"]}, {"cve": "CVE-2024-26313", "desc": "Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.13.P3 HF1 (6.13.0.3.1) is also a fixed release.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20720", "desc": "Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile", "https://github.com/xxDlib/CVE-2024-20720-PoC"]}, {"cve": "CVE-2024-22776", "desc": "Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats like date fields.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20857", "desc": "Improper access control vulnerability in startListening of CocktailBarService prior to SMR May-2024 Release 1 allows local attackers to access information of current application.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29777", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Reflected XSS.This issue affects Forminator: from n/a through 1.29.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0937", "desc": "A vulnerability, which was classified as critical, has been found in van_der_Schaar LAB synthcity 0.2.9. Affected by this issue is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252182 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early and confirmed immediately the existence of the issue. A patch is planned to be released in February 2024.", "poc": ["https://github.com/bayuncao/vul-cve-6/blob/main/poc.py", "https://vuldb.com/?id.252182"]}, {"cve": "CVE-2024-35591", "desc": "An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3783", "desc": "The Backup Agents section in WBSAirback 21.02.04 is affected by a Path Traversal vulnerability, allowing a user with low privileges to download files from the system.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4492", "desc": "A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). This issue affects the function formOfflineSet of the file /goform/setStaOffline. The manipulation of the argument GO/ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263081 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formOfflineSet.md"]}, {"cve": "CVE-2024-2860", "desc": "The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANnav is installed can gain access to sensitive data inside the PostgreSQL database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2330", "desc": "A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/index.php. The manipulation of the argument IPAddr leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256281 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/jikedaodao/cve/blob/main/NS-ASG-sql-addmacbind.md", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/wy876/wiki"]}, {"cve": "CVE-2024-31140", "desc": "In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28395", "desc": "SQL injection vulnerability in Best-Kit bestkit_popup v.1.7.2 and before allows a remote attacker to escalate privileges via the bestkit_popup.php component.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25395", "desc": "A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2.", "poc": ["https://github.com/0xdea/advisories", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hnsecurity/vulns"]}, {"cve": "CVE-2024-27905", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora.An endpoint exposing internals to unauthenticated users can be used as a \"padding oracle\" allowing an anonymous attacker to construct a valid authentication cookie. Potentially this could be combined with vulnerabilities in other components to achieve remote code execution.As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32343", "desc": "A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter.", "poc": ["https://github.com/adiapera/xss_create2_boidcms_2.1.0", "https://github.com/adiapera/xss_create2_boidcms_2.1.0"]}, {"cve": "CVE-2024-0284", "desc": "A vulnerability was found in Kashipara Food Management System up to 1.0. It has been rated as problematic. This issue affects some unknown processing of the file party_submit.php. The manipulation of the argument party_address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249839.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2770", "desc": "A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/contact-us.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257606 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-30683", "desc": "** DISPUTED ** A buffer overflow vulnerability has been discovered in the C++ components of ROS2 Iron Irwini versions ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via improper handling of arrays or strings. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/yashpatelphd/CVE-2024-30683"]}, {"cve": "CVE-2024-24937", "desc": "In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30252", "desc": "Livemarks is a browser extension that provides RSS feed bookmark folders. Versions of Livemarks prior to 3.7 are vulnerable to cross-site request forgery. A malicious website may be able to coerce the extension to send an authenticated GET request to an arbitrary URL. An authenticated request is a request where the cookies of the browser are sent along with the request. The `subscribe.js` script uses the first parameter from the current URL location as the URL of the RSS feed to subscribe to and checks that the RSS feed is valid XML. `subscribe.js` is accessible by an attacker website due to its use in `subscribe.html`, an HTML page that is declared as a `web_accessible_resource` in `manifest.json`. This issue may lead to `Privilege Escalation`. A CSRF breaks the integrity of servers running on a private network. A user of the browser extension may have a private server with dangerous functionality, which is assumed to be safe due to network segmentation. Upon receiving an authenticated request instantiated from an attacker, this integrity is broken. Version 3.7 fixes this issue by removing subscribe.html from `web_accessible_resources`.", "poc": ["https://github.com/nt1m/livemarks/security/advisories/GHSA-3gg9-w4fm-jjcg"]}, {"cve": "CVE-2024-2521", "desc": "A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/bookdate.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256958 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20bookdate.php.md", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1856", "desc": "In Progress\u00ae Telerik\u00ae Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30735", "desc": "** DISPUTED ** An arbitrary file upload vulnerability has been discovered in ROS Kinetic Kame in ROS_VERSION 1 and ROS_PYTHON_VERSION 3, allows attackers to execute arbitrary code, cause a denial of service (DoS), and obtain sensitive information via crafted payload to the file upload mechanism of the ROS system, including the server\u2019s functionality for handling file uploads and the associated validation processes. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/yashpatelphd/CVE-2024-30735"]}, {"cve": "CVE-2024-4331", "desc": "Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/angelov-1080/CVE_Checker", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27018", "desc": "In the Linux kernel, the following vulnerability has been resolved:netfilter: br_netfilter: skip conntrack input hook for promisc packetsFor historical reasons, when bridge device is in promisc mode, packetsthat are directed to the taps follow bridge input hook path. This patchadds a workaround to reset conntrack for these packets.Jianbo Liu reports warning splats in their test infrastructure wherecloned packets reach the br_netfilter input hook to confirm theconntrack object.Scratch one bit from BR_INPUT_SKB_CB to annotate that this packet hasreached the input hook because it is passed up to the bridge device toreach the taps.[ 57.571874] WARNING: CPU: 1 PID: 0 at net/bridge/br_netfilter_hooks.c:616 br_nf_local_in+0x157/0x180 [br_netfilter][ 57.572749] Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_isc si ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5ctl mlx5_core[ 57.575158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0+ #19[ 57.575700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014[ 57.576662] RIP: 0010:br_nf_local_in+0x157/0x180 [br_netfilter][ 57.577195] Code: fe ff ff 41 bd 04 00 00 00 be 04 00 00 00 e9 4a ff ff ff be 04 00 00 00 48 89 ef e8 f3 a9 3c e1 66 83 ad b4 00 00 00 04 eb 91 <0f> 0b e9 f1 fe ff ff 0f 0b e9 df fe ff ff 48 89 df e8 b3 53 47 e1[ 57.578722] RSP: 0018:ffff88885f845a08 EFLAGS: 00010202[ 57.579207] RAX: 0000000000000002 RBX: ffff88812dfe8000 RCX: 0000000000000000[ 57.579830] RDX: ffff88885f845a60 RSI: ffff8881022dc300 RDI: 0000000000000000[ 57.580454] RBP: ffff88885f845a60 R08: 0000000000000001 R09: 0000000000000003[ 57.581076] R10: 00000000ffff1300 R11: 0000000000000002 R12: 0000000000000000[ 57.581695] R13: ffff8881047ffe00 R14: ffff888108dbee00 R15: ffff88814519b800[ 57.582313] FS: 0000000000000000(0000) GS:ffff88885f840000(0000) knlGS:0000000000000000[ 57.583040] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[ 57.583564] CR2: 000000c4206aa000 CR3: 0000000103847001 CR4: 0000000000370eb0[ 57.584194] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000[ 57.584820] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400[ 57.585440] Call Trace:[ 57.585721] leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251678 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.251678", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29442", "desc": "** DISPUTED ** An unauthorized access vulnerability has been discovered in ROS2 Humble Hawksbill versions where ROS_VERSION is 2 and ROS_PYTHON_VERSION is 3. This vulnerability could potentially allow a malicious user to gain unauthorized access to multiple ROS2 nodes remotely. Unauthorized access to these nodes could result in compromised system integrity, the execution of arbitrary commands, and disclosure of sensitive information. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2024-29442"]}, {"cve": "CVE-2024-32699", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in YITH YITH WooCommerce Compare.This issue affects YITH WooCommerce Compare: from n/a through 2.37.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23213", "desc": "The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3. Processing web content may lead to arbitrary code execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25139", "desc": "In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level. This is fixed in ER605(UN)_v2_2.2.4 Build 020240119.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/microsoft/Microsoft-TP-Link-Research-Team"]}, {"cve": "CVE-2024-31065", "desc": "Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field.", "poc": ["https://github.com/sahildari/cve/blob/master/CVE-2024-31065.md", "https://portswigger.net/web-security/cross-site-scripting/stored"]}, {"cve": "CVE-2024-1749", "desc": "A vulnerability, which was classified as problematic, has been found in Bdtask Bhojon Best Restaurant Management Software 2.9. This issue affects some unknown processing of the file /dashboard/message of the component Message Page. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254531. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Srivishnu-p/CVEs-and-Vulnerabilities", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/machisri/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2024-1983", "desc": "The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users.", "poc": ["https://wpscan.com/vulnerability/bf3a31de-a227-4db1-bd18-ce6a78dc96fb/", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-27569", "desc": "LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the init_nvram function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", "poc": ["https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/init_nvram.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25731", "desc": "The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus, encryption can be defeated by an attacker who can observe packet data (e.g., over Wi-Fi).", "poc": ["https://github.com/actuator/com.cn.dq.ipc", "https://github.com/actuator/cve", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-25196", "desc": "Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_controller process. This vulnerability is triggerd via sending a crafted .yaml file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2609", "desc": "The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-2464", "desc": "This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20755", "desc": "Bridge versions 13.0.5, 14.0.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28344", "desc": "An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability allows attackers to control the \"back\" parameter in the URL through a double encoded URL.", "poc": ["https://securitycafe.ro/2024/03/21/cve-2024-28344-cve-2024-28345-in-sipwise-c5/"]}, {"cve": "CVE-2024-23131", "desc": "A maliciously crafted STP file in ASMKERN228A.dll or ASMDATAX228A.dll when parsed through Autodesk AutoCAD could lead to a memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0903", "desc": "The User Feedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_submitted' 'link' value in all versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the feedback submission page that will execute when a user clicks the link, while also pressing the command key.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2809", "desc": "A vulnerability, which was classified as critical, was found in Tenda AC15 15.03.05.18/15.03.20_multi. Affected is the function formSetFirewallCfg of the file /goform/SetFirewallCfg. The manipulation of the argument firewallEn leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257664. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formSetFirewallCfg.md", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28195", "desc": "your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.9.0 do not protect the API and login flow against Cross-Site Request Forgery (CSRF). Attackers can use this to execute CSRF attacks on victims, allowing them to retrieve, modify or delete data on the affected YourSpotify instance. Using repeated CSRF attacks, it is also possible to create a new user on the victim instance and promote the new user to instance administrator if a legitimate administrator visits a website prepared by an attacker. Note: Real-world exploitability of this vulnerability depends on the browser version and browser settings in use by the victim. This issue has been addressed in version 1.9.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-hfgf-99p3-6fjj"]}, {"cve": "CVE-2024-2490", "desc": "A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256897 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Emilytutu/IoT-vulnerable/blob/main/Tenda/AC18/setSchedWifi_end.md"]}, {"cve": "CVE-2024-27281", "desc": "An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1.", "poc": ["https://github.com/lifeparticle/Ruby-Cheatsheet"]}, {"cve": "CVE-2024-1932", "desc": "Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout", "poc": ["https://huntr.com/bounties/fefd711e-3bf0-4884-9acc-167649c1f9a2"]}, {"cve": "CVE-2024-31492", "desc": "An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23742", "desc": "** DISPUTED ** An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor disputes this because it requires local access to a victim's machine.", "poc": ["https://github.com/V3x0r/CVE-2024-23742", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/giovannipajeu1/CVE-2024-23742", "https://github.com/giovannipajeu1/giovannipajeu1", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-30871", "desc": "netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/applyhardware.php.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4497", "desc": "A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been declared as critical. This vulnerability affects the function formexeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263086 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formexeCommand.md"]}, {"cve": "CVE-2024-34244", "desc": "libmodbus v3.1.10 is vulnerable to Buffer Overflow via the modbus_write_bits function. This issue can be triggered when the function is fed with specially crafted input, which leads to out-of-bounds read and can potentially cause a crash or other unintended behaviors.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1473", "desc": "The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page contents via REST API thus bypassing maintenance mode protection provided by the plugin.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-2639", "desc": "A vulnerability was found in Bdtask Wholesale Inventory Management System up to 20240311. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to session fixiation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-3427", "desc": "A vulnerability, which was classified as problematic, was found in SourceCodester Online Courseware 1.0. This affects an unknown part of the file addq.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259599.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0425", "desc": "A vulnerability classified as critical was found in ForU CMS up to 2020-06-23. This vulnerability affects unknown code of the file /admin/index.php?act=reset_admin_psw. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250444.", "poc": ["https://github.com/mi2acle/forucmsvuln/blob/master/passwordreset.md"]}, {"cve": "CVE-2024-26044", "desc": "Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into a webpage. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of the victim's browser.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-29873", "desc": "SQL injection vulnerability in Sentrifugo 3.2, through\u00a0/sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30850", "desc": "An issue in tiagorlampert CHAOS v5.0.1 allows a remote attacker to execute arbitrary code via the BuildClient function within client_service.go", "poc": ["https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents/", "https://github.com/chebuya/CVE-2024-30850-chaos-rat-rce-poc", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-1785", "desc": "The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site's user with the edit_posts capability into performing an action such as clicking on a link.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-1199", "desc": "A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file \\employee-tasks-php\\attendance-info.php. The manipulation of the argument aten_id leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252697 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2560", "desc": "A vulnerability classified as problematic was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromSysToolRestoreSet of the file /goform/SysToolRestoreSet. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/fromSysToolRestoreSet.md", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-36426", "desc": "In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1753", "desc": "A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26445", "desc": "flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_place.php", "poc": ["https://github.com/xiaolanjing0/cms/blob/main/1.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30719", "desc": "** DISPUTED ** An insecure deserialization vulnerability has been identified in ROS2 Dashing Diademata in ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows attackers to execute arbitrary code and obtain sensitive information via Data Serialization and Deserialization Components, Inter-Process Communication Mechanisms, and Network Communication Interfaces. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/yashpatelphd/CVE-2024-30719"]}, {"cve": "CVE-2024-2776", "desc": "A vulnerability, which was classified as critical, was found in Campcodes Online Marriage Registration System 1.0. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257610 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-29374", "desc": "A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the \"GET /?lang=\" URL parameter.", "poc": ["https://gist.github.com/fir3storm/f9c7f3ec1a6496498517ed216d2640b2", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-20687", "desc": "Microsoft AllJoyn API Denial of Service Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29036", "desc": "Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-4998", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-4566. Reason: This candidate is a reservation duplicate of CVE-2024-4566. Notes: All CVE users should reference CVE-2024-4566 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28429", "desc": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.php", "poc": ["https://github.com/itsqian797/cms/blob/main/2.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20017", "desc": "In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2384", "desc": "The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11. This is due to the plugin not properly verifying the authentication and authorization of the current user This makes it possible for authenticated attackers, with customer-level access and above, to view potentially sensitive information about other users by leveraging their order id", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-3273", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.", "poc": ["https://github.com/Chocapikk/CVE-2024-3273", "https://github.com/GhostTroops/TOP", "https://github.com/K3ysTr0K3R/CVE-2024-3273-EXPLOIT", "https://github.com/K3ysTr0K3R/K3ysTr0K3R", "https://github.com/OIivr/Turvan6rkus-CVE-2024-3273", "https://github.com/Ostorlab/KEV", "https://github.com/ThatNotEasy/CVE-2024-3273", "https://github.com/adhikara13/CVE-2024-3273", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/mrrobot0o/CVE-2024-3273-", "https://github.com/nickswink/D-Link-NAS-Devices-Unauthenticated-RCE", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile", "https://github.com/toxyl/lscve", "https://github.com/wangjiezhe/awesome-stars", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/wy876/wiki", "https://github.com/yarienkiva/honeypot-dlink-CVE-2024-3273"]}, {"cve": "CVE-2024-30672", "desc": "** DISPUTED ** Arbitrary file upload vulnerability in ROS (Robot Operating System) Melodic Morenia in ROS_VERSION 1 and ROS_PYTHON_VERSION 3, allows attackers to execute arbitrary code, cause a denial of service (DoS), and obtain sensitive information via the file upload component. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/yashpatelphd/CVE-2024-30672"]}, {"cve": "CVE-2024-2135", "desc": "A vulnerability was found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This issue affects some unknown processing of the file /hospital_activities/birth/form of the component Hospital Activities Page. The manipulation of the argument Description with the input 
leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255497 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Srivishnu-p/CVEs-and-Vulnerabilities", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29126", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Mortellaro Specific Content For Mobile \u2013 Customize the mobile version without redirections allows Reflected XSS.This issue affects Specific Content For Mobile \u2013 Customize the mobile version without redirections: from n/a through 0.1.9.5.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-0677", "desc": "The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.", "poc": ["https://wpscan.com/vulnerability/0f7757c9-69fa-49db-90b0-40f0ff29bee7/"]}, {"cve": "CVE-2024-1877", "desc": "A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /cancel.php. The manipulation of the argument id with the input 1%20or%201=1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254725 was assigned to this vulnerability.", "poc": ["https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20EMPLOYEE%20MANAGEMENT%20SYSTEM/Employee%20Leave%20Cancel%20SQL%20Injection.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25305", "desc": "Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php.", "poc": ["https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20Authentication%20Bypass.md", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tubakvgc/CVEs"]}, {"cve": "CVE-2024-31576", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28097", "desc": "Calendar functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1260", "desc": "A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252999.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30973", "desc": "An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via crafted POST request to /boaform/getASPdata/formFirewall, /boaform/getASPdata/formAcc.", "poc": ["https://github.com/Athos-Zago/CVE-2024-30973/tree/main", "https://github.com/Athos-Zago/CVE-2024-30973", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-24525", "desc": "An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL.", "poc": ["https://github.com/l3v3lFORall/EpointWebBuilder_v5.x_VULN"]}, {"cve": "CVE-2024-0510", "desc": "A vulnerability, which was classified as critical, has been found in HaoKeKeJi YiQiNiu up to 3.1. Affected by this issue is the function http_post of the file /application/pay/controller/Api.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250652.", "poc": ["http://packetstormsecurity.com/files/176547/HaoKeKeJi-YiQiNiu-Server-Side-Request-Forgery.html"]}, {"cve": "CVE-2024-0801", "desc": "A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.", "poc": ["https://www.tenable.com/security/research/tra-2024-07"]}, {"cve": "CVE-2024-23193", "desc": "E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions. No publicly available exploits are known.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29386", "desc": "projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceExport.php.", "poc": ["https://cve.anas-cherni.me/2024/04/04/cve-2024-29386/"]}, {"cve": "CVE-2024-34446", "desc": "Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave the device. Data showing that the affected device was the origin of sensitive DNS requests may be observed and logged by operators of unintended DNS servers.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0891", "desc": "A vulnerability was found in hongmaple octopus 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument description with the input leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-252043.", "poc": ["https://github.com/biantaibao/octopus_XSS/blob/main/report.md", "https://vuldb.com/?id.252043"]}, {"cve": "CVE-2024-28639", "desc": "Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and cause a denial of service (DoS) via the IP field.", "poc": ["https://github.com/ZIKH26/CVE-information/blob/master/TOTOLINK/Vulnerability%20Information_1.md", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29439", "desc": "** DISPUTED ** An unauthorized node injection vulnerability has been identified in ROS2 Humble Hawksbill in ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows remote attackers to escalate privileges and inject malicious ROS2 nodes into the system. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2024-29439"]}, {"cve": "CVE-2024-1395", "desc": "Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system\u2019s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.This issue affects Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0905", "desc": "The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users", "poc": ["https://wpscan.com/vulnerability/3b9eba0d-29aa-47e4-b17f-4cf4bbf8b690/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34472", "desc": "An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerability exists in the mliRealtimeEmails.php file. The ordemGrid parameter in a POST request to /mailinspector/mliRealtimeEmails.php does not properly sanitize input, allowing an authenticated attacker to execute arbitrary SQL commands, leading to the potential disclosure of the entire application database.", "poc": ["https://github.com/osvaldotenorio/CVE-2024-34472", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/osvaldotenorio/CVE-2024-34472"]}, {"cve": "CVE-2024-29812", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReviewX allows Stored XSS.This issue affects ReviewX: from n/a through 1.6.22.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28111", "desc": "Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-based Canarytoken to target the Canarytoken's owner, if the owner exports the incident history to CSV and opens in a reader application such as Microsoft Excel. The impact is that this issue could lead to code execution on the machine on which the CSV file is opened. Version sha-c595a1f8 contains a fix for this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26043", "desc": "Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-21119", "desc": "Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8.5.6 and 8.5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-33343", "desc": "D-Link DIR-822+ V1.0.5 was found to contain a command injection in ChgSambaUserSettings function of prog.cgi, which allows remote attackers to execute arbitrary commands via shell.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25148", "desc": "In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24579", "desc": "stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. Specifically, use of `github.com/anchore/stereoscope/pkg/file.UntarToDirectory()` function, the `github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider` struct, or the higher level `github.com/anchore/stereoscope/pkg/image.Image.Read()` function express this vulnerability. As a workaround, if you are using the OCI archive as input into stereoscope then you can switch to using an OCI layout by unarchiving the tar archive and provide the unarchived directory to stereoscope.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28521", "desc": "SQL Injection vulnerability in Netcome NS-ASG Application Security Gateway v.6.3.1 allows a local attacker to execute arbitrary code and obtain sensitive information via a crafted script to the loginid parameter of the /singlelogin.php component.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-21012", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31961", "desc": "A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands via the level2 parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2211", "desc": "Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript payload in the campaign menu and trigger the payload when the campaign is removed from the menu.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0187", "desc": "The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/b4600411-bee1-4cc8-aee9-0a613ac9b55b/"]}, {"cve": "CVE-2024-26780", "desc": "In the Linux kernel, the following vulnerability has been resolved:af_unix: Fix task hung while purging oob_skb in GC.syzbot reported a task hung; at the same time, GC was looping infinitelyin list_for_each_entry_safe() for OOB skb. [0]syzbot demonstrated that the list_for_each_entry_safe() was not actuallysafe in this case.A single skb could have references for multiple sockets. If we free sucha skb in the list_for_each_entry_safe(), the current and next sockets couldbe unlinked in a single iteration.unix_notinflight() uses list_del_init() to unlink the socket, so theprefetched next socket forms a loop itself and list_for_each_entry_safe()never stops.Here, we must use while() and make sure we always fetch the first socket.[0]:Sending NMI from CPU 0 to CPUs 1:NMI backtrace for cpu 1CPU: 1 PID: 5065 Comm: syz-executor236 Not tainted 6.8.0-rc3-syzkaller-00136-g1f719a2f3fa6 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x60 kernel/kcov.c:207Code: cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 48 8b 14 25 40 c2 03 00 <65> 8b 05 b4 7c 78 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74RSP: 0018:ffffc900033efa58 EFLAGS: 00000283RAX: ffff88807b077800 RBX: ffff88807b077800 RCX: 1ffffffff27b1189RDX: ffff88802a5a3b80 RSI: ffffffff8968488d RDI: ffff88807b077f70RBP: ffffc900033efbb0 R08: 0000000000000001 R09: fffffbfff27a900cR10: ffffffff93d48067 R11: ffffffff8ae000eb R12: ffff88807b077800R13: dffffc0000000000 R14: ffff88807b077e40 R15: 0000000000000001FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000564f4fc1e3a8 CR3: 000000000d57a000 CR4: 00000000003506f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: unix_gc+0x563/0x13b0 net/unix/garbage.c:319 unix_release_sock+0xa93/0xf80 net/unix/af_unix.c:683 unix_release+0x91/0xf0 net/unix/af_unix.c:1064 __sock_release+0xb0/0x270 net/socket.c:659 sock_close+0x1c/0x30 net/socket.c:1421 __fput+0x270/0xb80 fs/file_table.c:376 task_work_run+0x14f/0x250 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa8a/0x2ad0 kernel/exit.c:871 do_group_exit+0xd4/0x2a0 kernel/exit.c:1020 __do_sys_exit_group kernel/exit.c:1031 [inline] __se_sys_exit_group kernel/exit.c:1029 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6f/0x77RIP: 0033:0x7f9d6cbdac09Code: Unable to access opcode bytes at 0x7f9d6cbdabdf.RSP: 002b:00007fff5952feb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9d6cbdac09RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000RBP: 00007f9d6cc552b0 R08: ffffffffffffffb8 R09: 0000000000000006R10: 0000000000000006 R11: 0000000000000246 R12: 00007f9d6cc552b0R13: 0000000000000000 R14: 00007f9d6cc55d00 R15: 00007f9d6cbabe70 ", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20864", "desc": "Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows local attackers to monitor system resources.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22988", "desc": "An issue in zkteco zkbio WDMS v.8.0.5 allows an attacker to execute arbitrary code via the /files/backup/ component.", "poc": ["https://gist.github.com/whiteman007/b50a9b64007a5d7bcb7a8bee61d2cb47", "https://www.vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategies", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24782", "desc": "An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22404", "desc": "Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download \"view-only\" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29400", "desc": "An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter.", "poc": ["https://github.com/Fr1ezy/RuoYi_info"]}, {"cve": "CVE-2024-30851", "desc": "Directory Traversal vulnerability in codesiddhant Jasmin Ransomware v.1.0.1 allows an attacker to obtain sensitive information via the download_file.php component.", "poc": ["https://github.com/chebuya/CVE-2024-30851-jasmin-ransomware-path-traversal-poc", "https://github.com/chebuya/CVE-2024-30851-jasmin-ransomware-path-traversal-poc", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-22285", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Elise Bosse Frontpage Manager.This issue affects Frontpage Manager: from n/a through 1.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29066", "desc": "Windows Distributed File System (DFS) Remote Code Execution Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26144", "desc": "Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4736", "desc": "A vulnerability was found in Campcodes Legal Case Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/tax. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263822 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_tax.md"]}, {"cve": "CVE-2024-20052", "desc": "In flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541757; Issue ID: ALPS08541761.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34221", "desc": "Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalation.", "poc": ["https://github.com/dovankha/CVE-2024-34221", "https://github.com/dovankha/CVE-2024-34221", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-2983", "desc": "A vulnerability was found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this issue is the function formSetClientState of the file /goform/SetClientState. The manipulation of the argument deviceId/limitSpeed/limitSpeedUp leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258152. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formSetClientState.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32709", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/truonghuuphuc/CVE-2024-32709-Poc"]}, {"cve": "CVE-2024-23305", "desc": "An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .vmrk file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26928", "desc": "In the Linux kernel, the following vulnerability has been resolved:smb: client: fix potential UAF in cifs_debug_files_proc_show()Skip sessions that are being teared down (status == SES_EXITING) toavoid UAF.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3590", "desc": "The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers", "poc": ["https://wpscan.com/vulnerability/829f4d40-e5b0-4009-b753-85ca2a5b3d25/"]}, {"cve": "CVE-2024-25507", "desc": "RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parameter at /LHMail/AttachDown.aspx.", "poc": ["https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#plan_template_previewaspx"]}, {"cve": "CVE-2024-29241", "desc": "Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to bypass security constraints via unspecified vectors.", "poc": ["https://github.com/LOURC0D3/ENVY-gitbook", "https://github.com/LOURC0D3/LOURC0D3"]}, {"cve": "CVE-2024-3416", "desc": "A vulnerability classified as critical was found in SourceCodester Online Courseware 1.0. This vulnerability affects unknown code of the file admin/editt.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259588.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22357", "desc": "IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 280894.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22039", "desc": "A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All versions < IP6 SR3), Cerberus PRO EN Fire Panel FC72x IP7 (All versions < IP7 SR5), Cerberus PRO EN X200 Cloud Distribution IP7 (All versions < V3.0.6602), Cerberus PRO EN X200 Cloud Distribution IP8 (All versions < V4.0.5016), Cerberus PRO EN X300 Cloud Distribution IP7 (All versions < V3.2.6601), Cerberus PRO EN X300 Cloud Distribution IP8 (All versions < V4.2.5015), Cerberus PRO UL Compact Panel FC922/924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution (All versions < V4.3.0001), Desigo Fire Safety UL Compact Panel FC2025/2050 (All versions < MP4), Desigo Fire Safety UL Engineering Tool (All versions < MP4), Desigo Fire Safety UL X300 Cloud Distribution (All versions < V4.3.0001), Sinteso FS20 EN Engineering Tool (All versions < MP8), Sinteso FS20 EN Fire Panel FC20 MP6 (All versions < MP6 SR3), Sinteso FS20 EN Fire Panel FC20 MP7 (All versions < MP7 SR5), Sinteso FS20 EN X200 Cloud Distribution MP7 (All versions < V3.0.6602), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.0.5016), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions < V3.2.6601), Sinteso FS20 EN X300 Cloud Distribution MP8 (All versions < V4.2.5015), Sinteso Mobile (All versions < V3.0.0). The network communication library in affected systems does not validate the length of certain X.509 certificate attributes which might result in a stack-based buffer overflow.\nThis could allow an unauthenticated remote attacker to execute code on the underlying operating system with root privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21336", "desc": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-0563", "desc": "Denial of service condition in M-Files Server in\u00a0versions before 24.2 (excluding 23.2 SR7 and 23.8 SR5) allows anonymous user to cause denial of service against other anonymous users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26247", "desc": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-5050", "desc": "A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 up to 20240516. This affects an unknown part of the file /?g=log_import_save. The manipulation of the argument reqfile leads to unrestricted upload. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-264747.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29238", "desc": "Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to inject SQL commands via unspecified vectors.", "poc": ["https://github.com/LOURC0D3/ENVY-gitbook", "https://github.com/LOURC0D3/LOURC0D3"]}, {"cve": "CVE-2024-36105", "desc": "dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to `INADDR_ANY (0.0.0.0)` or `IN6ADDR_ANY (::)` exposes an application on all network interfaces, increasing the risk of unauthorized access. As stated in the Python docs, a special form for address is accepted instead of a host address: `''` represents `INADDR_ANY`, equivalent to `\"0.0.0.0\"`. On systems with IPv6, '' represents `IN6ADDR_ANY`, which is equivalent to `\"::\"`. A user who serves docs on an unsecured public network, may unknowingly be hosting an unsecured (http) web site for any remote user/system to access on the same network. The issue has has been mitigated in dbt-core v1.6.15, dbt-core v1.7.15, and dbt-core v1.8.1 by binding to localhost explicitly by default in `dbt docs serve`.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24706", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Forum One WP-CFM wp-cfm.This issue affects WP-CFM: from n/a through 1.7.8.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0030", "desc": "In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1704", "desc": "A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been declared as critical. This vulnerability affects the function save/delete of the file /adminapi/system/crud. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254392. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.254392"]}, {"cve": "CVE-2024-29448", "desc": "** DISPUTED ** A buffer overflow vulnerability has been discovered in the C++ components of ROS2 Humble Hawksbill in ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows attackers to execute arbitrary code or cause a denial of service (DoS) via improper handling of arrays or strings. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2024-29448"]}, {"cve": "CVE-2024-31652", "desc": "A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.", "poc": ["https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31652.md"]}, {"cve": "CVE-2024-23284", "desc": "A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0343", "desc": "A vulnerability classified as problematic was found in CodeAstro Simple House Rental System 5.6. Affected by this vulnerability is an unknown functionality of the component Login Panel. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250111.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0965", "desc": "The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's page restriction and view page content.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32025", "desc": "Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `group_images_gui.py`. This vulnerability is fixed in 23.1.5.", "poc": ["https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss"]}, {"cve": "CVE-2024-29745", "desc": "there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/toxyl/lscve"]}, {"cve": "CVE-2024-30939", "desc": "An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attacker to gain control of an account via a flaw in the factory reset procedure.", "poc": ["https://medium.com/@deepsahu1/yealink-ip-phone-account-take-over-9bf9e7b847c0?source=friends_link&sk=b0d664dd5b3aad5b758e4934aca997ad"]}, {"cve": "CVE-2024-2065", "desc": "A vulnerability was found in SourceCodester Barangay Population Monitoring System up to 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /endpoint/update-resident.php. The manipulation of the argument full_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255380.", "poc": ["https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Barangay%20Population%20Monitoring%20System/Stored%20XSS%20update-resident.php%20.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28756", "desc": "The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (MitM) attacker to read and alter all network traffic between the application and the server.", "poc": ["https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-012.txt", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-35231", "desc": "rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.", "poc": ["https://github.com/Sim4n6/Sim4n6"]}, {"cve": "CVE-2024-24830", "desc": "OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the \"/api/{org_id}/users\" endpoint. This vulnerability allows any authenticated regular user ('member') to add new users with elevated privileges, including the 'root' role, to an organization. This issue circumvents the intended security controls for role assignments. The vulnerability resides in the user creation process, where the payload does not validate the user roles. A regular user can manipulate the payload to assign root-level privileges. This vulnerability leads to Unauthorized Privilege Escalation and significantly compromises the application's role-based access control system. It allows unauthorized control over application resources and poses a risk to data security. All users, particularly those in administrative roles, are impacted. This issue has been addressed in release version 0.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/openobserve/openobserve/security/advisories/GHSA-hfxx-g56f-8h5v"]}, {"cve": "CVE-2024-30872", "desc": "netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /include/authrp.php.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-33424", "desc": "A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Downloads parameter under the Language section.", "poc": ["https://github.com/adiapera/xss_language_cmsimple_5.15", "https://github.com/adiapera/xss_language_cmsimple_5.15"]}, {"cve": "CVE-2024-24479", "desc": "** DISPUTED ** A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28635", "desc": "Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.", "poc": ["https://packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-26152", "desc": "", "poc": ["https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6xv9-957j-qfhg", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24680", "desc": "An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.", "poc": ["https://github.com/ch4n3-yoon/ch4n3-yoon", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1193", "desc": "A vulnerability was found in Navicat 12.0.29. It has been rated as problematic. This issue affects some unknown processing of the component MySQL Conecction Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252683. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.252683"]}, {"cve": "CVE-2024-31216", "desc": "The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to version 1.2.5, when source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. This vulnerability was fixed in source-controller v1.2.5. There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27011", "desc": "In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: fix memleak in map from abort pathThe delete set command does not rely on the transaction object forelement removal, therefore, a combination of delete element + delete setfrom the abort path could result in restoring twice the refcount of themapping.Check for inactive element in the next generation for the delete elementcommand in the abort path, skip restoring state if next generation bithas been already cleared. This is similar to the activate logic usingthe set walk iterator.[ 6170.286929] ------------[ cut here ]------------[ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables][ 6170.287071] Modules linked in: [...][ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365[ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables][ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 <0f> 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f[ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202[ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000[ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750[ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55[ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10[ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100[ 6170.287940] FS: 0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000[ 6170.287948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0[ 6170.287962] Call Trace:[ 6170.287967] [ 6170.287973] ? __warn+0x9f/0x1a0[ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables][ 6170.288092] ? report_bug+0x1b1/0x1e0[ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables][ 6170.288092] ? report_bug+0x1b1/0x1e0[ 6170.288104] ? handle_bug+0x3c/0x70[ 6170.288112] ? exc_invalid_op+0x17/0x40[ 6170.288120] ? asm_exc_invalid_op+0x1a/0x20[ 6170.288132] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables][ 6170.288243] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables][ 6170.288366] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables][ 6170.288483] nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-36053", "desc": "In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in check_connection, drop_data_received_cb, and Service.remove. A user can modify a service name in a ~/.linuxmint/mintUpload/services/service file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3002", "desc": "A vulnerability, which was classified as critical, was found in code-projects Online Book System 1.0. Affected is an unknown function of the file /description.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258204.", "poc": ["https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System-%20SQL%20Injection%20-%204.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4918", "desc": "A vulnerability was found in Campcodes Online Examination System 1.0. It has been classified as critical. This affects an unknown part of the file updateQuestion.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264453 was assigned to this vulnerability.", "poc": ["https://github.com/yylmm/CVE/blob/main/Online%20Examination%20System%20With%20Timer/SQL_updateQuestion.md"]}, {"cve": "CVE-2024-23653", "desc": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.", "poc": ["https://github.com/mightysai1997/leaky-vessels-dynamic-detector", "https://github.com/snyk/leaky-vessels-dynamic-detector", "https://github.com/snyk/leaky-vessels-static-detector"]}, {"cve": "CVE-2024-22262", "desc": "Applications that use UriComponentsBuilder\u00a0to parse an externally provided URL (e.g. through a query parameter) AND\u00a0perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html \u00a0attack or to a SSRF attack if the URL is used after passing validation checks.This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 \u00a0and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.", "poc": ["https://github.com/SeanPesce/CVE-2024-22243", "https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-3907", "desc": "A vulnerability was found in Tenda AC500 2.0.1.9(1307). It has been rated as critical. This issue affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261143. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/formSetCfm.md"]}, {"cve": "CVE-2024-25652", "desc": "In Delinea PAM Secret Server 11.4, it is possible for a user (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users.", "poc": ["https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32980", "desc": "Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `\"self\"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23732", "desc": "The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4123", "desc": "A vulnerability, which was classified as critical, has been found in Tenda W15E 15.11.0.14. Affected by this issue is the function formSetPortMapping of the file /goform/SetPortMapping. The manipulation of the argument portMappingServer/portMappingProtocol/portMappingWan/porMappingtInternal/portMappingExternal leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W15Ev1.0/formSetPortMapping.md"]}, {"cve": "CVE-2024-2405", "desc": "The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.", "poc": ["https://wpscan.com/vulnerability/c42ffa15-6ebe-4c70-9e51-b95bd05ea04d/"]}, {"cve": "CVE-2024-23610", "desc": "An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-33671", "desc": "An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perform arbitrary file deletion on protected files.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3910", "desc": "A vulnerability, which was classified as critical, has been found in Tenda AC500 2.0.1.9(1307). Affected by this issue is the function fromDhcpListClient of the file /goform/DhcpListClient. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261146 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/fromDhcpListClient_page.md"]}, {"cve": "CVE-2024-27998", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager allows Reflected XSS.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.5.3.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-29948", "desc": "There is an out-of-bounds read vulnerability in some Hikvision NVRs. An authenticated attacker could exploit this vulnerability by sending specially crafted messages to a vulnerable device, causing a service abnormality.", "poc": ["https://github.com/LOURC0D3/ENVY-gitbook", "https://github.com/LOURC0D3/LOURC0D3"]}, {"cve": "CVE-2024-31771", "desc": "Insecure Permission vulnerability in TotalAV v.6.0.740 allows a local attacker to escalate privileges via a crafted file", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/restdone/CVE-2024-31771"]}, {"cve": "CVE-2024-4298", "desc": "The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20860", "desc": "Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reboot the device without proper permission.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0732", "desc": "A vulnerability was found in PCMan FTP Server 2.0.7 and classified as problematic. This issue affects some unknown processing of the component STOR Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251555.", "poc": ["https://fitoxs.com/vuldb/02-PCMan%20v2.0.7-exploit.txt"]}, {"cve": "CVE-2024-2724", "desc": "SQL injection vulnerability in the CIGESv2 system, through\u00a0/ajaxServiciosAtencion.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-4418", "desc": "A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being \"freed\" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21431", "desc": "Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-26626", "desc": "In the Linux kernel, the following vulnerability has been resolved:ipmr: fix kernel panic when forwarding mcast packetsThe stacktrace was:[ 86.305548] BUG: kernel NULL pointer dereference, address: 0000000000000092[ 86.306815] #PF: supervisor read access in kernel mode[ 86.307717] #PF: error_code(0x0000) - not-present page[ 86.308624] PGD 0 P4D 0[ 86.309091] Oops: 0000 [#1] PREEMPT SMP NOPTI[ 86.309883] CPU: 2 PID: 3139 Comm: pimd Tainted: G U 6.8.0-6wind-knet #1[ 86.311027] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014[ 86.312728] RIP: 0010:ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985)[ 86.313399] Code: f9 1f 0f 87 85 03 00 00 48 8d 04 5b 48 8d 04 83 49 8d 44 c5 00 48 8b 40 70 48 39 c2 0f 84 d9 00 00 00 49 8b 46 58 48 83 e0 fe <80> b8 92 00 00 00 00 0f 84 55 ff ff ff 49 83 47 38 01 45 85 e4 0f[ 86.316565] RSP: 0018:ffffad21c0583ae0 EFLAGS: 00010246[ 86.317497] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000[ 86.318596] RDX: ffff9559cb46c000 RSI: 0000000000000000 RDI: 0000000000000000[ 86.319627] RBP: ffffad21c0583b30 R08: 0000000000000000 R09: 0000000000000000[ 86.320650] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001[ 86.321672] R13: ffff9559c093a000 R14: ffff9559cc00b800 R15: ffff9559c09c1d80[ 86.322873] FS: 00007f85db661980(0000) GS:ffff955a79d00000(0000) knlGS:0000000000000000[ 86.324291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[ 86.325314] CR2: 0000000000000092 CR3: 000000002f13a000 CR4: 0000000000350ef0[ 86.326589] Call Trace:[ 86.327036] [ 86.327434] ? show_regs (/build/work/knet/arch/x86/kernel/dumpstack.c:479)[ 86.328049] ? __die (/build/work/knet/arch/x86/kernel/dumpstack.c:421 /build/work/knet/arch/x86/kernel/dumpstack.c:434)[ 86.328508] ? page_fault_oops (/build/work/knet/arch/x86/mm/fault.c:707)[ 86.329107] ? do_user_addr_fault (/build/work/knet/arch/x86/mm/fault.c:1264)[ 86.329756] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)[ 86.330350] ? __irq_work_queue_local (/build/work/knet/kernel/irq_work.c:111 (discriminator 1))[ 86.331013] ? exc_page_fault (/build/work/knet/./arch/x86/include/asm/paravirt.h:693 /build/work/knet/arch/x86/mm/fault.c:1515 /build/work/knet/arch/x86/mm/fault.c:1563)[ 86.331702] ? asm_exc_page_fault (/build/work/knet/./arch/x86/include/asm/idtentry.h:570)[ 86.332468] ? ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985)[ 86.333183] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)[ 86.333920] ipmr_mfc_add (/build/work/knet/./include/linux/rcupdate.h:782 /build/work/knet/net/ipv4/ipmr.c:1009 /build/work/knet/net/ipv4/ipmr.c:1273)[ 86.334583] ? __pfx_ipmr_hash_cmp (/build/work/knet/net/ipv4/ipmr.c:363)[ 86.335357] ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470)[ 86.336135] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)[ 86.336854] ? ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470)[ 86.337679] do_ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:944)[ 86.338408] ? __pfx_unix_stream_read_actor (/build/work/knet/net/unix/af_unix.c:2862)[ 86.339232] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)[ 86.339809] ? aa_sk_perm (/build/work/knet/security/apparmor/include/cred.h:153 /build/work/knet/security/apparmor/net.c:181)[ 86.340342] ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:1415)[ 86.340859] raw_setsockopt (/build/work/knet/net/ipv4/raw.c:836)[ 86.341408] ? security_socket_setsockopt (/build/work/knet/security/security.c:4561 (discriminator 13))[ 86.342116] sock_common_setsockopt (/build/work/knet/net/core/sock.c:3716)[ 86.342747] do_sock_setsockopt (/build/work/knet/net/socket.c:2313)[ 86.343363] __sys_setsockopt (/build/work/knet/./include/linux/file.h:32 /build/work/kn---truncated---", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4586", "desc": "A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/shops_delivery.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263308. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Hckwzh/cms/blob/main/17.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1017", "desc": "A vulnerability was found in Gabriels FTP Server 1.2. It has been rated as problematic. This issue affects some unknown processing. The manipulation of the argument USERNAME leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-252287.", "poc": ["https://packetstormsecurity.com/files/176714/Gabriels-FTP-Server-1.2-Denial-Of-Service.html", "https://www.youtube.com/watch?v=wwHuXfYS8yQ"]}, {"cve": "CVE-2024-20842", "desc": "Improper Input Validation vulnerability in handling apdu of libsec-ril prior to SMR Apr-2024 Release 1 allows local privileged attackers to write out-of-bounds memory.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31419", "desc": "An information disclosure flaw was found in OpenShift Virtualization. The DownwardMetrics feature was introduced to expose host metrics to virtual machine guests and is enabled by default. This issue could expose limited host metrics of a node to any guest in any namespace without being explicitly enabled by an administrator.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2630", "desc": "Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1261", "desc": "A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controllers/merchant/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-253000.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2851", "desc": "A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257775. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/formSetSambaConf.md", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30678", "desc": "** DISPUTED ** An issue has been discovered in ROS2 Iron Irwini ROS_VERSION 2 and ROS_PYTHON_VERSION 3, where the system transmits messages in plaintext. This flaw exposes sensitive information, making it vulnerable to man-in-the-middle (MitM) attacks, and allowing attackers to intercept and access this data. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/yashpatelphd/CVE-2024-30678"]}, {"cve": "CVE-2024-30603", "desc": "Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/saveParentControlInfo_urls.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25572", "desc": "Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20657", "desc": "Windows Group Policy Elevation of Privilege Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-2913", "desc": "A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1725", "desc": "A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22902", "desc": "Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.", "poc": ["https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/", "https://github.com/Chocapikk/CVE-2024-22899-to-22903-ExploitChain", "https://github.com/Chocapikk/My-CVEs"]}, {"cve": "CVE-2024-0746", "desc": "A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20872", "desc": "Improper handling of insufficient privileges vulnerability in TalkbackSE prior to version Android 14 allows local attackers to modify setting value of TalkbackSE.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24230", "desc": "Komm.One CMS 10.4.2.14 has a Server-Side Template Injection (SSTI) vulnerability via the Velocity template engine. It allows remote attackers to execute arbitrary code via a URL that specifies java.lang.Runtime in conjunction with getRuntime().exec followed by an OS command.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0484", "desc": "A vulnerability, which was classified as critical, has been found in code-projects Fighting Cock Information System 1.0. This issue affects some unknown processing of the file admin/action/update_mother.php. The manipulation of the argument age_mother leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250589 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-33485", "desc": "SQL Injection vulnerability in CASAP Automated Enrollment System using PHP/MySQLi with Source Code V1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the login.php component", "poc": ["https://github.com/CveSecLook/cve/issues/17"]}, {"cve": "CVE-2024-1995", "desc": "The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 4.2.2. This makes it possible for authenticated attackers, with subscrber-level access and above, to retrieve post content that is password protected and/or private.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-2364", "desc": "A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320.", "poc": ["https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25156", "desc": "A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23130", "desc": "A maliciously crafted SLDASM, or SLDPRT files in ODXSW_DLL.dll when parsed through Autodesk AutoCAD could lead to a memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22410", "desc": "Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsoft at startup. If a malicious user has access to overwrite the program files directory it is possible to replace these DLLs and execute arbitrary code. It is the view of the blockchain development team that the threat posed by a hypothetical binary planting attack is minimal and represents a low-security risk. The vulnerable DLL files are from the Windows networking subsystem, the Visual C++ runtime, and low-level cryptographic primitives. Collectively these dependencies are required for a large ecosystem of applications, ranging from enterprise-level security applications to game engines, and don\u2019t represent a fundamental lack of security or oversight in the design and implementation of Creditcoin. The blockchain team takes the stance that running Creditcoin on Windows is officially unsupported and at best should be thought of as experimental.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29889", "desc": "GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.", "poc": ["https://github.com/PhDLeToanThang/itil-helpdesk", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24469", "desc": "Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the delete_post .php.", "poc": ["https://github.com/tang-0717/cms/blob/main/2.md"]}, {"cve": "CVE-2024-21059", "desc": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-28855", "desc": "ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including JavaScript, the execution of such scripts would be prevented by the Content Security Policy. Versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15 contain a patch for this issue. No known workarounds are available.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4529", "desc": "The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting card categories via CSRF attacks", "poc": ["https://wpscan.com/vulnerability/082ff0b8-2ecd-4292-832d-0a79e1ba8cb3/"]}, {"cve": "CVE-2024-21327", "desc": "Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24927", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme allows Reflected XSS.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24787", "desc": "On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a \"#cgo LDFLAGS\" directive.", "poc": ["https://github.com/LOURC0D3/CVE-2024-24787-PoC", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-26295", "desc": "Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.", "poc": ["https://github.com/kaje11/CVEs"]}, {"cve": "CVE-2024-0237", "desc": "The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL, moderator, access details etc", "poc": ["https://wpscan.com/vulnerability/73d1b00e-1f17-4d9a-bfc8-6bc43a46b90b/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22919", "desc": "swftools0.9.2 was discovered to contain a global-buffer-overflow vulnerability via the function parseExpression at swftools/src/swfc.c:2587.", "poc": ["https://github.com/matthiaskramm/swftools/issues/209", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30459", "desc": "Missing Authorization vulnerability in AIpost AI WP Writer.This issue affects AI WP Writer: from n/a through 3.6.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26031", "desc": "Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-22228", "desc": "Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cifssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3524", "desc": "A vulnerability, which was classified as problematic, has been found in Campcodes Online Event Management System 1.0. This issue affects some unknown processing of the file /views/process.php. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259895.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2726", "desc": "Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the application form without prior registration.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-3446", "desc": "A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2607", "desc": "Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A systems. Other operating systems are unaffected. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25318", "desc": "Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'pid' parameter in Hotel/admin/print.php?pid=2.", "poc": ["https://github.com/tubakvgc/CVEs/blob/main/Hotel%20Managment%20System/Hotel%20Managment%20System%20-%20SQL%20Injection-3.md", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tubakvgc/CVEs"]}, {"cve": "CVE-2024-33672", "desc": "An issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in NetBackup can be leveraged to perform arbitrary file deletion on protected files.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32866", "desc": "Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.", "poc": ["https://github.com/edmundhung/conform/security/advisories/GHSA-624g-8qjg-8qxf"]}, {"cve": "CVE-2024-21485", "desc": "Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server.\n**Note:**\nThis is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-DASHCORECOMPONENTS-6183084", "https://security.snyk.io/vuln/SNYK-JS-DASHHTMLCOMPONENTS-6226337", "https://security.snyk.io/vuln/SNYK-PYTHON-DASH-6226335", "https://security.snyk.io/vuln/SNYK-PYTHON-DASHCORECOMPONENTS-6226334", "https://security.snyk.io/vuln/SNYK-PYTHON-DASHHTMLCOMPONENTS-6226336", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23285", "desc": "This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.4. An app may be able to create symlinks to protected regions of the disk.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30402", "desc": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the Layer 2 Address Learning Daemon\u00a0(l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).When telemetry requests are sent to the device,\u00a0and the Dynamic Rendering Daemon (drend) is suspended, the l2ald crashes and restarts due to factors outside the attackers control. Repeated occurrences of these events causes a sustained DoS condition.This issue affects:Junos OS: * All versions earlier than\u00a020.4R3-S10; * 21.2 versions earlier than\u00a021.2R3-S7; * 21.4 versions earlier than\u00a021.4R3-S5; * 22.1 versions earlier than\u00a022.1R3-S4; * 22.2 versions earlier than\u00a022.2R3-S3; * 22.3 versions earlier than\u00a022.3R3-S1; * 22.4 versions earlier than\u00a022.4R3; * 23.2 versions earlier than\u00a023.2R1-S2, 23.2R2.Junos OS Evolved: * All versions earlier than\u00a021.4R3-S5-EVO; * 22.1-EVO versions earlier than\u00a022.1R3-S4-EVO; * 22.2-EVO versions earlier than\u00a022.2R3-S3-EVO; * 22.3-EVO versions earlier than\u00a022.3R3-S1-EVO; * 22.4-EVO versions earlier than\u00a022.4R3-EVO; * 23.2-EVO versions earlier than\u00a023.2R2-EVO.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25678", "desc": "In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.", "poc": ["https://github.com/QUICTester/QUICTester", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22120", "desc": "Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection.", "poc": ["https://support.zabbix.com/browse/ZBX-24505", "https://github.com/GhostTroops/TOP", "https://github.com/W01fh4cker/CVE-2024-22120-RCE", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/fireinrain/github-trending", "https://github.com/johe123qwe/github-trending", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sampsonv/github-trending", "https://github.com/tanjiti/sec_profile", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/wy876/wiki", "https://github.com/zhaoxiaoha/github-trending"]}, {"cve": "CVE-2024-1290", "desc": "The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts.", "poc": ["https://wpscan.com/vulnerability/a60187d4-9491-435a-bc36-8dd348a1ffa3/"]}, {"cve": "CVE-2024-0456", "desc": "An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project", "poc": ["https://github.com/0xfschott/CVE-search", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-24386", "desc": "An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.", "poc": ["https://github.com/erick-duarte/CVE-2024-24386", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-1651", "desc": "Torrentpier version 2.4.1 allows executing arbitrary commands on the server.This is possible because the application is vulnerable to insecure deserialization.", "poc": ["https://github.com/Whiteh4tWolf/CVE-2024-1651-PoC", "https://github.com/hy011121/CVE-2024-1651-exploit-RCE", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sharpicx/CVE-2024-1651-PoC"]}, {"cve": "CVE-2024-25859", "desc": "A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24567", "desc": "Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. This vulnerability affects 0.3.10 and earlier versions.", "poc": ["https://github.com/brains93/CVE-2024-24576-PoC-Python", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-20768", "desc": "Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-0769", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.", "poc": ["https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2275", "desc": "A vulnerability, which was classified as problematic, was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0. Affected is an unknown function of the component OBS Patient/Gynee Prescription. The manipulation of the argument Patient Title/Full Name/Address/Cheif Complain/LMP/Menstrual Edd/OBS P/OBS Alc/Medicine Name/Medicine Type/Ml/Dose/Days/Comments/Template Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256044. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Srivishnu-p/CVEs-and-Vulnerabilities", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21907", "desc": "Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.", "poc": ["https://alephsecurity.com/vulns/aleph-2018004", "https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678", "https://github.com/aargenveldt/SbomTest"]}, {"cve": "CVE-2024-5145", "desc": "A vulnerability was found in SourceCodester Vehicle Management System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /newdriver.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265289 was assigned to this vulnerability.", "poc": ["https://github.com/CveSecLook/cve/issues/38", "https://github.com/CveSecLook/cve/issues/38CVE-2005-1275", "https://github.com/CveSecLook/cve/issues/38CVE-2020-7009"]}, {"cve": "CVE-2024-31380", "desc": "Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection.This issue affects Oxygen Builder: from n/a through 4.8.2.", "poc": ["https://patchstack.com/articles/unpatched-authenticated-rce-in-oxygen-and-breakdance-builder?_s_id=cve", "https://snicco.io/vulnerability-disclosure/oxygen/client-control-remote-code-execution-oxygen-4-8-1?_s_id=cve", "https://github.com/Chokopik/CVE-2024-31380-POC", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-1559", "desc": "The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3034", "desc": "The BackUpWordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.13 via the hmbkp_directory_browse parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to traverse directories outside of the context in which the plugin should allow.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23877", "desc": "A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/currencycreate.php, in the currencyid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29832", "desc": "The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue.Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26269", "desc": "Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25651", "desc": "User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29896", "desc": "Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be \"allow-listing\" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-33339", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/balckgu1/Poc", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-21351", "desc": "Windows SmartScreen Security Feature Bypass Vulnerability", "poc": ["https://github.com/GarethPullen/Powershell-Scripts", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29983", "desc": "Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25313", "desc": "Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/teacher_login.php.", "poc": ["https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20Authentication%20Bypass%20-%202.md", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tubakvgc/CVEs"]}, {"cve": "CVE-2024-29944", "desc": "An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-27613", "desc": "Numbas editor before 7.3 mishandles reading of themes and extensions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26629", "desc": "In the Linux kernel, the following vulnerability has been resolved:nfsd: fix RELEASE_LOCKOWNERThe test on so_count in nfsd4_release_lockowner() is nonsense andharmful. Revert to using check_for_locks(), changing that to not sleep.First: harmful.As is documented in the kdoc comment for nfsd4_release_lockowner(), thetest on so_count can transiently return a false positive resulting in areturn of NFS4ERR_LOCKS_HELD when in fact no locks are held. This isclearly a protocol violation and with the Linux NFS client it can causeincorrect behaviour.If RELEASE_LOCKOWNER is sent while some other thread is stillprocessing a LOCK request which failed because, at the time that requestwas received, the given owner held a conflicting lock, then the nfsdthread processing that LOCK request can hold a reference (conflock) tothe lock owner that causes nfsd4_release_lockowner() to return anincorrect error.The Linux NFS client ignores that NFS4ERR_LOCKS_HELD error because itnever sends NFS4_RELEASE_LOCKOWNER without first releasing any locks, soit knows that the error is impossible. It assumes the lock owner was infact released so it feels free to use the same lock owner identifier insome later locking request.When it does reuse a lock owner identifier for which a previous RELEASEfailed, it will naturally use a lock_seqid of zero. However the server,which didn't release the lock owner, will expect a larger lock_seqid andso will respond with NFS4ERR_BAD_SEQID.So clearly it is harmful to allow a false positive, which testingso_count allows.The test is nonsense because ... well... it doesn't mean anything.so_count is the sum of three different counts.1/ the set of states listed on so_stateids2/ the set of active vfs locks owned by any of those states3/ various transient counts such as for conflicting locks.When it is tested against '2' it is clear that one of these is thetransient reference obtained by find_lockowner_str_locked(). It is notclear what the other one is expected to be.In practice, the count is often 2 because there is precisely one stateon so_stateids. If there were more, this would fail.In my testing I see two circumstances when RELEASE_LOCKOWNER is called.In one case, CLOSE is called before RELEASE_LOCKOWNER. That results inall the lock states being removed, and so the lockowner being discarded(it is removed when there are no more references which usually happenswhen the lock state is discarded). When nfsd4_release_lockowner() findsthat the lock owner doesn't exist, it returns success.The other case shows an so_count of '2' and precisely one state listedin so_stateid. It appears that the Linux client uses a separate lockowner for each file resulting in one lock state per lock owner, so thistest on '2' is safe. For another client it might not be safe.So this patch changes check_for_locks() to use the (newish)find_any_file_locked() so that it doesn't take a reference on thenfs4_file and so never calls nfsd_file_put(), and so never sleeps. Withthis check is it safe to restore the use of check_for_locks() ratherthan testing so_count against the mysterious '2'.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34490", "desc": "In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controlled by a local attacker who can create files in advance with these names. This affects, for example, plot2d.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26594", "desc": "In the Linux kernel, the following vulnerability has been resolved:ksmbd: validate mech token in session setupIf client send invalid mech token in session setup request, ksmbdvalidate and make the error if it is invalid.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31009", "desc": "SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php.", "poc": ["https://github.com/ss122-0ss/semcms/blob/main/README.md"]}, {"cve": "CVE-2024-23477", "desc": "The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25932", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Manish Kumar Agarwal Change Table Prefix.This issue affects Change Table Prefix: from n/a through 2.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21117", "desc": "Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8.5.6 and 8.5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-0155", "desc": "Dell Digital Delivery, versions prior to 5.0.86.0, contain a Use After Free Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to an application crash or execution of arbitrary code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27226", "desc": "In tmu_config_gov_params of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0166", "desc": "Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_tcpdump utility. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands with elevated privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-33345", "desc": "D-Link DIR-823G A1V1.0.2B05 was found to contain a Null-pointer dereference in the main function of upload_firmware.cgi, which allows remote attackers to cause a Denial of Service (DoS) via a crafted input.", "poc": ["https://github.com/n0wstr/IOTVuln/tree/main/DIR-823g/UploadFirmware"]}, {"cve": "CVE-2024-29449", "desc": "** DISPUTED ** An issue was discovered in ROS2 Humble Hawksbill in ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows attackers to obtain sensitive information via man-in-the-middle attacks due to cleartext transmission of data across the ROS2 nodes' communication channels. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2024-29449"]}, {"cve": "CVE-2024-30727", "desc": "** DISPUTED ** An issue was discovered in ROS Kinetic Kame in Kinetic Kame ROS_VERSION 1 and ROS_ PYTHON_VERSION 3, where the system transmits messages in plaintext, allowing attackers to obtain sensitive information via a man-in-the-middle attack. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/yashpatelphd/CVE-2024-30727"]}, {"cve": "CVE-2024-26542", "desc": "Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a crafted payload to the Groups Display name field.", "poc": ["https://github.com/c0d3x27/CVEs/blob/main/CVE-2024-26542/README.md"]}, {"cve": "CVE-2024-1015", "desc": "Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from the operating system to the system via the web configuration functionality of the device.", "poc": ["https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28065", "desc": "In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root password hash.", "poc": ["https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-007.txt"]}, {"cve": "CVE-2024-31634", "desc": "Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \\XunRuiCMS\\dayrui\\Fcms\\Library.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22817", "desc": "FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte", "poc": ["https://github.com/mafangqian/cms/blob/main/1.md"]}, {"cve": "CVE-2024-21371", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28401", "desc": "TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wireless Page.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-5093", "desc": "A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265072.", "poc": ["https://github.com/BurakSevben/CVEs/blob/main/House%20Rental%20Management%20System/House%20Rental%20Management%20System%20-%20Authentication%20Bypass.md"]}, {"cve": "CVE-2024-0271", "desc": "A vulnerability has been found in Kashipara Food Management System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file addmaterial_edit.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249826 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3218", "desc": "A vulnerability classified as critical has been found in Shibang Communications IP Network Intercom Broadcasting System 1.0. This affects an unknown part of the file /php/busyscreenshotpush.php. The manipulation of the argument jsondata[callee]/jsondata[imagename] leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259065 was assigned to this vulnerability.", "poc": ["https://github.com/garboa/cve_3/blob/main/file_put_content.md"]}, {"cve": "CVE-2024-4085", "desc": "The Tabellen von faustball.com plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29515", "desc": "File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the save.php and config.php component.", "poc": ["https://github.com/zzq66/cve7/"]}, {"cve": "CVE-2024-5134", "desc": "A vulnerability was found in SourceCodester Electricity Consumption Monitoring Tool 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-bill.php. The manipulation of the argument bill leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-265210 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/BurakSevben/CVEs/blob/main/Electricity%20Consumption%20Monitoring%20Tool/Electricity%20Consumption%20Monitoring%20Tool%20-%20SQL%20Injection.md"]}, {"cve": "CVE-2024-24001", "desc": "jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() function of jshERP which allows an attacker to construct malicious payload to bypass jshERP's protection mechanism.", "poc": ["https://github.com/jishenghua/jshERP/issues/99"]}, {"cve": "CVE-2024-22651", "desc": "There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.", "poc": ["https://github.com/goldds96/Report/blob/main/DLink/DIR-815/CI.md"]}, {"cve": "CVE-2024-21651", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3906", "desc": "A vulnerability was found in Tenda AC500 2.0.1.9(1307). It has been declared as critical. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-261142 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/formQuickIndex.md"]}, {"cve": "CVE-2024-24863", "desc": "In malidp_mw_connector_reset, new memory is allocated with kzalloc, but no check is performed. In order to prevent null pointer dereferencing, ensure that mw_state is checked before calling __drm_atomic_helper_connector_reset.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22768", "desc": "Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.", "poc": ["https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-3543", "desc": "Use of reversible password encryption algorithm allows attackers to decrypt passwords.\u00a0 Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21475", "desc": "Memory corruption when the payload received from firmware is not as per the expected protocol size.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32795", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io \u2013 Easy Meeting Scheduler.This issue affects WPCal.Io \u2013 Easy Meeting Scheduler: from n/a through 0.9.5.8.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3642", "desc": "The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/dc44d85f-afe8-4824-95b0-11b9abfb04d8/"]}, {"cve": "CVE-2024-24817", "desc": "Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to version 0.4, event invitees created in topics in private categories or PMs (private messages) can be retrieved by anyone, even if they're not logged in. This problem is resolved in version 0.4 of the discourse-calendar plugin. While no known workaround is available, putting the site behind `login_required` will disallow this endpoint to be used by anonymous users, but logged in users can still get the list of invitees in the private topics.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26557", "desc": "Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter.", "poc": ["https://github.com/Hebing123/cve/issues/18", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23865", "desc": "A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/taxstructurelist.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2682", "desc": "A vulnerability classified as problematic has been found in Campcodes Online Job Finder System 1.0. Affected is an unknown function of the file /admin/employee/controller.php. The manipulation of the argument EMPLOYEEID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257382 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-24936", "desc": "In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4847", "desc": "The Alt Text AI \u2013 Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the \u2018last_post_id\u2019 parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0904", "desc": "The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/baf4afc9-c20e-47d6-a798-75e15652d1e3/"]}, {"cve": "CVE-2024-21080", "desc": "Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: REST Services). Supported versions that are affected are 12.2.9-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-25448", "desc": "An issue in the imlib_free_image_and_decache function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image.", "poc": ["https://github.com/derf/feh/issues/711", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25381", "desc": "There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.", "poc": ["https://github.com/Ox130e07d/CVE-2024-25381", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-20016", "desc": "In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation Patch ID: ALPS07835901; Issue ID: ALPS07835901.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24573", "desc": "facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.", "poc": ["https://github.com/WillyXJ/facileManager/security/advisories/GHSA-w67q-pp62-j4pf"]}, {"cve": "CVE-2024-1474", "desc": "In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22368", "desc": "The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.", "poc": ["http://www.openwall.com/lists/oss-security/2024/01/10/2", "https://github.com/haile01/perl_spreadsheet_excel_rce_poc/blob/main/parse_xlsx_bomb.md", "https://metacpan.org/dist/Spreadsheet-ParseXLSX/changes", "https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1702", "desc": "A vulnerability was found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /edit.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254390 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/omarexala/PHP-MYSQL-User-Login-System---SQL-Injection"]}, {"cve": "CVE-2024-0051", "desc": "In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://android.googlesource.com/platform/frameworks/av/+/a52c14a5b49f26efafa581dea653b4179d66909e"]}, {"cve": "CVE-2024-31356", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log.This issue affects User Activity Log: from n/a through 1.8.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0288", "desc": "A vulnerability classified as critical has been found in Kashipara Food Management System 1.0. This affects an unknown part of the file rawstock_used_damaged_submit.php. The manipulation of the argument product_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249849 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21002", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 2.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-20851", "desc": "Improper access control vulnerability in Samsung Data Store prior to version 5.3.00.4 allows local attackers to launch arbitrary activity with Samsung Data Store privilege.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25309", "desc": "Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'pass' parameter at School/teacher_login.php.", "poc": ["https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-7.md", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tubakvgc/CVEs"]}, {"cve": "CVE-2024-23829", "desc": "aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input. Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.", "poc": ["https://github.com/aio-libs/aiohttp/pull/8074", "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2"]}, {"cve": "CVE-2024-4559", "desc": "Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3000", "desc": "A vulnerability classified as critical was found in code-projects Online Book System 1.0. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument username/password/login_username/login_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258202 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System%20-%20Authentication%20Bypass.md", "https://github.com/FoxyProxys/CVE-2024-3000", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-29128", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Post SMTP POST SMTP allows Reflected XSS.This issue affects POST SMTP: from n/a through 2.8.6.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25869", "desc": "An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload of a crafted php file in the settings.php component.", "poc": ["https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-Unrestricted_Fileupload.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30923", "desc": "SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering", "poc": ["https://github.com/Chocapikk/My-CVEs", "https://github.com/Chocapikk/derbynet-research"]}, {"cve": "CVE-2024-28567", "desc": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the FreeImage_CreateICCProfile() function when reading images in TIFF format.", "poc": ["https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-21385", "desc": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-2392", "desc": "The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21105", "desc": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 2.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-33250", "desc": "An issue in Open-Source Technology Committee SRS real-time video server RS/4.0.268(Leo) and SRS/4.0.195(Leo) allows a remote attacker to execute arbitrary code via a crafted request.", "poc": ["https://github.com/hacker2004/cccccckkkkkk/blob/main/CVE-2024-33250.md"]}, {"cve": "CVE-2024-2133", "desc": "A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0. This affects an unknown part of the file /dashboard/Cinvoice/manage_invoice of the component Manage Sale Page. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255495.", "poc": ["https://vuldb.com/?id.255495", "https://github.com/Srivishnu-p/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2024-26349", "desc": "flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_translation.php", "poc": ["https://github.com/Icycu123/cms/blob/main/1.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23867", "desc": "A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/statecreate.php, in the stateid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4334", "desc": "The Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the \u2018typing_cursor\u2019 parameter in versions up to, and including, 2.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4624", "desc": "The Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018eael_ext_toc_title_tag\u2019 parameter in versions up to, and including, 5.9.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21672", "desc": "This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server.Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of\u00a0CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H allows an unauthenticated attacker to remotely expose assets in your environment susceptible to exploitation which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:* Confluence Data Center and Server 7.19: Upgrade to a release 7.19.18, or any higher 7.19.x release* Confluence Data Center and Server 8.5: Upgrade to a release 8.5.5 or any higher 8.5.x release* Confluence Data Center and Server 8.7: Upgrade to a release 8.7.2 or any higher releaseSee the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html ). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/swagcrafted/CVE-2024-21672-POC"]}, {"cve": "CVE-2024-21892", "desc": "On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE.Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set.This allows unprivileged users to inject code that inherits the process's elevated privileges.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20821", "desc": "A vulnerability possible to reconfigure OTP allows local attackers to transit RMA(Return Merchandise Authorization) mode, which disables security features. This attack needs additional privilege to control TEE.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24813", "desc": "Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access to data which the user doesn't have permission to access. Versions 14.64.0 and 15.0.0 contain a patch for this issue. No known workarounds are available.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-28394", "desc": "An issue in Advanced Plugins reportsstatistics v1.3.20 and before allows a remote attacker to execute arbitrary code via the Sales Reports, Statistics, Custom Fields & Export module.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-1860", "desc": "The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_add_whitelist() function in all versions up to, and including, 4.51. This makes it possible for unauthenticated attackers to add their IP Address to the whitelist circumventing protection", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26369", "desc": "An issue in the HistoryQosPolicy component of FastDDS v2.12.x, v2.11.x, v2.10.x, and v2.6.x leads to a SIGABRT (signal abort) upon receiving DataWriter's data.", "poc": ["https://github.com/eProsima/Fast-DDS/issues/4365", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3231", "desc": "The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.", "poc": ["https://wpscan.com/vulnerability/81dbb5c0-ccdd-4af1-b2f2-71cb1b37fe93/"]}, {"cve": "CVE-2024-0220", "desc": "B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22088", "desc": "Lotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, because realloc is mishandled.", "poc": ["https://github.com/chendotjs/lotos/issues/7", "https://github.com/Halcy0nic/Trophies", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/skinnyrad/Trophies"]}, {"cve": "CVE-2024-1292", "desc": "The wpb-show-core WordPress plugin before 2.6 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/56d4fc48-d0dc-4ac6-93cd-f64d4c3c5c07/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4238", "desc": "A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this vulnerability is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AX/AX1806/formSetDeviceName_devName.md"]}, {"cve": "CVE-2024-24549", "desc": "Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-4367", "desc": "A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.", "poc": ["https://github.com/LOURC0D3/CVE-2024-4367-PoC", "https://github.com/Threekiii/Awesome-POC", "https://github.com/avalahEE/pdfjs_disable_eval", "https://github.com/google/fishy-pdf", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/s4vvysec/CVE-2024-4367-POC", "https://github.com/spaceraccoon/detect-cve-2024-4367", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-4589", "desc": "A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede/mytag_edit.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263311. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Hckwzh/cms/blob/main/20.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0213", "desc": "A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service (DoS), through exploiting a memory corruption issue in the TA service, which runs as root. This may also result in the disabling of event reporting to ePO, caused by failure to validate input from the file correctly.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10416", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3689", "desc": "A vulnerability classified as problematic has been found in Zhejiang Land Zongheng Network Technology O2OA up to 20240403. Affected is an unknown function of the file /x_portal_assemble_surface/jaxrs/portal/list?v=8.2.3-4-43f4fe3. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-260478 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4521", "desc": "A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file /view/teacher_salary_details2.php. The manipulation of the argument index leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263124.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4372", "desc": "The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/13dcfd8a-e378-44b4-af6f-940bc41539a4/"]}, {"cve": "CVE-2024-21109", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-34230", "desc": "A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Information parameter.", "poc": ["https://github.com/Amrita2000/CVES/blob/main/CVE-2024-34230.md"]}, {"cve": "CVE-2024-34752", "desc": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Reflected XSS.This issue affects Landing Page Builder: from n/a through 1.5.1.8.", "poc": ["https://github.com/password123456/cves"]}, {"cve": "CVE-2024-27960", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution Email Subscription Popup allows Stored XSS.This issue affects Email Subscription Popup: from n/a through 1.2.20.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-26033", "desc": "Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-26462", "desc": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.", "poc": ["https://github.com/GrigGM/05-virt-04-docker-hw", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2024-30410", "desc": "An Incorrect Behavior Order in the routing engine (RE) of Juniper Networks Junos OS on EX4300 Series allows traffic intended to the device to reach the RE\u00a0instead of being discarded when the\u00a0discard term is set in loopback (lo0) interface. The intended function is that the lo0 firewall filter takes precedence over the revenue interface firewall filter.\u00a0This issue affects only IPv6 firewall filter.This issue only affects the EX4300 switch. No other products or platforms are affected by this vulnerability.\u00a0This issue affects Juniper Networks Junos OS: * All versions before 20.4R3-S10, * from 21.2 before 21.2R3-S7, * from 21.4 before 21.4R3-S6.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0655", "desc": "A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /novel/bookSetting/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251383.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1112", "desc": "Heap-based buffer overflow vulnerability in Resource Hacker, developed by Angus Johnson, affecting version 3.6.0.92. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31391", "desc": "Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator.This issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0.When asked to bootstrap Solr security, the operator will enable basic authentication and create several accounts for accessing Solr: including the \"solr\" and \"admin\" accounts for use by end-users, and a \"k8s-oper\" account which the operator uses for its own requests to Solr.One common source of these operator requests is healthchecks: liveness, readiness, and startup probes are all used to determine Solr's health and ability to receive traffic.By default, the operator configures the Solr APIs used for these probes to be exempt from authentication, but\u00a0users may specifically request that authentication be required on probe endpoints as well.Whenever one of these probes would fail, if authentication was in use, the Solr Operator would create a Kubernetes \"event\" containing the username and password of the \"k8s-oper\" account.Within the affected version range, this vulnerability affects any solrcloud resource which (1) bootstrapped security through use of the `.solrOptions.security.authenticationType=basic` option, and (2) required authentication be used on probes by setting `.solrOptions.security.probesRequireAuth=true`.Users are recommended to upgrade to Solr Operator version 0.8.1, which fixes this issue by ensuring that probes no longer print the credentials used for Solr requests.\u00a0 Users may also mitigate the vulnerability by disabling authentication on their healthcheck probes using the setting `.solrOptions.security.probesRequireAuth=false`.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21069", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-21644", "desc": "pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.", "poc": ["https://github.com/pyload/pyload/security/advisories/GHSA-mqpq-2p68-46fv", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/ltranquility/CVE-2024-21644-Poc", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-4512", "desc": "A vulnerability classified as problematic was found in SourceCodester Prison Management System 1.0. This vulnerability affects unknown code of the file /Employee/edit-profile.php. The manipulation of the argument txtfullname/txtdob/txtaddress/txtqualification/cmddept/cmdemployeetype/txtappointment leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263116.", "poc": ["https://github.com/yylmm/CVE/blob/main/Prison%20Management%20System/xss.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34341", "desc": "Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25559", "desc": "URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may be forced to access an arbitrary website when clicking a link in the audit log.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34486", "desc": "OFPPacketQueue in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPQueueProp.len=0.", "poc": ["https://github.com/faucetsdn/ryu/issues/190", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22256", "desc": "VMware Cloud Director contains a partial information disclosure vulnerability.\u00a0A malicious actor can potentially gather information about organization names based on the behavior of the instance.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22259", "desc": "Applications that use UriComponentsBuilder in Spring Framework\u00a0to parse an externally provided URL (e.g. through a query parameter) AND\u00a0perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html \u00a0attack or to a SSRF attack if the URL is used after passing validation checks.This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/SeanPesce/CVE-2024-22243", "https://github.com/ashrafsarhan/order-service", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-25453", "desc": "Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_StszAtom::GetSampleSize() function.", "poc": ["https://github.com/axiomatic-systems/Bento4/issues/204", "https://github.com/axiomatic-systems/Bento4/issues/874", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27933", "desc": "Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node child_process IPC relies on the JS side to pass the raw IPC file descriptor to `op_node_ipc_pipe()`, which returns a `IpcJsonStreamResource` ID associated with the file descriptor. On closing the resource, the raw file descriptor is closed together.Use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors. This allow standard input (fd 0) to be closed and re-opened for a different resource, which allows a silent permission prompt bypass. This is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions.This bug is known to be exploitable. There is a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions, additionally abusing the fact that Cache API lacks filesystem permission checks. The attack can be conducted silently as stderr can also be closed, suppressing all prompt outputs.Version 1.39.1 fixes the bug.", "poc": ["https://github.com/denoland/deno/security/advisories/GHSA-6q4w-9x56-rmwq"]}, {"cve": "CVE-2024-28323", "desc": "The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a potential security vulnerability related to user input validation. The script retrieves user-provided date inputs without proper validation, making it susceptible to SQL injection attacks.", "poc": ["https://packetstormsecurity.com/files/177168/User-Registration-And-Login-And-User-Management-System-3.1-SQL-Injection.html", "https://sospiro014.github.io/User-Registration-And-Login-And-User-Management-System-3.1-SQL-Injection", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30007", "desc": "Microsoft Brokering File System Elevation of Privilege Vulnerability", "poc": ["https://github.com/angelov-1080/CVE_Checker"]}, {"cve": "CVE-2024-29949", "desc": "There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary commands.", "poc": ["https://github.com/LOURC0D3/ENVY-gitbook", "https://github.com/LOURC0D3/LOURC0D3"]}, {"cve": "CVE-2024-27399", "desc": "In the Linux kernel, the following vulnerability has been resolved:Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeoutThere is a race condition between l2cap_chan_timeout() andl2cap_chan_del(). When we use l2cap_chan_del() to delete thechannel, the chan->conn will be set to null. But the conn couldbe dereferenced again in the mutex_lock() of l2cap_chan_timeout().As a result the null pointer dereference bug will happen. TheKASAN report triggered by POC is shown below:[ 472.074580] ==================================================================[ 472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0[ 472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7[ 472.075308][ 472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36[ 472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4[ 472.075308] Workqueue: events l2cap_chan_timeout[ 472.075308] Call Trace:[ 472.075308] [ 472.075308] dump_stack_lvl+0x137/0x1a0[ 472.075308] print_report+0x101/0x250[ 472.075308] ? __virt_addr_valid+0x77/0x160[ 472.075308] ? mutex_lock+0x68/0xc0[ 472.075308] kasan_report+0x139/0x170[ 472.075308] ? mutex_lock+0x68/0xc0[ 472.075308] kasan_check_range+0x2c3/0x2e0[ 472.075308] mutex_lock+0x68/0xc0[ 472.075308] l2cap_chan_timeout+0x181/0x300[ 472.075308] process_one_work+0x5d2/0xe00[ 472.075308] worker_thread+0xe1d/0x1660[ 472.075308] ? pr_cont_work+0x5e0/0x5e0[ 472.075308] kthread+0x2b7/0x350[ 472.075308] ? pr_cont_work+0x5e0/0x5e0[ 472.075308] ? kthread_blkcg+0xd0/0xd0[ 472.075308] ret_from_fork+0x4d/0x80[ 472.075308] ? kthread_blkcg+0xd0/0xd0[ 472.075308] ret_from_fork_asm+0x11/0x20[ 472.075308] [ 472.075308] ==================================================================[ 472.094860] Disabling lock debugging due to kernel taint[ 472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158[ 472.096136] #PF: supervisor write access in kernel mode[ 472.096136] #PF: error_code(0x0002) - not-present page[ 472.096136] PGD 0 P4D 0[ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI[ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G B 6.9.0-rc5-00356-g78c0094a146b #36[ 472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4[ 472.096136] Workqueue: events l2cap_chan_timeout[ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0[ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88[ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246[ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865[ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78[ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f[ 472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000[ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00[ 472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000[ 472.096136] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[ 472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0[ 472.096136] Call Trace:[ 472.096136] [ 472.096136] ? __die_body+0x8d/0xe0[ 472.096136] ? page_fault_oops+0x6b8/0x9a0[ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0[ 472.096136] ? do_user_addr_fault+0x1027/0x1340[ 472.096136] ? _printk+0x7a/0xa0[ 472.096136] ? mutex_lock+0x68/0xc0[ 472.096136] ? add_taint+0x42/0xd0[ 472.096136] ? exc_page_fault+0x6a/0x1b0[ 472.096136] ? asm_exc_page_fault+0x26/0x30[ 472.096136] ? mutex_lock+0x75/0xc0[ 472.096136] ? mutex_lock+0x88/0xc0[ 472.096136] ? mutex_lock+0x75/0xc0[ 472.096136] l2cap_chan_timeo---truncated---", "poc": ["https://git.kernel.org/stable/c/06acb75e7ed600d0bbf7bff5628aa8f24a97978c", "https://git.kernel.org/stable/c/6466ee65e5b27161c846c73ef407f49dfa1bd1d9", "https://git.kernel.org/stable/c/8960ff650aec70485b40771cd8e6e8c4cb467d33", "https://git.kernel.org/stable/c/955b5b6c54d95b5e7444dfc81c95c8e013f27ac0", "https://git.kernel.org/stable/c/adf0398cee86643b8eacde95f17d073d022f782c", "https://git.kernel.org/stable/c/e137e2ba96e51902dc2878131823a96bf8e638ae", "https://git.kernel.org/stable/c/e97e16433eb4533083b096a3824b93a5ca3aee79", "https://git.kernel.org/stable/c/eb86f955488c39526534211f2610e48a5cf8ead4"]}, {"cve": "CVE-2024-21798", "desc": "ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affected product with specially crafted content. When another administrative user logs in and operates the product, an arbitrary script may be executed on the web browser. Affected products and versions are as follows: WRC-1167GS2-B v1.67 and earlier, WRC-1167GS2H-B v1.67 and earlier, WRC-2533GS2-B v1.62 and earlier, WRC-2533GS2-W v1.62 and earlier, WRC-2533GS2V-B v1.62 and earlier, WRC-X3200GST3-B v1.25 and earlier, and WRC-G01-W v1.24 and earlier.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0698", "desc": "The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1096", "desc": "Twister Antivirus v8.17 is vulnerable to a Denial of Service vulnerability by triggering the 0x80112067, 0x801120CB 0x801120CC 0x80112044, 0x8011204B, 0x8011204F,\u00a00x80112057, 0x8011205B, 0x8011205F, 0x80112063, 0x8011206F,\u00a00x80112073, 0x80112077, 0x80112078, 0x8011207C\u00a0and 0x80112080\u00a0IOCTL codes of the fildds.sys\u00a0driver.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21025", "desc": "Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair, and Overhaul. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Complex Maintenance, Repair, and Overhaul, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Complex Maintenance, Repair, and Overhaul accessible data as well as unauthorized read access to a subset of Oracle Complex Maintenance, Repair, and Overhaul accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-23612", "desc": "An improper error handling vulnerability in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27140", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED **Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva.This issue affects Apache Archiva: from 2.0.0.As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL.NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27988", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-33215", "desc": "Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/addressNat.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29112", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Marketing Robot WooCommerce Google Feed Manager allows Stored XSS.This issue affects WooCommerce Google Feed Manager: from n/a through 2.2.0.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-4984", "desc": "The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018display_name\u2019 author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32313", "desc": "Tenda FH1205 V2.0.0.7(775) firmware has a stack overflow vulnerability located via the adslPwd parameter of the formWanParameterSetting function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formWanParameterSetting.md"]}, {"cve": "CVE-2024-28092", "desc": "UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, or RgParentalBasic.asp. The affected fields are SMTP Server Name, SMTP Username, Host Name, Time Server 1, Time Server 2, Time Server 3, Target, Add Keyword, Add Domain, and Add Allowed Domain.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/actuator/cve"]}, {"cve": "CVE-2024-23837", "desc": "LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.", "poc": ["https://redmine.openinfosecfoundation.org/issues/6444", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-5135", "desc": "A vulnerability was found in PHPGurukul Directory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265211.", "poc": ["https://github.com/BurakSevben/CVEs/blob/main/Directory%20Management%20System/Directory%20Management%20System%20-%20SQL%20Injection%20-%201.md"]}, {"cve": "CVE-2024-20814", "desc": "Out-of-bounds Read in padmd_vld_ac_prog_refine of libpadm.so prior to SMR Feb-2024 Release 1 allows local attackers access unauthorized information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25848", "desc": "In the module \"Ever Ultimate SEO\" (everpsseo) <= 8.1.2 from Team Ever for PrestaShop, a guest can perform SQL injection in affected versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1361", "desc": "The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing or incorrect nonce validation on the apiCall() function. This makes it possible for unauthenticated attackers to call a limited set of functions that can be used to import images, delete posts, or save theme data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2452", "desc": "In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could cause an integer wrap-around and an allocation smaller than expected. This could cause subsequent heap buffer overflows.", "poc": ["https://github.com/0xdea/advisories", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hnsecurity/vulns"]}, {"cve": "CVE-2024-0931", "desc": "A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49_multi_TDE01. This vulnerability affects the function saveParentControlInfo. The manipulation of the argument deviceId/time/urls leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252136. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/saveParentControlInfo_1.md", "https://vuldb.com/?id.252136", "https://github.com/yaoyue123/iot"]}, {"cve": "CVE-2024-29239", "desc": "Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to inject SQL commands via unspecified vectors.", "poc": ["https://github.com/LOURC0D3/ENVY-gitbook", "https://github.com/LOURC0D3/LOURC0D3"]}, {"cve": "CVE-2024-2822", "desc": "A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/vote_edit.php. The manipulation of the argument aid leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-26781", "desc": "In the Linux kernel, the following vulnerability has been resolved:mptcp: fix possible deadlock in subflow diagSyzbot and Eric reported a lockdep splat in the subflow diag: WARNING: possible circular locking dependency detected 6.8.0-rc4-syzkaller-00212-g40b9385dd8e6 #0 Not tainted syz-executor.2/24141 is trying to acquire lock: ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline] ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137 but task is already holding lock: ffffc9000135e488 (&h->lhash2[i].lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffffc9000135e488 (&h->lhash2[i].lock){+.+.}-{2:2}, at: inet_diag_dump_icsk+0x39f/0x1f80 net/ipv4/inet_diag.c:1038 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&h->lhash2[i].lock){+.+.}-{2:2}: lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __inet_hash+0x335/0xbe0 net/ipv4/inet_hashtables.c:743 inet_csk_listen_start+0x23a/0x320 net/ipv4/inet_connection_sock.c:1261 __inet_listen_sk+0x2a2/0x770 net/ipv4/af_inet.c:217 inet_listen+0xa3/0x110 net/ipv4/af_inet.c:239 rds_tcp_listen_init+0x3fd/0x5a0 net/rds/tcp_listen.c:316 rds_tcp_init_net+0x141/0x320 net/rds/tcp.c:577 ops_init+0x352/0x610 net/core/net_namespace.c:136 __register_pernet_operations net/core/net_namespace.c:1214 [inline] register_pernet_operations+0x2cb/0x660 net/core/net_namespace.c:1283 register_pernet_device+0x33/0x80 net/core/net_namespace.c:1370 rds_tcp_init+0x62/0xd0 net/rds/tcp.c:735 do_one_initcall+0x238/0x830 init/main.c:1236 do_initcall_level+0x157/0x210 init/main.c:1298 do_initcalls+0x3f/0x80 init/main.c:1314 kernel_init_freeable+0x42f/0x5d0 init/main.c:1551 kernel_init+0x1d/0x2a0 init/main.c:1441 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 -> #0 (k-sk_lock-AF_INET6){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18ca/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 lock_sock_fast include/net/sock.h:1723 [inline] subflow_get_info+0x166/0xd20 net/mptcp/diag.c:28 tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline] tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137 inet_sk_diag_fill+0x10ed/0x1e00 net/ipv4/inet_diag.c:345 inet_diag_dump_icsk+0x55b/0x1f80 net/ipv4/inet_diag.c:1061 __inet_diag_dump+0x211/0x3a0 net/ipv4/inet_diag.c:1263 inet_diag_dump_compat+0x1c1/0x2d0 net/ipv4/inet_diag.c:1371 netlink_dump+0x59b/0xc80 net/netlink/af_netlink.c:2264 __netlink_dump_start+0x5df/0x790 net/netlink/af_netlink.c:2370 netlink_dump_start include/linux/netlink.h:338 [inline] inet_diag_rcv_msg_compat+0x209/0x4c0 net/ipv4/inet_diag.c:1405 sock_diag_rcv_msg+0xe7/0x410 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77As noted by Eric we can break the lock dependency chain avoiddumping ---truncated---", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4139", "desc": "Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can delete rules of other users affecting the integrity of the application. Confidentiality and Availability are not affected.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26709", "desc": "In the Linux kernel, the following vulnerability has been resolved:powerpc/iommu: Fix the missing iommu_group_put() during platform domain attachThe function spapr_tce_platform_iommu_attach_dev() is missing to calliommu_group_put() when the domain is already set. This refcount leakshows up with BUG_ON() during DLPAR remove operation as: KernelBug: Kernel bug in state 'None': kernel BUG at arch/powerpc/platforms/pseries/iommu.c:100! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=8192 NUMA pSeries Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_016) hv:phyp pSeries NIP: c0000000000ff4d4 LR: c0000000000ff4cc CTR: 0000000000000000 REGS: c0000013aed5f840 TRAP: 0700 Tainted: G I (6.8.0-rc3-autotest-g99bd3cb0d12e) MSR: 8000000000029033 CR: 44002402 XER: 20040000 CFAR: c000000000a0d170 IRQMASK: 0 ... NIP iommu_reconfig_notifier+0x94/0x200 LR iommu_reconfig_notifier+0x8c/0x200 Call Trace: iommu_reconfig_notifier+0x8c/0x200 (unreliable) notifier_call_chain+0xb8/0x19c blocking_notifier_call_chain+0x64/0x98 of_reconfig_notify+0x44/0xdc of_detach_node+0x78/0xb0 ofdt_write.part.0+0x86c/0xbb8 proc_reg_write+0xf4/0x150 vfs_write+0xf8/0x488 ksys_write+0x84/0x140 system_call_exception+0x138/0x330 system_call_vectored_common+0x15c/0x2ecThe patch adds the missing iommu_group_put() call.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4927", "desc": "A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/admin/ajax.php?action=save_product. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264463.", "poc": ["https://github.com/Hefei-Coffee/cve/blob/main/upload2.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3378", "desc": "A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.2.0.160 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-259501 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?submit.310642", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30696", "desc": "** DISPUTED ** OS command injection vulnerability in ROS2 Galactic Geochelone in ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the command processing or system call components in ROS2, including External Command Execution Modules, System Call Handlers, and Interface Scripts. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/yashpatelphd/CVE-2024-30696"]}, {"cve": "CVE-2024-20974", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21100", "desc": "Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Platform). Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. While the vulnerability is in Oracle Commerce Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 4.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-34251", "desc": "An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of service via the \"block_type_get_arity\" function in core/iwasm/interpreter/wasm.h.", "poc": ["https://github.com/bytecodealliance/wasm-micro-runtime/issues/3347", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23263", "desc": "A logic issue was addressed with improved validation. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28386", "desc": "An issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27013", "desc": "In the Linux kernel, the following vulnerability has been resolved:tun: limit printing rate when illegal packet received by tun devvhost_worker will call tun call backs to receive packets. If too manyillegal packets arrives, tun_do_read will keep dumping packet contents.When console is enabled, it will costs much more cpu time to dumppacket and soft lockup will be detected.net_ratelimit mechanism can be used to limit the dumping rate.PID: 33036 TASK: ffff949da6f20000 CPU: 23 COMMAND: \"vhost-32980\" #0 [fffffe00003fce50] crash_nmi_callback at ffffffff89249253 #1 [fffffe00003fce58] nmi_handle at ffffffff89225fa3 #2 [fffffe00003fceb0] default_do_nmi at ffffffff8922642e #3 [fffffe00003fced0] do_nmi at ffffffff8922660d #4 [fffffe00003fcef0] end_repeat_nmi at ffffffff89c01663 [exception RIP: io_serial_in+20] RIP: ffffffff89792594 RSP: ffffa655314979e8 RFLAGS: 00000002 RAX: ffffffff89792500 RBX: ffffffff8af428a0 RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000000005 RDI: ffffffff8af428a0 RBP: 0000000000002710 R8: 0000000000000004 R9: 000000000000000f R10: 0000000000000000 R11: ffffffff8acbf64f R12: 0000000000000020 R13: ffffffff8acbf698 R14: 0000000000000058 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #5 [ffffa655314979e8] io_serial_in at ffffffff89792594 #6 [ffffa655314979e8] wait_for_xmitr at ffffffff89793470 #7 [ffffa65531497a08] serial8250_console_putchar at ffffffff897934f6 #8 [ffffa65531497a20] uart_console_write at ffffffff8978b605 #9 [ffffa65531497a48] serial8250_console_write at ffffffff89796558 #10 [ffffa65531497ac8] console_unlock at ffffffff89316124 #11 [ffffa65531497b10] vprintk_emit at ffffffff89317c07 #12 [ffffa65531497b68] printk at ffffffff89318306 #13 [ffffa65531497bc8] print_hex_dump at ffffffff89650765 #14 [ffffa65531497ca8] tun_do_read at ffffffffc0b06c27 [tun] #15 [ffffa65531497d38] tun_recvmsg at ffffffffc0b06e34 [tun] #16 [ffffa65531497d68] handle_rx at ffffffffc0c5d682 [vhost_net] #17 [ffffa65531497ed0] vhost_worker at ffffffffc0c644dc [vhost] #18 [ffffa65531497f10] kthread at ffffffff892d2e72 #19 [ffffa65531497f50] ret_from_fork at ffffffff89c0022f", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4249", "desc": "A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been classified as critical. Affected is the function formwrlSSIDget of the file /goform/wifiSSIDget. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formwrlSSIDget.md"]}, {"cve": "CVE-2024-32963", "desc": "Navidrome is an open source web-based music collection server and streamer. In affected versions of Navidrome are subject to a parameter tampering vulnerability where an attacker has the ability to manipulate parameter values in the HTTP requests. The attacker is able to change the parameter values in the body and successfully impersonate another user. In this case, the attacker created a playlist, added song, posted arbitrary comment, set the playlist to be public, and put the admin as the owner of the playlist. The attacker must be able to intercept http traffic for this attack. Each known user is impacted. An attacker can obtain the ownerId from shared playlist information, meaning every user who has shared a playlist is also impacted, as they can be impersonated. This issue has been addressed in version 0.52.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/navidrome/navidrome/security/advisories/GHSA-4jrx-5w4h-3gpm"]}, {"cve": "CVE-2024-22134", "desc": "Server-Side Request Forgery (SSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27204", "desc": "In tmu_set_gov_active of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-30884", "desc": "Reflected Cross-Site Scripting (XSS) vulnerability in Discuz! version X3.4 20220811, allows remote attackers to execute arbitrary code and obtain sensitive information via crafted payload to the primarybegin parameter in the misc.php component.", "poc": ["https://github.com/Hebing123/cve/issues/28"]}, {"cve": "CVE-2024-25442", "desc": "An issue in the HuginBase::PanoramaMemento::loadPTScript function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a crafted image.", "poc": ["https://bugs.launchpad.net/hugin/+bug/2025032", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25207", "desc": "Barangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Resident function at /barangay-population-monitoring-system/masterlist.php. This vulnerabiity allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Contact Number parameter.", "poc": ["https://github.com/BurakSevben/CVEs/blob/main/Barangay%20Population%20Monitoring%20System/Barangay%20Population%20System%20-%20XSS-2.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28684", "desc": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.php", "poc": ["https://github.com/777erp/cms/blob/main/16.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29185", "desc": "FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file. The value of the php_path parameter is being executed as an OS command by the shell_exec function, without validating it. This allows an adversary to execute malicious OS commands on the server. A practical demonstration of the successful command injection attack extracted the /etc/passwd file of the server. This represented the complete compromise of the server hosting the FreeScout application. This attack requires an attacker to know the `App_Key` of the application. This limitation makes the Attack Complexity to be High. If an attacker gets hold of the `App_Key`, the attacker can compromise the Complete server on which the application is deployed. Version 1.8.128 contains a patch for this issue.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-33820", "desc": "Totolink AC1200 Wireless Dual Band Gigabit Router A3002R_V4 Firmware V4.0.0-B20230531.1404 is vulnerable to Buffer Overflow via the formWlEncrypt function of the boa server. Specifically, they exploit the length of the wlan_ssid field triggers the overflow.", "poc": ["https://gist.github.com/Swind1er/ee095fbfe13f77a5b45b39a5aa82bd17", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29937", "desc": "NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption.", "poc": ["https://www.youtube.com/watch?v=i_JOkHaCdzk", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-29062", "desc": "Secure Boot Security Feature Bypass Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34469", "desc": "Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.", "poc": ["https://github.com/Toxich4/CVE-2024-34469", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-3970", "desc": "Server Side Request Forgery vulnerability\u00a0has been discovered in OpenText\u2122 iManager 3.2.6.0200. Thiscould lead to senstive information disclosure by directory traversal.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28580", "desc": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the ReadData() function when reading images in RAS format.", "poc": ["https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-21104", "desc": "Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to compromise Oracle ZFS Storage Appliance Kit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-0310", "desc": "A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy configuration.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10417"]}, {"cve": "CVE-2024-4585", "desc": "A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/member_type.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263307. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Hckwzh/cms/blob/main/16.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0612", "desc": "The Content Views \u2013 Post Grid, Slider, Accordion (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-33899", "desc": "RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.", "poc": ["https://sdushantha.medium.com/ansi-escape-injection-vulnerability-in-winrar-a2cbfac4b983"]}, {"cve": "CVE-2024-1871", "desc": "A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. Affected is an unknown function of the file /process/assignp.php of the component Project Assignment Report. The manipulation of the argument pname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-254694 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20EMPLOYEE%20MANAGEMENT%20SYSTEM/XSS%20Vulnerability%20in%20Project%20Assignment%20Report.md", "https://vuldb.com/?id.254694", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25830", "desc": "F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the root and admin password.", "poc": ["https://neroteam.com/blog/f-logic-datacube3-vulnerability-report", "https://github.com/0xNslabs/CVE-2024-25832-PoC", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20030", "desc": "In da, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541632; Issue ID: ALPS08541741.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1971", "desc": "A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file login.php of the component POST Parameter Handler. The manipulation of the argument password with the input nochizplz'+or+1%3d1+limit+1%23 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255127.", "poc": ["https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/Surya2Developer%20Online_shopping_-system/SQL%20Injection%20Auth.md"]}, {"cve": "CVE-2024-28084", "desc": "p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact because of initialization issues in situations where parsing of advertised service information fails.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21851", "desc": "in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through integer overflow.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4855", "desc": "Use after free issue in editcap could cause denial of service via crafted capture file", "poc": ["https://gitlab.com/wireshark/wireshark/-/issues/19782", "https://gitlab.com/wireshark/wireshark/-/issues/19783", "https://gitlab.com/wireshark/wireshark/-/issues/19784", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0267", "desc": "A vulnerability classified as critical was found in Kashipara Hospital Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file login.php of the component Parameter Handler. The manipulation of the argument email/password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249823.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22049", "desc": "httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.", "poc": ["https://github.com/advisories/GHSA-5pq7-52mg-hr42", "https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23888", "desc": "A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/stocktransactionslist.php, in the itemidy parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24943", "desc": "In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-5220", "desc": "The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25875", "desc": "A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field.", "poc": ["https://github.com/dd3x3r/enhavo/blob/main/xss-page-content-header-undertitel-v0.13.1.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29278", "desc": "funboot v1.1 is vulnerable to Cross Site Scripting (XSS) via the title field in \"create a message .\"", "poc": ["https://github.com/QDming/cve", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-28328", "desc": "CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format.", "poc": ["https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/CSV-Injection-CVE%E2%80%902024%E2%80%9028328", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0575", "desc": "A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been classified as critical. This affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250791. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.250791"]}, {"cve": "CVE-2024-33782", "desc": "MP-SPDZ v0.3.8 was discovered to contain a stack overflow via the function OTExtensionWithMatrix::extend in /OT/OTExtensionWithMatrix.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted message.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3124", "desc": "A vulnerability classified as problematic has been found in fridgecow smartalarm 1.8.1 on Android. This affects an unknown part of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258867.", "poc": ["https://github.com/ctflearner/Android_Findings/blob/main/Smartalarm/Backup.md", "https://vuldb.com/?submit.307752", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29151", "desc": "Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22236", "desc": "In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava\u00a0dependency in the org.springframework.cloud:spring-cloud-contract-shade\u00a0dependency.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23054", "desc": "An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index (npm).", "poc": ["https://github.com/c0d3x27/CVEs/blob/main/CVE-2024-23054/README.md"]}, {"cve": "CVE-2024-26166", "desc": "Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-31650", "desc": "A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name parameter.", "poc": ["https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-31650.md"]}, {"cve": "CVE-2024-1267", "desc": "A vulnerability, which was classified as problematic, has been found in CodeAstro Restaurant POS System 1.0. Affected by this issue is some unknown functionality of the file create_account.php. The manipulation of the argument Full Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-253010 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26817", "desc": "In the Linux kernel, the following vulnerability has been resolved:amdkfd: use calloc instead of kzalloc to avoid integer overflowThis uses calloc instead of doing the multiplication which mightoverflow.", "poc": ["https://github.com/MaherAzzouzi/CVE-2024-26817-amdkfd", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-23109", "desc": "An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 7.1.0 through 7.1.1 and 7.0.0 through 7.0.2 and 6.7.0 through 6.7.8 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.2 and 6.4.0 through 6.4.2 allows attacker to execute unauthorized code or commands via via\u00a0crafted API requests.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21439", "desc": "Windows Telephony Server Elevation of Privilege Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-25828", "desc": "cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.", "poc": ["https://github.com/sec-Kode/cve", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0692", "desc": "The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds\u2019 service, resulting in remote code execution.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/f0ur0four/Insecure-Deserialization"]}, {"cve": "CVE-2024-22795", "desc": "Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status component.", "poc": ["https://github.com/Hagrid29/ForeScout-SecureConnector-EoP", "https://github.com/Hagrid29/ForeScout-SecureConnector-EoP"]}, {"cve": "CVE-2024-30621", "desc": "Tenda AX1803 v1.0.0.1 contains a stack overflow via the serverName parameter in the function fromAdvSetMacMtuWan.", "poc": ["https://github.com/re1wn/IoT_vuln/blob/main/Tenda_AX1803_v1.0.0.1_contains_a_stack_overflow_via_the_serverName_parameter_in_the_function_fromAdvSetMacMtuWan.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34308", "desc": "TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the function urldecode.", "poc": ["https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20LR350/README.md"]}, {"cve": "CVE-2024-4591", "desc": "A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/sys_group_add.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Hckwzh/cms/blob/main/22.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24803", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPoperation Ultra Companion \u2013 Companion plugin for WPoperation Themes allows Stored XSS.This issue affects Ultra Companion \u2013 Companion plugin for WPoperation Themes: from n/a through 1.1.9.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23642", "desc": "GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap SVG Output Format when the Simple SVG renderer is enabled. Access to the WMS SVG Format is available to all users by default although data and service security may limit users' ability to trigger the XSS. Versions 2.23.4 and 2.24.1 contain a fix for this issue.", "poc": ["https://github.com/geoserver/geoserver/security/advisories/GHSA-fg9v-56hw-g525", "https://osgeo-org.atlassian.net/browse/GEOS-11152", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3918", "desc": "The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/2074d0f5-4165-4130-9391-37cb21e8aa1b/"]}, {"cve": "CVE-2024-3188", "desc": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/bc273e75-7faf-4eaf-8ebd-efc5d6e9261f/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26475", "desc": "An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grub_sfs_read_extent function.", "poc": ["https://github.com/TronciuVlad/CVE-2024-26475", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-29049", "desc": "Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2614", "desc": "Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21632", "desc": "omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the `email` is used as a trusted user identifier. This could lead to account takeover. Version 2.0.0 contains a fix for this issue.", "poc": ["https://www.descope.com/blog/post/noauth", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2823", "desc": "A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/mda_main.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257710 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/lcg-22266/cms/blob/main/1.md", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-28417", "desc": "Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1844", "desc": "The RevivePress \u2013 Keep your Old Content Evergreen plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the import_data and copy_data functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with subscriber-level access or higher, to overwrite plugin settings and view them.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-2686", "desc": "A vulnerability has been found in Campcodes Online Job Finder System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/applicants/controller.php. The manipulation of the argument JOBREGID leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257386 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-0210", "desc": "Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file", "poc": ["https://gitlab.com/wireshark/wireshark/-/issues/19504"]}, {"cve": "CVE-2024-0855", "desc": "The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.", "poc": ["https://wpscan.com/vulnerability/5d5da91e-3f34-46b0-8db2-354a88bdf934/"]}, {"cve": "CVE-2024-26996", "desc": "In the Linux kernel, the following vulnerability has been resolved:usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport errorWhen ncm function is working and then stop usb0 interface for link down,eth_stop() is called. At this piont, accidentally if usb transport errorshould happen in usb_ep_enable(), 'in_ep' and/or 'out_ep' may not be enabled.After that, ncm_disable() is called to disable for ncm unbindbut gether_disconnect() is never called since 'in_ep' is not enabled.As the result, ncm object is released in ncm unbindbut 'dev->port_usb' associated to 'ncm->port' is not NULL.And when ncm bind again to recover netdev, ncm object is reallocatedbut usb0 interface is already associated to previous released ncm object.Therefore, once usb0 interface is up and eth_start_xmit() is called,released ncm object is dereferrenced and it might cause use-after-free memory.[function unlink via configfs] usb0: eth_stop dev->port_usb=ffffff9b179c3200 --> error happens in usb_ep_enable(). NCM: ncm_disable: ncm=ffffff9b179c3200 --> no gether_disconnect() since ncm->port.in_ep->enabled is false. NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200 NCM: ncm_free: ncm free ncm=ffffff9b179c3200 <-- released ncm[function link via configfs] NCM: ncm_alloc: ncm alloc ncm=ffffff9ac4f8a000 NCM: ncm_bind: ncm bind ncm=ffffff9ac4f8a000 NCM: ncm_set_alt: ncm=ffffff9ac4f8a000 alt=0 usb0: eth_open dev->port_usb=ffffff9b179c3200 <-- previous released ncm usb0: eth_start dev->port_usb=ffffff9b179c3200 <-- eth_start_xmit() --> dev->wrap() Unable to handle kernel paging request at virtual address dead00000000014fThis patch addresses the issue by checking if 'ncm->netdev' is not NULL atncm_disable() to call gether_disconnect() to deassociate 'dev->port_usb'.It's more reasonable to check 'ncm->netdev' to call gether_connect/disconnectrather than check 'ncm->port.in_ep->enabled' since it might not be enabledbut the gether connection might be established.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3968", "desc": "Remote CodeExecution has been discovered inOpenText\u2122 iManager 3.2.6.0200.\u00a0The vulnerability cantrigger remote code execution using custom file upload task.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32312", "desc": "Tenda F1203 V2.0.1.6 firmware has a stack overflow vulnerability located in the adslPwd parameter of the formWanParameterSetting function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1203/formWanParameterSetting.md"]}, {"cve": "CVE-2024-31818", "desc": "Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component.", "poc": ["https://github.com/Chocapikk/My-CVEs"]}, {"cve": "CVE-2024-0399", "desc": "The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.", "poc": ["https://wpscan.com/vulnerability/1550e30c-bf80-48e0-bc51-67d29ebe7272/", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/xbz0n/CVE-2024-0399"]}, {"cve": "CVE-2024-3094", "desc": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "poc": ["http://www.openwall.com/lists/oss-security/2024/04/16/5", "https://lwn.net/Articles/967180/", "https://news.ycombinator.com/item?id=39895344", "https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils", "https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094", "https://github.com/0x7Fancy/0x7Fancy.github.io", "https://github.com/0xlane/xz-cve-2024-3094", "https://github.com/Bella-Bc/xz-backdoor-CVE-2024-3094-Check", "https://github.com/Cas-Cornelissen/xz-vulnerability-ansible", "https://github.com/CyberGuard-Foundation/CVE-2024-3094", "https://github.com/EGI-Federation/SVG-advisories", "https://github.com/FabioBaroni/CVE-2024-3094-checker", "https://github.com/Fractal-Tess/CVE-2024-3094", "https://github.com/Getshell/xzDoor", "https://github.com/GhostTroops/TOP", "https://github.com/Hacker-Hermanos/CVE-2024-3094_xz_check", "https://github.com/HaveFun83/awesome-stars", "https://github.com/Horizon-Software-Development/CVE-2024-3094", "https://github.com/JVS23/cybsec-project-2024", "https://github.com/JonathanSiemering/stars", "https://github.com/Juul/xz-backdoor-scan", "https://github.com/MagpieRYL/CVE-2024-3094-backdoor-env-container", "https://github.com/MrBUGLF/XZ-Utils_CVE-2024-3094", "https://github.com/Mustafa1986/CVE-2024-3094", "https://github.com/OpensourceICTSolutions/xz_utils-CVE-2024-3094", "https://github.com/QuentinN42/xztester", "https://github.com/SOC-SC/XZ-Response", "https://github.com/ScrimForever/CVE-2024-3094", "https://github.com/Security-Phoenix-demo/CVE-2024-3094-fix-exploits", "https://github.com/Simplifi-ED/CVE-2024-3094-patcher", "https://github.com/TheTorjanCaptain/CVE-2024-3094-Checker", "https://github.com/Thiagocsoaresbh/heroku-test", "https://github.com/Yuma-Tsushima07/CVE-2024-3094", "https://github.com/ackemed/detectar_cve-2024-3094", "https://github.com/adibue/brew-xz-patcher", "https://github.com/alexzeitgeist/starred", "https://github.com/alokemajumder/CVE-2024-3094-Vulnerability-Checker-Fixer", "https://github.com/amlweems/xzbot", "https://github.com/aneasystone/github-trending", "https://github.com/anhnmt/ansible-check-xz-utils", "https://github.com/ashwani95/CVE-2024-3094", "https://github.com/awdemos/demos", "https://github.com/badsectorlabs/ludus_xz_backdoor", "https://github.com/bioless/xz_cve-2024-3094_detection", "https://github.com/bollwarm/SecToolSet", "https://github.com/brinhosa/CVE-2024-3094-One-Liner", "https://github.com/bsekercioglu/cve2024-3094-Checker", "https://github.com/buluma/ansible-role-crowd", "https://github.com/buluma/ansible-role-cve_2024_3094", "https://github.com/buluma/ansible-role-openjdk", "https://github.com/byinarie/CVE-2024-3094-info", "https://github.com/chadsr/stars", "https://github.com/chavezvic/update-checker-Penguin", "https://github.com/christoofar/safexz", "https://github.com/crfearnworks/ansible-CVE-2024-3094", "https://github.com/crosscode-nl/snowflake", "https://github.com/cxyfreedom/website-hot-hub", "https://github.com/dah4k/CVE-2024-3094", "https://github.com/devjanger/CVE-2024-3094-XZ-Backdoor-Detector", "https://github.com/donmccaughey/xz_pkg", "https://github.com/drdry2/CVE-2024-3094-EXPLOIT", "https://github.com/duytruongpham/duytruongpham", "https://github.com/emirkmo/xz-backdoor-github", "https://github.com/felipecosta09/cve-2024-3094", "https://github.com/fevar54/Detectar-Backdoor-en-liblzma-de-XZ-utils-CVE-2024-3094-", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/gaahrdner/starred", "https://github.com/galacticquest/cve-2024-3094-detect", "https://github.com/gayatriracha/CVE-2024-3094-Nmap-NSE-script", "https://github.com/gustavorobertux/CVE-2024-3094", "https://github.com/hackingetico21/revisaxzutils", "https://github.com/harekrishnarai/xz-utils-vuln-checker", "https://github.com/hazemkya/CVE-2024-3094-checker", "https://github.com/hoanbi1812000/hoanbi1812000", "https://github.com/iakat/stars", "https://github.com/iheb2b/CVE-2024-3094-Checker", "https://github.com/initMAX/zabbix-templates", "https://github.com/isuruwa/CVE-2024-3094", "https://github.com/jafshare/GithubTrending", "https://github.com/jbnetwork-git/linux-tools", "https://github.com/jfrog/cve-2024-3094-tools", "https://github.com/johe123qwe/github-trending", "https://github.com/juev/links", "https://github.com/k4t3pr0/Check-CVE-2024-3094", "https://github.com/kornelski/cargo-deb", "https://github.com/kun-g/Scraping-Github-trending", "https://github.com/lemon-mint/stars", "https://github.com/lockness-Ko/xz-vulnerable-honeypot", "https://github.com/lu-zero/autotools-rs", "https://github.com/lypd0/CVE-2024-3094-Vulnerabity-Checker", "https://github.com/marcelofmatos/ssh-xz-backdoor", "https://github.com/mauvehed/starred", "https://github.com/mesutgungor/xz-backdoor-vulnerability", "https://github.com/mightysai1997/CVE-2024-3094", "https://github.com/mightysai1997/CVE-2024-3094-info", "https://github.com/mightysai1997/xzbot", "https://github.com/mmomtchev/ffmpeg", "https://github.com/mmomtchev/magickwand.js", "https://github.com/neuralinhibitor/xzwhy", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/pentestfunctions/CVE-2024-3094", "https://github.com/prototux/xz-backdoor-recreation", "https://github.com/przemoc/xz-backdoor-links", "https://github.com/r0binak/xzk8s", "https://github.com/reuteras/CVE-2024-3094", "https://github.com/rezigned/xz-backdoor", "https://github.com/rezigned/xz-backdoor-container-image", "https://github.com/robertdebock/ansible-playbook-cve-2024-3094", "https://github.com/robertdebock/ansible-role-cve_2024_3094", "https://github.com/samokat-oss/pisc", "https://github.com/sampsonv/github-trending", "https://github.com/sarutobi12/sarutobi12", "https://github.com/schu/notebook", "https://github.com/securitycipher/daily-bugbounty-writeups", "https://github.com/silentEAG/awesome-stars", "https://github.com/sunlei/awesome-stars", "https://github.com/tanjiti/sec_profile", "https://github.com/teyhouse/CVE-2024-3094", "https://github.com/trngtam10d/trngtam10d", "https://github.com/ulikunitz/xz", "https://github.com/unresolv/stars", "https://github.com/vuduclyunitn/software_supply_chain_papers", "https://github.com/weltregie/liblzma-scan", "https://github.com/wgetnz/CVE-2024-3094-check", "https://github.com/zayidu/zayidu", "https://github.com/zgimszhd61/cve-2024-3094-detect-tool", "https://github.com/zhaoxiaoha/github-trending"]}, {"cve": "CVE-2024-32291", "desc": "Tenda W30E v1.0 firmware v1.0.1.25(633) has a stack overflow vulnerability via the page parameter in the fromNatlimit function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromNatlimit.md"]}, {"cve": "CVE-2024-4517", "desc": "A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /view/teacher_salary_invoice1.php. The manipulation of the argument date leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263121 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2562", "desc": "A vulnerability, which was classified as critical, was found in PandaXGO PandaX up to 20240310. This affects the function InsertRole of the file /apps/system/services/role_menu.go. The manipulation of the argument roleKey leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257061 was assigned to this vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-2074", "desc": "A vulnerability was found in Mini-Tmall up to 20231017 and classified as critical. This issue affects some unknown processing of the file ?r=tmall/admin/user/1/1. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255389 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yuziiiiiiiiii/CVE-2024-2074"]}, {"cve": "CVE-2024-27558", "desc": "Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings.", "poc": ["https://github.com/kilooooo/cms/blob/main/2.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1034", "desc": "A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadFile of the file /application/index/controller/File.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252309 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30891", "desc": "A command injection vulnerability exists in /goform/exeCommand in Tenda AC18 v15.03.05.05, which allows attackers to construct cmdinput parameters for arbitrary command execution.", "poc": ["https://github.com/Lantern-r/IoT-vuln/blob/main/Tenda/AC18/formexeCommand.md"]}, {"cve": "CVE-2024-30056", "desc": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", "poc": ["https://github.com/absholi7ly/Microsoft-Edge-Information-Disclosure", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-30885", "desc": "Reflected Cross-Site Scripting (XSS) vulnerability in HadSky v7.6.3, allows remote attackers to execute arbitrary code and obtain sensitive information via the chklogin.php component .", "poc": ["https://github.com/Hebing123/cve/issues/29"]}, {"cve": "CVE-2024-22729", "desc": "NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.", "poc": ["https://github.com/adhikara13/CVE/blob/main/netis_MW5360/blind%20command%20injection%20in%20password%20parameter%20in%20initial%20settings.md"]}, {"cve": "CVE-2024-23514", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ClickToTweet.Com Click To Tweet allows Stored XSS.This issue affects Click To Tweet: from n/a through 2.0.14.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0204", "desc": "Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.", "poc": ["http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.html", "http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/Ostorlab/KEV", "https://github.com/Threekiii/CVE", "https://github.com/adminlove520/CVE-2024-0204", "https://github.com/cbeek-r7/CVE-2024-0204", "https://github.com/gobysec/Goby", "https://github.com/horizon3ai/CVE-2024-0204", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/m-cetin/CVE-2024-0204", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/toxyl/lscve"]}, {"cve": "CVE-2024-30604", "desc": "Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the list1 parameter of the fromDhcpListClient function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/fromDhcpListClient_list1.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29019", "desc": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files (create, edit, delete). It is possible for a malicious actor to create a specifically crafted web page that triggers a cross site request against ESPHome, this allows bypassing the authentication for API calls on the platform. This vulnerability allows bypassing authentication on API calls accessing configuration file operations on the behalf of a logged user. In order to trigger the vulnerability, the victim must visit a weaponized page. In addition to this, it is possible to chain this vulnerability with GHSA-9p43-hj5j-96h5/ CVE-2024-27287 to obtain a complete takeover of the user account. Version 2024.3.0 contains a patch for this issue.", "poc": ["https://github.com/advisories/GHSA-9p43-hj5j-96h5", "https://github.com/esphome/esphome/security/advisories/GHSA-5925-88xh-6h99", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-33213", "desc": "Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/RouteStatic.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20666", "desc": "BitLocker Security Feature Bypass Vulnerability", "poc": ["https://github.com/MHimken/WinRE-Customization", "https://github.com/NaInSec/CVE-LIST", "https://github.com/nnotwen/Script-For-CVE-2024-20666", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-1818", "desc": "A vulnerability was found in CodeAstro Membership Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /uploads/ of the component Logo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254606 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29138", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DEV Institute Restrict User Access \u2013 Membership Plugin with Force allows Reflected XSS.This issue affects Restrict User Access \u2013 Membership Plugin with Force: from n/a through 2.5.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29095", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Ryley Site Reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 6.11.6.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-1204", "desc": "The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.", "poc": ["https://wpscan.com/vulnerability/03191b00-0b05-42db-9ce2-fc525981b6c9/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20252", "desc": "Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device. \nNote: \"Cisco Expressway Series\" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.\nFor more information about these vulnerabilities, see the Details [\"#details\"] section of this advisory.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2042", "desc": "The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28247", "desc": "The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs from behind, reading files is done as a privileged user.If the URL that is in the list of \"Adslists\" begins with \"file*\" it is understood that it is updating from a local file, on the other hand if it does not begin with \"file*\" depending on the state of the response it does one thing or another. The problem resides in the update through local files. When updating from a file which contains non-domain lines, 5 of the non-domain lines are printed on the screen, so if you provide it with any file on the server which contains non-domain lines it will print them on the screen. This vulnerability is fixed by 5.18.", "poc": ["https://github.com/pi-hole/pi-hole/security/advisories/GHSA-95g6-7q26-mp9x", "https://github.com/T0X1Cx/CVE-2024-28247-Pi-hole-Arbitrary-File-Read", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-0223", "desc": "Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3967", "desc": "Remote CodeExecution has been discovered inOpenText\u2122 iManager 3.2.6.0200.\u00a0The vulnerability cantrigger remote code execution unisng unsafe java object deserialization.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25128", "desc": "Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. This vulnerability is only exploitable when the application is using the OpenID 2.0 authorization protocol. Upgrade to Flask-AppBuilder 4.3.11 to fix the vulnerability.", "poc": ["https://github.com/securitycipher/daily-bugbounty-writeups"]}, {"cve": "CVE-2024-31864", "desc": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver.This issue affects Apache Zeppelin: before 0.11.1.Users are recommended to upgrade to version 0.11.1, which fixes the issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24133", "desc": "** UNSUPPORTED WHEN ASSIGNED ** Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.", "poc": ["https://github.com/Hebing123/cve/issues/16", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1977", "desc": "The Restaurant Solutions \u2013 Checklist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Checklist points in version 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.", "poc": ["https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2022-004"]}, {"cve": "CVE-2024-4242", "desc": "A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been rated as critical. This issue affects the function formwrlSSIDget of the file /goform/wifiSSIDget. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W9/formwrlSSIDget.md"]}, {"cve": "CVE-2024-33429", "desc": "Buffer-Overflow vulnerability at pcm_convert.h:513 of phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via a crafted .wav file.", "poc": ["https://github.com/Helson-S/FuzzyTesting/blob/master/phiola/heap-buffer-overflow-2/heap-buffer-overflow-2.assets/image-20240420011116818.png", "https://github.com/Helson-S/FuzzyTesting/blob/master/phiola/heap-buffer-overflow-2/heap-buffer-overflow-2.md", "https://github.com/Helson-S/FuzzyTesting/blob/master/phiola/heap-buffer-overflow-2/poc/", "https://github.com/Helson-S/FuzzyTesting/tree/master/phiola/heap-buffer-overflow-2", "https://github.com/stsaz/phiola/issues/30"]}, {"cve": "CVE-2024-22087", "desc": "route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution.", "poc": ["https://github.com/foxweb/pico/issues/31", "https://github.com/Halcy0nic/Trophies", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/skinnyrad/Trophies"]}, {"cve": "CVE-2024-24725", "desc": "Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.", "poc": ["https://www.exploit-db.com/exploits/51903", "https://github.com/NaInSec/CVE-LIST", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-32023", "desc": "Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the `common_gui.py` `find_and_replace` function. This vulnerability is fixed in 23.1.5.", "poc": ["https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss"]}, {"cve": "CVE-2024-28187", "desc": "SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to an OS Command Injection vulnerability within the file upload feature when accessed by an administrator. The vulnerability enables the execution of arbitrary OS commands through specially crafted file names containing a semicolon, affecting the jpegoptim functionality. This vulnerability has been patched in version 3.14.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3148", "desc": "A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112. This issue affects some unknown processing of the file dede/makehtml_archives_action.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258923. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-3012", "desc": "A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been declared as critical. This vulnerability affects the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258298 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/GetParentControlInfo.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26628", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22818", "desc": "FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword_save", "poc": ["https://github.com/mafangqian/cms/blob/main/3.md"]}, {"cve": "CVE-2024-21451", "desc": "Microsoft ODBC Driver Remote Code Execution Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-30583", "desc": "Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the mitInterface parameter of the fromAddressNat function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/fromAddressNat_mitInterface.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3536", "desc": "A vulnerability has been found in Campcodes Church Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/delete_log.php. The manipulation of the argument selector leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259906 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21035", "desc": "Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair, and Overhaul. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Complex Maintenance, Repair, and Overhaul, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Complex Maintenance, Repair, and Overhaul accessible data as well as unauthorized read access to a subset of Oracle Complex Maintenance, Repair, and Overhaul accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-20700", "desc": "Windows Hyper-V Remote Code Execution Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-1703", "desc": "A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been classified as problematic. This affects the function openfile of the file /adminapi/system/file/openfile. The manipulation leads to absolute path traversal. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254391. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.254391"]}, {"cve": "CVE-2024-2247", "desc": "JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34950", "desc": "D-Link DIR-822+ v1.0.5 was discovered to contain a stack-based buffer overflow vulnerability in the SetNetworkTomographySettings module.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3692", "desc": "The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/6f100f85-3a76-44be-8092-06eb8595b0c9/"]}, {"cve": "CVE-2024-1750", "desc": "A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3. Affected is the function get_img_url/img_replace in the library lib/images_get_down.php of the component Image Download Handler. The manipulation leads to deserialization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254532. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.254532", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28012", "desc": "Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, WG1800HP2, WF1200HP, WG600HP, WG300HP, WF300HP, WG1800HP, WG1400HP, WR8175N, WR9300N, WR8750N, WR8160N, WR9500N, WR8600N, WR8370N, WR8170N, WR8700N, WR8300N, WR8150N, WR4100N, WR4500N, WR8100N, WR8500N, CR2500P, WR8400N, WR8200N, WR1200H, WR7870S, WR6670S, WR7850S, WR6650S, WR6600H, WR7800H, WM3400RN, WM3450RN, WM3500R, WM3600R, WM3800R, WR8166N, MR01LN MR02LN, WG1810HP(JE) and WG1810HP(MF) all versions allows a attacker to execute an arbitrary command with the root privilege via the internet.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1673", "desc": "Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0654", "desc": "A vulnerability, which was classified as problematic, was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. Affected is an unknown function of the file mainscripts/Util.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. VDB-251382 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29027", "desc": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1220", "desc": "A stack-based buffer overflow in the built-in web server in Moxa NPort W2150A/W2250A Series firmware version 2.3 and prior allows a remote attacker to exploit the vulnerability by sending crafted payload to the web service. Successful exploitation of the vulnerability could result in denial of service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24845", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sewpafly Post Thumbnail Editor.This issue affects Post Thumbnail Editor: from n/a through 2.4.8.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26495", "desc": "Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the BBCode tags in the post content and post comments function.", "poc": ["https://github.com/friendica/friendica/issues/13884"]}, {"cve": "CVE-2024-2159", "desc": "The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/d7fa9849-c82a-4efd-84b6-9245053975ba/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2684", "desc": "A vulnerability, which was classified as problematic, has been found in Campcodes Online Job Finder System 1.0. Affected by this issue is some unknown functionality of the file /admin/category/index.php. The manipulation of the argument view leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257384.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-35012", "desc": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=add&nohrefStr=close.", "poc": ["https://github.com/Thirtypenny77/cms/blob/main/7.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22359", "desc": "IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 280897.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21067", "desc": "Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). The supported version that is affected is 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-24806", "desc": "libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["http://www.openwall.com/lists/oss-security/2024/02/08/2", "https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22145", "desc": "Improper Privilege Management vulnerability in InstaWP Team InstaWP Connect allows Privilege Escalation.This issue affects InstaWP Connect: from n/a through 0.1.0.8.", "poc": ["https://github.com/RandomRobbieBF/CVE-2024-22145", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-1938", "desc": "Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2180", "desc": "Zemana AntiLogger v2.74.204.664 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x80002020 IOCTL code of the zam64.sys and zamguard64.sys drivers", "poc": ["https://fluidattacks.com/advisories/gomez/"]}, {"cve": "CVE-2024-20972", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1108", "desc": "The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_init() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to change the settings of the plugin, which can also cause a denial of service due to a misconfiguration.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2086", "desc": "The Integrate Google Drive \u2013 Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers to modify plugin settings as well as allowing full read/write/delete access to the Google Drive associated with the plugin.", "poc": ["https://github.com/MrCyberSecs/CVE-2024-2086-GOOGLE-DRIVE", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-0928", "desc": "A vulnerability was found in Tenda AC10U 15.03.06.49_multi_TDE01. It has been declared as critical. Affected by this vulnerability is the function fromDhcpListClient. The manipulation of the argument page/listN leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromDhcpListClient_1.md", "https://github.com/yaoyue123/iot"]}, {"cve": "CVE-2024-22369", "desc": "Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/oscerd/CVE-2024-22369"]}, {"cve": "CVE-2024-25715", "desc": "Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirect_uri.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20027", "desc": "In da, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541632; Issue ID: ALPS08541633.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22227", "desc": "Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_dc utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability execute commands with root privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22453", "desc": "Dell PowerEdge Server BIOS contains a heap-based buffer overflow vulnerability. A local high privileged attacker could potentially exploit this vulnerability to write to otherwise unauthorized memory.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-21480", "desc": "Memory corruption while playing audio file having large-sized input buffer.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30607", "desc": "Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/saveParentControlInfo_deviceId.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26922", "desc": "In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: validate the parameters of bo mapping operations more clearlyVerify the parameters ofamdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32399", "desc": "Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via the /webeditor/ component.", "poc": ["https://github.com/NN0b0dy/CVE-2024-32399/blob/main/README.md", "https://github.com/NN0b0dy/CVE-2024-32399", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-26135", "desc": "MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is exploitable when an attacker is able to convince a victim end-user to click on a malicious link to a page hosting an attacker-controlled site. The attacker can then originate a cross-site websocket connection using client-side JavaScript code to connect to `control.ashx` as the victim user within MeshCentral. Version 1.1.21 contains a patch for this issue.", "poc": ["https://github.com/Ylianst/MeshCentral/security/advisories/GHSA-cp68-qrhr-g9h8"]}, {"cve": "CVE-2024-25930", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24539", "desc": "FusionPBX before 5.2.0 does not validate a session.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2591", "desc": "Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_group.php, in multiple\u00a0parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0170", "desc": "Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cava utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23756", "desc": "The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them.", "poc": ["https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-23756", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23709", "desc": "In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.", "poc": ["https://android.googlesource.com/platform/external/sonivox/+/3f798575d2d39cd190797427d13471d6e7ceae4c"]}, {"cve": "CVE-2024-5378", "desc": "A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage_sy.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-266290 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2184", "desc": "Buffer overflow in identifier field of WSD probe request process of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF740C Series/Satera MF640C Series/Satera LBP660C Series/Satera LBP620C Series firmware v12.07 and earlier, and Satera MF750C Series/Satera LBP670C Series firmware v03.09 and earlier sold in Japan.Color imageCLASS MF740C Series/Color imageCLASS MF640C Series/Color imageCLASS X MF1127C/Color imageCLASS LBP664Cdw/Color imageCLASS LBP622Cdw/Color imageCLASS X LBP1127C firmware v12.07 and earlier, and Color imageCLASS MF750C Series/Color imageCLASS X MF1333C/Color imageCLASS LBP674Cdw/Color imageCLASS X LBP1333C firmware v03.09 and earlier sold in US.i-SENSYS MF740C Series/i-SENSYS MF640C Series/C1127i Series/i-SENSYS LBP660C Series/i-SENSYS LBP620C Series/C1127P firmware v12.07 and earlier, and i-SENSYS MF750C Series/C1333i Series/i-SENSYS LBP673Cdw/C1333P firmware v03.09 and earlier sold in Europe.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2054", "desc": "The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the \"www-data\" user.", "poc": ["http://seclists.org/fulldisclosure/2024/Mar/12", "https://korelogic.com/Resources/Advisories/KL-001-2024-002.txt", "https://github.com/Madan301/CVE-2024-2054", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-28403", "desc": "TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2329", "desc": "A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/list_resource_icon.php?action=delete. The manipulation of the argument IconId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256280. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-list_resource_icon.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24330", "desc": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the setRemoteCfg function.", "poc": ["https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/14/TOTOlink%20A3300R%20setRemoteCfg.md"]}, {"cve": "CVE-2024-21408", "desc": "Windows Hyper-V Denial of Service Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-26026", "desc": "An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "poc": ["https://github.com/GRTMALDET/Big-IP-Next-CVE-2024-26026", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/passwa11/CVE-2024-26026", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/wy876/wiki"]}, {"cve": "CVE-2024-29387", "desc": "projeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /view/print.php.", "poc": ["https://cve.anas-cherni.me/2024/04/04/cve-2024-29387/"]}, {"cve": "CVE-2024-3979", "desc": "A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The manipulation leads to race condition. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261596.", "poc": ["https://github.com/COVESA/vsomeip/files/14904610/details.zip", "https://github.com/COVESA/vsomeip/issues/663"]}, {"cve": "CVE-2024-24095", "desc": "Code-projects Simple Stock System 1.0 is vulnerable to SQL Injection.", "poc": ["https://github.com/ASR511-OO7/CVE-2024-24095", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-0029", "desc": "In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23188", "desc": "Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interaction is required for the vulnerability to trigger. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding attachment information to the web interface. No publicly available exploits are known.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25760", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31226", "desc": "Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named `C:\\Program.exe`, `C:\\Program.bat`, or `C:\\Program.cmd` on the user's computer. This attack vector isn't exploitable unless the user has manually loosened ACLs on the system drive. If the user's system locale is not English, then the name of the executable will likely vary. Version 0.23.0 contains a patch for the issue. Some workarounds are available. One may identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate. Alternatively, ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory `C:`. Require that all executables be placed in write-protected directories.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26160", "desc": "Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-23752", "desc": "GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.", "poc": ["https://github.com/gventuri/pandas-ai/issues/868", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27689", "desc": "Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via /update-article.php.", "poc": ["https://github.com/Xin246/cms/blob/main/2.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22080", "desc": "An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur during XML body parsing.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-0259", "desc": "Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to gain elevated privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24099", "desc": "Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Employment Status Information Update.", "poc": ["https://github.com/ASR511-OO7/CVE-2024-24099", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-21446", "desc": "NTFS Elevation of Privilege Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-0222", "desc": "Use after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-31003", "desc": "Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial at Ap4ByteStream.cpp.", "poc": ["https://github.com/axiomatic-systems/Bento4/issues/939"]}, {"cve": "CVE-2024-0055", "desc": "Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-20021", "desc": "In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08584568; Issue ID: MSV-1249.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28432", "desc": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php.", "poc": ["https://github.com/itsqian797/cms/blob/main/4.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-35039", "desc": "idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/tplSys_deal.php?mudi=area.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20043", "desc": "In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541781; Issue ID: ALPS08541781.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4813", "desc": "A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506. Affected is an unknown function of the file /view/networkConfig/physicalInterface/interface_commit.php. The manipulation of the argument name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-263934 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29686", "desc": "** DISPUTED ** Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be entered by a trusted user, such as the owner of the server that hosts Winter CMS, or a developer working for them.", "poc": ["https://www.exploit-db.com/exploits/51893", "https://github.com/capture0x/My-CVE", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2526", "desc": "A vulnerability has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/rooms.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20rooms.php.md", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-30584", "desc": "Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWifiBasicSet_security.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31759", "desc": "An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.", "poc": ["https://gist.github.com/menghaining/8d424faebfe869c80eadaea12bbdd158", "https://github.com/menghaining/PoC/blob/main/PublicCMS/publishCMS--PoC.md"]}, {"cve": "CVE-2024-1342", "desc": "A flaw was found in OpenShift. The existing Cross-Site Request Forgery (CSRF) protections in place do not properly protect GET requests, allowing for the creation of WebSockets via CSRF.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31844", "desc": "An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disclosure of information about the server. An unauthenticated user is able craft specific requests in order to make the application generate an error. Inside an error message, some information about the server is revealed, such as the absolute path of the source code of the application. This kind of information can help an attacker to perform other attacks against the system. This can be exploited without authentication.", "poc": ["https://www.gruppotim.it/it/footer/red-team.html"]}, {"cve": "CVE-2024-24794", "desc": "A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. To trigger this vulnerability, an attacker would need to induce the vulnerable application to process a malicious DICOM image.The Use-After-Free happens in the `parse_meta_sequence_end()` parsing the Sequence Value Represenations.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2024-1931", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1931"]}, {"cve": "CVE-2024-33830", "desc": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=clearWebCache.", "poc": ["https://github.com/xyaly163/cms/blob/main/2.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0347", "desc": "A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file signup_teacher.php. The manipulation of the argument Password leads to weak password requirements. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250115.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0985", "desc": "Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the protections that older branches are using to fix their vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/marklogic/marklogic-kubernetes"]}, {"cve": "CVE-2024-31208", "desc": "Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate excessive data in the database of such instances, resulting in a denial of service. Servers in private federations, or those that do not federate, are not affected. Server administrators should upgrade to 1.105.1 or later. Some workarounds are available. One can ban the malicious users or ACL block servers from the rooms and/or leave the room and purge the room using the admin API.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27224", "desc": "In strncpy of strncpy.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23864", "desc": "A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/countrylist.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31342", "desc": "Missing Authorization vulnerability in WPcloudgallery WordPress Gallery Exporter.This issue affects WordPress Gallery Exporter: from n/a through 1.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0421", "desc": "The MapPress Maps for WordPress plugin before 2.88.16 does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.", "poc": ["https://wpscan.com/vulnerability/587acc47-1966-4baf-a380-6aa479a97c82/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-35108", "desc": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/homePro_deal.php?mudi=del&dataType=&dataTypeCN.", "poc": ["https://github.com/FirstLIF/cms/blob/main/1.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20985", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-33332", "desc": "An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant.", "poc": ["https://github.com/wy876/cve/issues/3"]}, {"cve": "CVE-2024-22373", "desc": "An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4532", "desc": "The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting cards via CSRF attacks", "poc": ["https://wpscan.com/vulnerability/64cf5f95-bbf0-4c5f-867b-62f1b7f6a42e/"]}, {"cve": "CVE-2024-33793", "desc": "netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the ping test page.", "poc": ["https://github.com/ymkyu/CVE/tree/main/CVE-2024-33793", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23354", "desc": "Memory corruption when the IOCTL call is interrupted by a signal.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29789", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Walter Pinem OneClick Chat to Order allows Stored XSS.This issue affects OneClick Chat to Order: from n/a through 1.0.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27764", "desc": "An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24003", "desc": "jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.", "poc": ["https://github.com/jishenghua/jshERP/issues/99"]}, {"cve": "CVE-2024-32737", "desc": "A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3.\u00a0An unauthenticated remote attacker can leak sensitive information via the \"query_contract_result\" function within MCUDBHelper.", "poc": ["https://www.tenable.com/security/research/tra-2024-14"]}, {"cve": "CVE-2024-30612", "desc": "Tenda AC10U v15.03.06.48 has a stack overflow vulnerability in the deviceId, limitSpeed, limitSpeedUp parameter from formSetClientState function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.48/more/formSetClientState.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27356", "desc": "An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.", "poc": ["https://github.com/aggressor0/GL.iNet-Exploits", "https://github.com/aggressor0/GL.iNet-RCE", "https://github.com/aggressor0/GL.iNet-Vulnerabilities", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21395", "desc": "Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21103", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Linux hosts only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-22889", "desc": "Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.", "poc": ["https://github.com/shenhav12/CVE-2024-22889-Plone-v6.0.9", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/shenhav12/CVE-2024-22889-Plone-v6.0.9"]}, {"cve": "CVE-2024-21328", "desc": "Dynamics 365 Sales Spoofing Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34460", "desc": "The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24115", "desc": "A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.", "poc": ["https://mechaneus.github.io/CVE-2024-24115.html", "https://mechaneus.github.io/CVE-PENDING-COTONTI.html", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/mechaneus/mechaneus.github.io"]}, {"cve": "CVE-2024-25922", "desc": "Missing Authorization vulnerability in Peach Payments Peach Payments Gateway.This issue affects Peach Payments Gateway: from n/a through 3.1.9.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-25868", "desc": "A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via the membershipType parameter in the add_type.php component.", "poc": ["https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-Stored_XSS_Add_Type.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30513", "desc": "Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2631", "desc": "Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3785", "desc": "Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device NAS shared section (/admin/DeviceNAS). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34209", "desc": "TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpPortFilterRules function.", "poc": ["https://github.com/n0wstr/IOTVuln/tree/main/CP450/setIpPortFilterRules"]}, {"cve": "CVE-2024-20036", "desc": "In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08509508; Issue ID: ALPS08509508.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29452", "desc": "** DISPUTED ** An insecure deserialization vulnerability has been identified in ROS2 Humble Hawksbill in ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows attackers to execute arbitrary code and obtain sensitive information via crafted input to the Data Serialization and Deserialization Components, Inter-Process Communication Mechanisms, and Network Communication Interfaces. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2024-29452"]}, {"cve": "CVE-2024-34523", "desc": "** UNSUPPORTED WHEN ASSIGNED ** AChecker 1.5 allows remote attackers to read the contents of arbitrary files via the download.php path parameter by using Unauthenticated Path Traversal. This occurs through readfile in PHP. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/piuppi/Proof-of-Concepts/blob/main/AChecker/CVE-2024-34523.md", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/piuppi/Proof-of-Concepts"]}, {"cve": "CVE-2024-23895", "desc": "A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/locationcreate.php, in the locationid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24940", "desc": "In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22189", "desc": "quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25520", "desc": "RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new.aspx.", "poc": ["https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#sys_blogtemplate_newaspx"]}, {"cve": "CVE-2024-30726", "desc": "** DISPUTED ** A shell injection vulnerability was discovered in ROS (Robot Operating System) Kinetic Kame in ROS_VERSION 1 and ROS_ PYTHON_VERSION 3, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information due to the way ROS handles shell command execution in components like command interpreters or interfaces that process external inputs. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/yashpatelphd/CVE-2024-30726"]}, {"cve": "CVE-2024-25915", "desc": "Server-Side Request Forgery (SSRF) vulnerability in Raaj Trambadia Pexels: Free Stock Photos.This issue affects Pexels: Free Stock Photos: from n/a through 1.2.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25625", "desc": "Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkAction` function of the UserController, specifically in the way `$loginUrl` trusts user input. The host header from incoming HTTP requests is used unsafely when generating URLs. An attacker can manipulate the HTTP host header in requests to the /admin/user/invitationlink endpoint, resulting in the generation of URLs with the attacker's domain. In fact, if a host header is injected in the POST request, the $loginURL parameter is constructed with this unvalidated host header. It is then used to send an invitation email to the provided user. This vulnerability can be used to perform phishing attacks by making the URLs in the invitation links emails point to an attacker-controlled domain. Version 1.3.4 contains a patch for the vulnerability. The maintainers recommend validating the host header and ensuring it matches the application's domain. It would also be beneficial to use a default trusted host or hostname if the incoming host header is not recognized or is absent.", "poc": ["https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3qpq-6w89-f7mx", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/v0lck3r/SecurityResearch"]}, {"cve": "CVE-2024-26589", "desc": "In the Linux kernel, the following vulnerability has been resolved:bpf: Reject variable offset alu on PTR_TO_FLOW_KEYSFor PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed offfor validation. However, variable offset ptr alu is not prohibitedfor this ptr kind. So the variable offset is not checked.The following prog is accepted: func#0 @0 0: R1=ctx() R10=fp0 0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx() 1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys() 2: (b7) r8 = 1024 ; R8_w=1024 3: (37) r8 /= 1 ; R8_w=scalar() 4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0, smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400)) 5: (0f) r7 += r8 mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024 mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1 mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off =(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024, var_off=(0x0; 0x400)) 6: (79) r0 = *(u64 *)(r7 +0) ; R0_w=scalar() 7: (95) exitThis prog loads flow_keys to r7, and adds the variable offset r8to r7, and finally causes out-of-bounds access: BUG: unable to handle page fault for address: ffffc90014c80038 [...] Call Trace: bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline] __bpf_prog_run include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline] bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline] bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991 bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359 bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline] __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475 __do_sys_bpf kernel/bpf/syscall.c:5561 [inline] __se_sys_bpf kernel/bpf/syscall.c:5559 [inline] __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6bFix this by rejecting ptr alu with variable offset on flow_keys.Applying the patch rejects the program with \"R7 pointer arithmeticon flow_keys prohibited\".", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2827", "desc": "A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315. This issue affects some unknown processing of the file /ureport/designer/saveReportFile. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257717 was assigned to this vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4558", "desc": "Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24767", "desc": "CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.", "poc": ["https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c69x-5xmw-v44x", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-5122", "desc": "A vulnerability was found in SourceCodester Event Registration System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registrar/. The manipulation of the argument search leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-265202 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/BurakSevben/CVEs/blob/main/Event%20Registration%20System/Event%20Registration%20System%20-%20SQL%20Injection%20-%204.md"]}, {"cve": "CVE-2024-25655", "desc": "Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allows members (with read access to the application database) to decrypt the LDAP passwords of users who successfully authenticate to web management via LDAP.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-24904", "desc": "Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0866", "desc": "The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-26645", "desc": "In the Linux kernel, the following vulnerability has been resolved:tracing: Ensure visibility when inserting an element into tracing_mapRunning the following two commands in parallel on a multi-processorAArch64 machine can sporadically produce an unexpected warning aboutduplicate histogram entries: $ while true; do echo hist:key=id.syscall:val=hitcount > \\ /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist sleep 0.001 done $ stress-ng --sysbadaddr $(nproc)The warning looks as follows:[ 2911.172474] ------------[ cut here ]------------[ 2911.173111] Duplicates detected: 1[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E)[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G E 6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408[ 2911.185310] sp : ffff8000a1513900[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480[ 2911.194259] Call trace:[ 2911.194626] tracing_map_sort_entries+0x3e0/0x408[ 2911.195220] hist_show+0x124/0x800[ 2911.195692] seq_read_iter+0x1d4/0x4e8[ 2911.196193] seq_read+0xe8/0x138[ 2911.196638] vfs_read+0xc8/0x300[ 2911.197078] ksys_read+0x70/0x108[ 2911.197534] __arm64_sys_read+0x24/0x38[ 2911.198046] invoke_syscall+0x78/0x108[ 2911.198553] el0_svc_common.constprop.0+0xd0/0xf8[ 2911.199157] do_el0_svc+0x28/0x40[ 2911.199613] el0_svc+0x40/0x178[ 2911.200048] el0t_64_sync_handler+0x13c/0x158[ 2911.200621] el0t_64_sync+0x1a8/0x1b0[ 2911.201115] ---[ end trace 0000000000000000 ]---The problem appears to be caused by CPU reordering of writes issued from__tracing_map_insert().The check for the presence of an element with a given key in thisfunction is: val = READ_ONCE(entry->val); if (val && keys_match(key, val->key, map->key_size)) ...The write of a new entry is: elt = get_free_elt(map); memcpy(elt->key, key, map->key_size); entry->val = elt;The \"memcpy(elt->key, key, map->key_size);\" and \"entry->val = elt;\"stores may become visible in the reversed order on another CPU. Thissecond CPU might then incorrectly determine that a new key doesn't matchan already present val->key and subse---truncated---", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21450", "desc": "Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-20667", "desc": "Azure DevOps Server Remote Code Execution Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21472", "desc": "Memory corruption in Kernel while handling GPU operations.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21314", "desc": "Microsoft Message Queuing Information Disclosure Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3091", "desc": "A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/search.php of the component Search Request Page. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258684.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-5111", "desc": "A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. This affects an unknown part of the file /view/student_payment_invoice1.php. The manipulation of the argument date leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265101 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3634", "desc": "The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/76e000e0-314f-4e39-8871-68bf8cc95b22/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4651", "desc": "A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. This issue affects some unknown processing of the file /view/student_attendance_history1.php. The manipulation of the argument year leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263495.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2465", "desc": "Open redirection vulnerability in CDeX application\u00a0allows to redirect users to arbitrary websites via a specially crafted URL.This issue affects CDeX application versions through 5.7.1.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29078", "desc": "Incorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unauthenticated attacker with access to the product to alter the product settings.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0566", "desc": "The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/ca83db95-4a08-4615-aa8d-016022404c32/", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/xbz0n/CVE-2024-0566"]}, {"cve": "CVE-2024-1979", "desc": "A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-4894", "desc": "ITPison OMICARD EDM fails to properly filter specific URL parameter, allowing unauthenticated remote attackers to modify the parameters and conduct Server-Side Request Forgery (SSRF) attacks. This vulnerability enables attackers to probe internal network information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29191", "desc": "gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The links page (`links.html`) appends the `src` GET parameter (`[0]`) in all of its links for 1-click previews. The context in which `src` is being appended is `innerHTML` (`[1]`), which will insert the text as HTML. Commit 3b3d5b033aac3a019af64f83dec84f70ed2c8aba contains a patch for the issue.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2060", "desc": "A vulnerability classified as critical has been found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /admin/app/login_crud.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255375.", "poc": ["https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/login_crud.php%20SQL%20Injection.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26503", "desc": "Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.php endpoint.", "poc": ["https://github.com/RoboGR00t/Exploit-CVE-2024-26503", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-0256", "desc": "The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22403", "desc": "Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0836", "desc": "The WordPress Review & Structure Data Schema Plugin \u2013 Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrs_review_edit() function in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary reviews.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21084", "desc": "Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Service Gateway). Supported versions that are affected are 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-27223", "desc": "In EUTRAN_LCS_DecodeFacilityInformationElement of LPP_LcsManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure after authenticating the cell connection with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2603", "desc": "The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/b4186c03-99ee-4297-85c0-83b7053afc1c/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34225", "desc": "Cross Site Scripting vulnerability in php-lms/admin/?page=system_info in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject arbitrary web script or HTML via the name, shortname parameters.", "poc": ["https://github.com/dovankha/CVE-2024-34225", "https://github.com/dovankha/CVE-2024-34225", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-20345", "desc": "A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. \nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to access sensitive data on an affected device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3769", "desc": "A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Affected is an unknown function of the file /login.php. The manipulation of the argument id/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260616.", "poc": ["https://github.com/BurakSevben/CVEs/blob/main/Student%20Record%20System%203.20/Student%20Record%20System%20-%20Authentication%20Bypass.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1488", "desc": "A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21734", "desc": "SAP Marketing (Contacts App) - version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing phishing attack with low impact on confidentiality and integrity of the application.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2025", "desc": "The \"BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages\" plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.20 via deserialization of untrusted input in the get_simple_request function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-21427", "desc": "Windows Kerberos Security Feature Bypass Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-24695", "desc": "Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28159", "desc": "A missing permission check in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers with Item/Read permission to trigger a build.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0263", "desc": "A vulnerability was found in ACME Ultra Mini HTTPd 1.21. It has been classified as problematic. This affects an unknown part of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249819.", "poc": ["https://0day.today/exploit/description/39212", "https://packetstormsecurity.com/files/176333/Ultra-Mini-HTTPd-1.21-Denial-Of-Service.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30915", "desc": "An issue was discovered in OpenDDS commit b1c534032bb62ad4ae32609778de6b8d6c823a66, allows a local attacker to cause a denial of service and obtain sensitive information via the max_samples parameter within the DataReaderQoS component.", "poc": ["https://github.com/OpenDDS/OpenDDS/issues/4527"]}, {"cve": "CVE-2024-2227", "desc": "This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-0266", "desc": "A vulnerability classified as problematic has been found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the component User Registration. The manipulation of the argument First Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249822 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0188", "desc": "A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0. This affects an unknown part of the file change_password_teacher.php. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-249501 was assigned to this vulnerability.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2024-33217", "desc": "Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter in ip/goform/addressNat.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28320", "desc": "Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access and modifications via crafted POST request to /patient/edit-user.php.", "poc": ["https://packetstormsecurity.com/files/177326/Hospital-Management-System-1.0-Insecure-Direct-Object-Reference-Account-Takeover.html", "https://sospiro014.github.io/Hospital-Management-System-1.0-Insecure-Direct-Object-Reference-+-Account-Takeover"]}, {"cve": "CVE-2024-20840", "desc": "Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02 in Android 14 allows physical attackers using hardware keyboard to use VoiceRecorder on the lock screen.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30378", "desc": "A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband edge service manager daemon (bbe-smgd) to crash upon execution of specific CLI commands, creating a Denial of Service (DoS) condition.\u00a0 The process crashes and restarts automatically.When specific CLI commands are executed, the bbe-smgd daemon attempts to write into an area of memory (mgd socket) that was already closed, causing the process to crash.\u00a0 This process manages and controls the configuration of broadband subscriber sessions and services.\u00a0 While the process is unavailable, additional subscribers will not be able to connect to the device, causing a temporary Denial of Service condition.This issue only occurs if\u00a0Graceful Routing Engine Switchover (GRES) and Subscriber Management are enabled.This issue affects Junos OS: * All versions before 20.4R3-S5, * from 21.1 before 21.1R3-S4, * from 21.2 before 21.2R3-S3, * from 21.3 before 21.3R3-S5, * from 21.4 before 21.4R3-S5, * from 22.1 before 22.1R3, * from 22.2 before 22.2R3, * from 22.3 before 22.3R2;", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2627", "desc": "Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://issues.chromium.org/issues/41493290", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0779", "desc": "The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example", "poc": ["https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2/", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-35851", "desc": "In the Linux kernel, the following vulnerability has been resolved:Bluetooth: qca: fix NULL-deref on non-serdev suspendQualcomm ROME controllers can be registered from the Bluetooth linediscipline and in this case the HCI UART serdev pointer is NULL.Add the missing sanity check to prevent a NULL-pointer dereference whenwakeup() is called for a non-serdev controller during suspend.Just return true for now to restore the original behaviour and addressthe crash with pre-6.2 kernels, which do not have commit e9b3e5b8c657(\"Bluetooth: hci_qca: only assign wakeup with serial port support\") thatcauses the crash to happen already at setup() time.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2467", "desc": "A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.", "poc": ["https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0977", "desc": "The Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image URLs in the plugin's timeline widget in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, changes the slideshow type, and then changes it back to an image.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26339", "desc": "swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a.", "poc": ["https://github.com/matthiaskramm/swftools/issues/225", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27521", "desc": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multiple parameters in the \"setOpModeCfg\" function. This security issue allows an attacker to take complete control of the device. In detail, exploitation allows unauthenticated, remote attackers to execute arbitrary system commands with administrative privileges (i.e., as user \"root\").", "poc": ["https://github.com/SpikeReply/advisories/blob/main/cve/totolink/cve-2024-27521.md"]}, {"cve": "CVE-2024-22386", "desc": "A race condition was found in the Linux kernel's drm/exynos device driver in\u00a0exynos_drm_crtc_atomic_disable() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25935", "desc": "Missing Authorization vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.2.5.9.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-29989", "desc": "Azure Monitor Agent Elevation of Privilege Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-1113", "desc": "A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/controller/Unity.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252471.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-34808", "desc": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.2.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3756", "desc": "The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/"]}, {"cve": "CVE-2024-24757", "desc": "open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when working with git actions. This problem is fixed in 1.0.1. Discontinuing all sensitive keys and turning into secrets.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0800", "desc": "A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet.", "poc": ["https://www.tenable.com/security/research/tra-2024-07"]}, {"cve": "CVE-2024-33350", "desc": "Directory Traversal vulnerability in TaoCMS v.3.0.2 allows a remote attacker to execute arbitrary code and obtain sensitive information via the include/model/file.php component.", "poc": ["https://github.com/majic-banana/vulnerability/blob/main/POC/taocms-3.0.2%20Arbitrary%20File%20Writing%20Vulnerability.md"]}, {"cve": "CVE-2024-32653", "desc": "jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary code into the package name. The vulnerability allows an attacker to execute commands with shell privileges. Version 1.5.0 contains a patch for the vulnerability.", "poc": ["https://github.com/skylot/jadx/security/advisories/GHSA-3pp3-hg2q-9gpm"]}, {"cve": "CVE-2024-25214", "desc": "An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at /alogin.html.", "poc": ["https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20Authentication%20Bypass.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24707", "desc": "Improper Control of Generation of Code ('Code Injection') vulnerability in Cwicly Builder, SL. Cwicly allows Code Injection.This issue affects Cwicly: from n/a through 1.4.0.2.", "poc": ["https://snicco.io/vulnerability-disclosure/cwicly/remote-code-execution-cwicly-1-4-0-2?_s_id=cve"]}, {"cve": "CVE-2024-22939", "desc": "Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_edit component.", "poc": ["https://github.com/NUDTTAN91/CVE-2024-22939", "https://github.com/NUDTTAN91/CVE20240109/blob/master/README.md", "https://github.com/NUDTTAN91/CVE-2024-22939", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-23201", "desc": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.7.4, watchOS 10.3, tvOS 17.3, macOS Ventura 13.6.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3. An app may be able to cause a denial-of-service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2024-24840", "desc": "Missing Authorization vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.4.11.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3076", "desc": "The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/617ec2e9-9058-4a93-8ad4-7ecb85107141/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-31705", "desc": "An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input.", "poc": ["https://github.com/V3locidad/GLPI_POC_Plugins_Shell", "https://seclists.org/fulldisclosure/2024/Apr/23", "https://github.com/V3locidad/V3locidad"]}, {"cve": "CVE-2024-2546", "desc": "A vulnerability has been found in Tenda AC18 15.13.07.09 and classified as critical. Affected by this vulnerability is the function fromSetWirelessRepeat. The manipulation of the argument wpapsk_crypto5g leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256999. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/A18/fromSetWirelessRepeat_a.md", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23280", "desc": "An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, tvOS 17.4. A maliciously crafted webpage may be able to fingerprint the user.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27234", "desc": "In fvp_set_target of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30988", "desc": "Cross Site Scripting vulnerability in /search-invoices.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to execute arbitrary code and obtain sensitive information via the Search bar.", "poc": ["https://medium.com/@shanunirwan/cve-2024-30988-cross-site-scripting-vulnerability-in-client-management-system-using-php-mysql-1-1-e7a677936c23"]}, {"cve": "CVE-2024-22353", "desc": "IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 280400.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-30572", "desc": "Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntp_server parameter.", "poc": ["https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Netgear-R6850%20V1.1.0.88%20Command%20Injection(ntp_server).md"]}, {"cve": "CVE-2024-33774", "desc": "A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formWlanSetup_Wizard allows remote authenticated users to trigger a denial of service (DoS) through the parameter \"webpage.\"", "poc": ["https://github.com/YuboZhaoo/IoT/blob/main/D-Link/DIR-619L/20240424.md"]}, {"cve": "CVE-2024-21008", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2024.html"]}, {"cve": "CVE-2024-0851", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Grup Arge Energy and Control Systems Smartpower allows SQL Injection.This issue affects Smartpower: through V24.05.27.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-26726", "desc": "In the Linux kernel, the following vulnerability has been resolved:btrfs: don't drop extent_map for free space inode on write errorWhile running the CI for an unrelated change I hit the following panicwith generic/648 on btrfs_holes_spacecache.assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385------------[ cut here ]------------kernel BUG at fs/btrfs/extent_io.c:1385!invalid opcode: 0000 [#1] PREEMPT SMP NOPTICPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G W 6.8.0-rc2+ #1RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0Call Trace: extent_write_cache_pages+0x2ac/0x8f0 extent_writepages+0x87/0x110 do_writepages+0xd5/0x1f0 filemap_fdatawrite_wbc+0x63/0x90 __filemap_fdatawrite_range+0x5c/0x80 btrfs_fdatawrite_range+0x1f/0x50 btrfs_write_out_cache+0x507/0x560 btrfs_write_dirty_block_groups+0x32a/0x420 commit_cowonly_roots+0x21b/0x290 btrfs_commit_transaction+0x813/0x1360 btrfs_sync_file+0x51a/0x640 __x64_sys_fdatasync+0x52/0x90 do_syscall_64+0x9c/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76This happens because we fail to write out the free space cache in oneinstance, come back around and attempt to write it again. However onthe second pass through we go to call btrfs_get_extent() on the inode toget the extent mapping. Because this is a new block group, and with thefree space inode we always search the commit root to avoid deadlockingwith the tree, we find nothing and return a EXTENT_MAP_HOLE for therequested range.This happens because the first time we try to write the space cache outwe hit an error, and on an error we drop the extent mapping. This isnormal for normal files, but the free space cache inode is special. Wealways expect the extent map to be correct. Thus the second timethrough we end up with a bogus extent map.Since we're deprecating this feature, the most straightforward way tofix this is to simply skip dropping the extent map range for this failedrange.I shortened the test by using error injection to stress the area to makeit easier to reproduce. With this patch in place we no longer panicwith my error injection test.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0795", "desc": "If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an `admin` role and then be able to use this new account to have elevated privileges on the instance", "poc": ["https://huntr.com/bounties/f69e3307-7b44-4776-ac60-2990990723ec"]}, {"cve": "CVE-2024-28212", "desc": "nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20935", "desc": "Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Installed Base accessible data as well as unauthorized read access to a subset of Oracle Installed Base accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-23294", "desc": "This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.4. Processing malicious input may lead to code execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3705", "desc": "Unrestricted file upload vulnerability in OpenGnsys affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to send a POST request to the endpoint '/opengnsys/images/M_Icons.php' modifying the file extension, due to lack of file extension verification, resulting in a webshell injection.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-35593", "desc": "An arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uploading a crafted PDF file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2463", "desc": "Weak password recovery mechanism in CDeX application allows to retrieve\u00a0password\u00a0reset token.This issue affects CDeX application versions through 5.7.1.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2152", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Online Mobile Management Store 1.0. Affected by this issue is some unknown functionality of the file /admin/product/manage_product.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255584.", "poc": ["https://github.com/vanitashtml/CVE-Dumps/blob/main/SQL%20Injection%20in%20Mobile%20Management%20Store.md", "https://github.com/RNBBarrett/CrewAI-examples"]}, {"cve": "CVE-2024-4392", "desc": "The Jetpack \u2013 WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3881", "desc": "A vulnerability was found in Tenda W30E 1.0.1.25(633) and classified as critical. This issue affects the function frmL7PlotForm of the file /goform/frmL7ProtForm. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260915. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/frmL7ProtForm.md"]}, {"cve": "CVE-2024-26304", "desc": "There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.", "poc": ["https://github.com/Roud-Roud-Agency/CVE-2024-26304-RCE-exploits", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/wy876/wiki"]}, {"cve": "CVE-2024-4985", "desc": "An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnerability allowed an attacker to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13.0 and was fixed in versions 3.9.15, 3.10.12, 3.11.10 and 3.12.4. This vulnerability was reported via the GitHub Bug Bounty program.", "poc": ["https://github.com/absholi7ly/Bypass-authentication-GitHub-Enterprise-Server"]}, {"cve": "CVE-2024-31872", "desc": "IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Open Source scripts due to missing certificate validation. IBM X-Force ID: 287316.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20255", "desc": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\nThis vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2815", "desc": "A vulnerability classified as critical has been found in Tenda AC15 15.03.20_multi. Affected is the function R7WebsSecurityHandler of the file /goform/execCommand of the component Cookie Handler. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/R7WebsSecurityHandler.md", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22313", "desc": "IBM Storage Defender - Resiliency Service 2.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 278749.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3128", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in Replify-Messenger 1.0 on Android. This issue affects some unknown processing of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-258869 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: The vendor was contacted early and responded very quickly. He does not intend to maintain the app anymore and will revoke the availability in the Google Play Store.", "poc": ["https://github.com/ctflearner/Android_Findings/blob/main/Replify-Messenger/Backup.md", "https://vuldb.com/?submit.307761", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20833", "desc": "Use after free vulnerability in pub_crypto_recv_msg prior to SMR Mar-2024 Release 1 due to race condition allows local attackers with system privilege to cause memory corruption.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3203", "desc": "A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.14.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-259050 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?submit.304556", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0803", "desc": "Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3540", "desc": "A vulnerability was found in Campcodes Church Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_sundaysch.php. The manipulation of the argument Gender leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259910 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-27278", "desc": "OpenPNE Plugin \"opTimelinePlugin\" 1.2.11 and earlier contains a cross-site scripting vulnerability. On the site which uses the affected product, when a user configures the profile with some malicious contents, an arbitrary script may be executed on the web browsers of other users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28849", "desc": "follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4805", "desc": "A vulnerability classified as critical has been found in Kashipara College Management System 1.0. This affects an unknown part of the file edit_faculty.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263925 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-3119", "desc": "A buffer overflow vulnerability exists in all versions of sngrep since v0.4.2, due to improper handling of 'Call-ID' and 'X-Call-ID' SIP headers. The functions sip_get_callid and sip_get_xcallid in sip.c use the strncpy function to copy header contents into fixed-size buffers without checking the data length. This flaw allows remote attackers to execute arbitrary code or cause a denial of service (DoS) through specially crafted SIP messages.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-0874", "desc": "A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-22523", "desc": "Directory Traversal vulnerability in Qiyu iFair version 23.8_ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2741", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to trick some authenticated users into performing actions in their session, such as adding or updating accounts through the Switch web interface.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-26635", "desc": "In the Linux kernel, the following vulnerability has been resolved:llc: Drop support for ETH_P_TR_802_2.syzbot reported an uninit-value bug below. [0]llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2(0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', \"90e5dd\"}}}}, 0x16)llc_conn_handler() initialises local variables {saddr,daddr}.macbased on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passesthem to __llc_lookup().However, the initialisation is done only when skb->protocol ishtons(ETH_P_802_2), otherwise, __llc_lookup_established() and__llc_lookup_listener() will read garbage.The missing initialisation existed prior to commit 211ed865108e(\"net: delete all instances of special processing for token ring\").It removed the part to kick out the token ring stuff but forgot toclose the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().Let's remove llc_tr_packet_type and complete the deprecation.[0]:BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6bLocal variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-29025", "desc": "Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.", "poc": ["https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v", "https://github.com/th2-net/th2-bom"]}, {"cve": "CVE-2024-2523", "desc": "A vulnerability classified as problematic was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. This vulnerability affects unknown code of the file /admin/booktime.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256960. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20booktime.php.md", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-1379", "desc": "The Website Article Monetization By MageNet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'abp_auth_key' parameter in all versions up to, and including, 1.0.11 due to insufficient input sanitization and output escaping and a missing authorization check. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-23112", "desc": "An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user\u2019s bookmark via URL manipulation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28678", "desc": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_description_main.php", "poc": ["https://github.com/777erp/cms/blob/main/15.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-24161", "desc": "MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered.", "poc": ["https://github.com/wy876/cve/issues/2"]}, {"cve": "CVE-2024-32876", "desc": "NewPipe is an Android app for video streaming written in Java. It supports exporting and importing backups, as a way to let users move their data to a new device effortlessly. However, in versions 0.13.4 through 0.26.1, importing a backup file from an untrusted source could have resulted in Arbitrary Code Execution. This is because backups are serialized/deserialized using Java's Object Serialization Stream Protocol, which can allow constructing any class in the app, unless properly restricted.To exploit this vulnerability, an attacker would need to build a backup file containing the exploit, and then persuade a user into importing it. During the import process, the malicious code would be executed, possibly crashing the app, stealing user data from the NewPipe app, performing nasty actions through Android APIs, and attempting Android JVM/Sandbox escapes through vulnerabilities in the Android OS.The attack can take place only if the user imports a malicious backup file, so an attacker would need to trick a user into importing a backup file from a source they can control. The implementation details of the malicious backup file can be independent of the attacked user or the device they are being run on, and do not require additional privileges.All NewPipe versions from 0.13.4 to 0.26.1 are vulnerable. NewPipe version 0.27.0 fixes the issue by doing the following: Restrict the classes that can be deserialized when calling Java's Object Serialization Stream Protocol, by adding a whitelist with only innocuous data-only classes that can't lead to Arbitrary Code Execution; deprecate backups serialized with Java's Object Serialization Stream Protocol; use JSON serialization for all newly created backups (but still include an alternative file serialized with Java's Object Serialization Stream Protocol in the backup zip for backwards compatibility); show a warning to the user when attempting to import a backup where the only available serialization mode is Java's Object Serialization Stream Protocol (note that in the future this serialization mode will be removed completely).", "poc": ["https://github.com/TeamNewPipe/NewPipe/security/advisories/GHSA-wxrm-jhpf-vp6v"]}, {"cve": "CVE-2024-26151", "desc": "The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of `FelixSchwarz/mjml-python` who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like `<script>` would be rendered as ` leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-221739.", "poc": ["https://vuldb.com/?id.221739"]}, {"cve": "CVE-2023-2422", "desc": "A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1543", "desc": "Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.", "poc": ["https://huntr.dev/bounties/f82388d6-dfc3-4fbc-bea6-eb40cf5b2683"]}, {"cve": "CVE-2023-48172", "desc": "A Cross Site Scripting (XSS) vulnerability in Shuttle Booking Software 2.0 allows a remote attacker to inject JavaScript via the name, description, title, or address parameter to index.php.", "poc": ["http://packetstormsecurity.com/files/175800"]}, {"cve": "CVE-2023-24757", "desc": "libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_unweighted_pred_16_fallback function at fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.", "poc": ["https://github.com/strukturag/libde265/issues/385"]}, {"cve": "CVE-2023-3188", "desc": "Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.", "poc": ["https://huntr.dev/bounties/0d0d526a-1c39-4e6a-b081-d3914468e495"]}, {"cve": "CVE-2023-37143", "desc": "ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp().", "poc": ["https://github.com/chakra-core/ChakraCore/issues/6888"]}, {"cve": "CVE-2023-33744", "desc": "TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Use of a Hard-coded Password (PIN): 385521, 843646, and 592671.", "poc": ["http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html"]}, {"cve": "CVE-2023-4514", "desc": "The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/365b15e6-3755-4ed5-badd-c9dd962bd9fa"]}, {"cve": "CVE-2023-5141", "desc": "The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/9997fe8d-8027-4ae0-9885-a1f5565f2d1a"]}, {"cve": "CVE-2023-43810", "desc": "OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label `http_method` that has unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. HTTP method for requests can be easily set by an attacker to be random and long. In order to be affected program has to be instrumented for HTTP handlers and does not filter any unknown HTTP methods on the level of CDN, LB, previous middleware, etc. This issue has been patched in version 0.41b0.", "poc": ["https://github.com/open-telemetry/opentelemetry-python-contrib/security/advisories/GHSA-5rv5-6h4r-h22v"]}, {"cve": "CVE-2023-32369", "desc": "A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may be able to modify protected parts of the file system.", "poc": ["https://github.com/houjingyi233/macOS-iOS-system-security", "https://github.com/yo-yo-yo-jbo/yo-yo-yo-jbo.github.io"]}, {"cve": "CVE-2023-1829", "desc": "A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation.\u00a0The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure.\u00a0A local attacker user can use this vulnerability to elevate its privileges to root.We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.", "poc": ["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8c710f75256bb3cf05ac7b1672c82b92c43f3d28", "https://github.com/EGI-Federation/SVG-advisories", "https://github.com/N1ghtu/RWCTF6th-RIPTC", "https://github.com/Threekiii/CVE", "https://github.com/lanleft/CVE2023-1829", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/star-sg/CVE", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-31518", "desc": "A heap use-after-free in the component CDataFileReader::GetItem of teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via a crafted map file.", "poc": ["https://github.com/manba-bryant/record"]}, {"cve": "CVE-2023-28526", "desc": "IBM Informix Dynamic Server 12.10 and 14.10 archecker is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault. IBM X-Force ID: 251204.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46778", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in TheFreeWindows Auto Limit Posts Reloaded plugin <=\u00a02.5 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26237", "desc": "An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a registry key as SYSTEM.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2564", "desc": "OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0.", "poc": ["https://huntr.dev/bounties/d13113ad-a107-416b-acc1-01e4c16ec461", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-21880", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-33971", "desc": "Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probable stored cross-site scripting vulnerability is present in Formcreator 2.13.5 and prior via the use of the use of `##FULLFORM##` for rendering. This could result in arbitrary javascript code execution in an admin/tech context. A patch is unavailable as of time of publication. As a workaround, one may use a regular expression to remove `< > \"` in all fields.", "poc": ["https://github.com/pluginsGLPI/formcreator/security/advisories/GHSA-777g-3848-8r3g"]}, {"cve": "CVE-2023-45867", "desc": "ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential files stored on the web server. The attacker can access files that are readable by the web server user www-data; this may include sensitive configuration files and documents located outside the documentRoot. The vulnerability is exploited by an attacker who manipulates the file parameter in a URL, inserting directory traversal sequences in order to access unauthorized files. This manipulation allows the attacker to retrieve sensitive files, such as /etc/passwd, potentially compromising the system's security. This issue poses a significant risk to confidentiality and is remotely exploitable over the internet.", "poc": ["https://rehmeinfosec.de/labor/cve-2023-45867"]}, {"cve": "CVE-2023-28180", "desc": "A denial-of-service issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. A user in a privileged network position may be able to cause a denial-of-service.", "poc": ["https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1679", "https://github.com/houjingyi233/macOS-iOS-system-security"]}, {"cve": "CVE-2023-23549", "desc": "Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hostnames.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26125", "desc": "Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.\n**Note:** Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.", "poc": ["https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-3324285"]}, {"cve": "CVE-2023-30562", "desc": "A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29738", "desc": "An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause code execution and escalation of Privileges via the database files.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29738/CVE%20detail.md", "https://play.google.com/store/apps/details?id=com.amdroidalarmclock.amdroid"]}, {"cve": "CVE-2023-7157", "desc": "A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /app/ajax/sell_return_data.php. The manipulation of the argument columns[0][data] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249179.", "poc": ["https://medium.com/@heishou/inventory-management-system-sql-injection-7b955b5707eb"]}, {"cve": "CVE-2023-46136", "desc": "Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.", "poc": ["https://github.com/marcus67/some_flask_helpers", "https://github.com/mmbazm/device_api"]}, {"cve": "CVE-2023-43318", "desc": "TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET requests.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/str2ver/CVE-2023-43318"]}, {"cve": "CVE-2023-45479", "desc": "Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the list parameter in the function sub_49E098.", "poc": ["https://github.com/l3m0nade/IOTvul/blob/master/sub_49E098.md"]}, {"cve": "CVE-2023-2414", "desc": "The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload media files, and inject malicious JavaScript.", "poc": ["https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita"]}, {"cve": "CVE-2023-1531", "desc": "Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1724", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-44019", "desc": "Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the mac parameter in the GetParentControlInfo function.", "poc": ["https://github.com/aixiao0621/Tenda/blob/main/AC10U/5/0.md", "https://github.com/aixiao0621/Tenda"]}, {"cve": "CVE-2023-26924", "desc": "** DISPUTED ** LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. NOTE: third parties dispute this because the LLVM security policy excludes \"Language front-ends ... for which a malicious input file can cause undesirable behavior.\"", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1282", "desc": "The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.", "poc": ["https://wpscan.com/vulnerability/8a9548c5-59ea-46b0-bfa5-a0f7a259351a", "https://wpscan.com/vulnerability/f4b2617f-5235-4587-9eaf-d0f6bb23dc27"]}, {"cve": "CVE-2023-33086", "desc": "Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27744", "desc": "An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remote code execution.", "poc": ["https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf"]}, {"cve": "CVE-2023-1783", "desc": "OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.", "poc": ["https://fluidattacks.com/advisories/stirling/"]}, {"cve": "CVE-2023-0907", "desc": "A vulnerability, which was classified as problematic, has been found in Filseclab Twister Antivirus 8.17. Affected by this issue is the function 0x220017 in the library ffsmon.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221456.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-0907", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-51713", "desc": "make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44353", "desc": "Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.", "poc": ["https://github.com/JC175/CVE-2023-44353-Nuclei-Template", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-36163", "desc": "Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code via a crafted script to the mc parameter of the URL.", "poc": ["http://packetstormsecurity.com/files/173366/BuildaGate5-Cross-Site-Scripting.html", "https://github.com/TraiLeR2/CVE-2023-36163", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2385", "desc": "A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been rated as problematic. This issue affects some unknown processing of the file scgi-bin/platform.cgi?page=ike_policies.htm of the component Web Management Interface. The manipulation of the argument IpsecIKEPolicy.IKEPolicyName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227663. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/5"]}, {"cve": "CVE-2023-46976", "desc": "TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function.", "poc": ["https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20A3300R/1/README.md"]}, {"cve": "CVE-2023-4176", "desc": "A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file appointmentapproval.php. The manipulation of the argument time leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236211.", "poc": ["https://vuldb.com/?id.236211"]}, {"cve": "CVE-2023-43835", "desc": "Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite config.inc.php content.", "poc": ["https://packetstormsecurity.com/files/174756/Super-Store-Finder-3.7-Remote-Command-Execution.html"]}, {"cve": "CVE-2023-3711", "desc": "Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004.\u00a0Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).", "poc": ["https://www.honeywell.com/us/en/product-security", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/vpxuser/CVE-2023-3711-POC"]}, {"cve": "CVE-2023-0677", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.", "poc": ["https://huntr.dev/bounties/d280ae81-a1c9-4a50-9aa4-f98f1f9fd2c0", "https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-0786", "desc": "Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-0675", "desc": "A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an unknown part. The manipulation of the argument start/end leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220197 was assigned to this vulnerability.", "poc": ["https://www.youtube.com/watch?v=eoPuINHWjHo"]}, {"cve": "CVE-2023-47068", "desc": "Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43581", "desc": "A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-33115", "desc": "Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49800", "desc": "`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.", "poc": ["https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-q6hx-3m4p-749h", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28606", "desc": "js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.", "poc": ["https://github.com/sixgroup-security/CVE"]}, {"cve": "CVE-2023-21868", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-27635", "desc": "debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file. (The path is shown to the user before execution.)", "poc": ["https://bugs.debian.org/1031267"]}, {"cve": "CVE-2023-38759", "desc": "Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/reset_user_password.html, templates/user/overview.html, core/views/user.py, and templates/user/preferences.html, core/forms.py components.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-29111", "desc": "The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confidentiality of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-3311", "desc": "A vulnerability, which was classified as problematic, was found in PuneethReddyHC online-shopping-system-advanced 1.0. This affects an unknown part of the file addsuppliers.php. The manipulation of the argument First name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231807.", "poc": ["https://kr1shna4garwal.github.io/posts/cve-poc-2023/#cve-2023-3311"]}, {"cve": "CVE-2023-28772", "desc": "An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3", "https://github.com/Satheesh575555/linux-4.1.15_CVE-2023-28772", "https://github.com/Trinadh465/linux-4.1.15_CVE-2023-28772", "https://github.com/hheeyywweellccoommee/linux-4.1.15_CVE-2023-28772-ipchu", "https://github.com/hshivhare67/kernel_v4.1.15_CVE-2023-28772", "https://github.com/nidhi7598/linux-4.19.72_CVE-2023-28772", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-32317", "desc": "Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both \"Base File Tar\" and \"Additional file archive\" can be fed with Tar files that contain paths outside their target directories (e.g., `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process. This issue has been addressed in version 2.11.0. Users are advised to upgrade.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-081_GHSL-2023-082_Autolab/"]}, {"cve": "CVE-2023-30331", "desc": "An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.", "poc": ["https://github.com/luelueking/Beetl-3.15.0-vuln-poc", "https://github.com/luelueking/luelueking"]}, {"cve": "CVE-2023-40362", "desc": "An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contractor information is known.", "poc": ["https://github.com/ally-petitt/CVE-2023-40362", "https://github.com/ally-petitt/CVE-2023-40362", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-48967", "desc": "Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.", "poc": ["https://github.com/noear/solon/issues/226"]}, {"cve": "CVE-2023-38764", "desc": "SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-30092", "desc": "SourceCodester Online Pizza Ordering System v1.0 is vulnerable to SQL Injection via the QTY parameter.", "poc": ["https://github.com/nawed20002/CVE-2023-30092", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1839", "desc": "The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).", "poc": ["https://wpscan.com/vulnerability/fddc5a1c-f267-4ef4-8acf-731dbecac450"]}, {"cve": "CVE-2023-47795", "desc": "Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's \u201cTitle\u201d text field.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2972", "desc": "Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.", "poc": ["https://huntr.dev/bounties/009f1cd9-401c-49a7-bd08-be35cff6faef"]}, {"cve": "CVE-2023-46017", "desc": "SQL Injection vulnerability in receiverLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'remail' and 'rpassword' parameters.", "poc": ["https://github.com/ersinerenler/CVE-2023-46017-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability", "https://github.com/ersinerenler/CVE-2023-46017-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability", "https://github.com/ersinerenler/Code-Projects-Blood-Bank-1.0", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38768", "desc": "SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-2010", "desc": "The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll.", "poc": ["https://wpscan.com/vulnerability/d0da4c0d-622f-4310-a867-6bfdb474073a"]}, {"cve": "CVE-2023-21970", "desc": "Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Security). The supported version that is affected is 6.4.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-22681", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Aarvanshinfotech Online Exam Software: eExamhall plugin <= 4.0 versions.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-45204", "desc": "A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain a type confusion vulnerability while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21268)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43239", "desc": "D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter flag_5G in showMACfilterMAC.", "poc": ["https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/showMACfilterMAC/1.md"]}, {"cve": "CVE-2023-4821", "desc": "The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensions. Therefore, an attacker can upload unsafe .shtml or .svg files containing malicious scripts.", "poc": ["https://wpscan.com/vulnerability/3ac0853b-03f7-44b9-aa9b-72df3e01a9b5"]}, {"cve": "CVE-2023-45375", "desc": "In the module \"PireosPay\" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModuleFrontController::postProcess().`", "poc": ["https://security.friendsofpresta.org/modules/2023/10/12/pireospay.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51802", "desc": "Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the page or class_month parameter in the /php-attendance/attendance_report component.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-51802", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4075", "desc": "Use after free in Cast in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45358", "desc": "Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release.", "poc": ["https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45857", "desc": "An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.", "poc": ["https://github.com/bmuenzenmeyer/axios-1.0.0-migration-guide", "https://github.com/fuyuooumi1027/CVE-2023-45857-Demo", "https://github.com/intercept6/CVE-2023-45857-Demo", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/seal-community/cli", "https://github.com/seal-community/patches", "https://github.com/stiifii/tbo_projekt", "https://github.com/valentin-panov/CVE-2023-45857", "https://github.com/zvigrinberg/exhort-service-readiness-experiment"]}, {"cve": "CVE-2023-26805", "desc": "Tenda W20E v15.11.0.6 (US_W20EV4.0br_v15.11.0.6(1068_1546_841)_CN_TDC) is vulnerable to Buffer Overflow via function formIPMacBindModify.", "poc": ["https://github.com/Stevenbaga/fengsha/blob/main/W20E/formIPMacBindModify.md"]}, {"cve": "CVE-2023-37915", "desc": "OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS crashes while parsing a malformed `PID_PROPERTY_LIST` in a DATA submessage during participant discovery. Attackers can remotely crash OpenDDS processes by sending a DATA submessage containing the malformed parameter to the known multicast port. This issue has been addressed in version 3.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-v5pp-7prc-5xq9"]}, {"cve": "CVE-2023-42791", "desc": "A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21235", "desc": "In onCreate of LockSettingsActivity.java, there is a possible way set a new lockscreen PIN without entering the existing PIN due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28616", "desc": "An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component.", "poc": ["https://advisories.stormshield.eu/2023-006"]}, {"cve": "CVE-2023-43284", "desc": "D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecified manipulation of the QoS POST parameter.", "poc": ["https://github.com/MateusTesser/CVE-2023-43284", "https://github.com/MateusTesser/CVE-2023-43284", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26320", "desc": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.", "poc": ["https://github.com/H4lo/awesome-IoT-security-article"]}, {"cve": "CVE-2023-21885", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. Note: Applies to Windows only. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0315", "desc": "Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.", "poc": ["http://packetstormsecurity.com/files/171108/Froxlor-2.0.6-Remote-Command-Execution.html", "http://packetstormsecurity.com/files/171729/Froxlor-2.0.3-Stable-Remote-Code-Execution.html", "https://huntr.dev/bounties/ff4e177b-ba48-4913-bbfa-ab8ce0db5943", "https://github.com/ARPSyndicate/cvemon", "https://github.com/CVEDB/PoC-List", "https://github.com/CVEDB/top", "https://github.com/hktalent/TOP", "https://github.com/k0mi-tg/CVE-POC", "https://github.com/manas3c/CVE-POC", "https://github.com/mhaskar/CVE-2023-0315", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/whoforget/CVE-POC", "https://github.com/youwizard/CVE-POC"]}, {"cve": "CVE-2023-4142", "desc": "The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means remote code execution is still possible for site administrators, use the plugin with caution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3765", "desc": "Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.", "poc": ["https://huntr.dev/bounties/4be5fd63-8a0a-490d-9ee1-f33dc768ed76"]}, {"cve": "CVE-2023-6843", "desc": "The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 does not properly secure some of its AJAX actions, allowing any logged-in users to modify its settings.", "poc": ["https://wpscan.com/vulnerability/41508340-8caf-4dca-bd88-350b63b78ab0"]}, {"cve": "CVE-2023-46389", "desc": "LOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 Firmware 7.2.4 are vulnerable to Incorrect Access Control via registry.xml file. This vulnerability allows remote attackers to disclose sensitive information on LINX configuration.", "poc": ["http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html"]}, {"cve": "CVE-2023-4022", "desc": "The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/c4ac0b19-58b1-4620-b3b7-fbe6dd6c8dd5"]}, {"cve": "CVE-2023-22833", "desc": "Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organization to bypass discretionary or mandatory access controls under certain circumstances.", "poc": ["https://palantir.safebase.us/?tcuUid=7f1fd834-805d-4679-85d0-9d779fa064ae"]}, {"cve": "CVE-2023-29998", "desc": "A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTML and gain privileges via the description parameter.", "poc": ["https://labs.yarix.com/2023/07/gis3w-persistent-xss-in-g3wsuite-3-5-cve-2023-29998/"]}, {"cve": "CVE-2023-23304", "desc": "The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` module without permission. A malicious application could call any functions from the `Toybox.SensorHistory` module without the user's consent and disclose potentially private or sensitive information.", "poc": ["https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23304.md"]}, {"cve": "CVE-2023-5920", "desc": "Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0865", "desc": "The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.", "poc": ["https://wpscan.com/vulnerability/e39c0171-ed4a-4143-9a31-c407e3555eec"]}, {"cve": "CVE-2023-40289", "desc": "A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges.", "poc": ["https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-0291", "desc": "The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.", "poc": ["https://packetstormsecurity.com/files/171011/wpqsm808-xsrf.txt", "https://github.com/ARPSyndicate/cvemon", "https://github.com/MrTuxracer/advisories"]}, {"cve": "CVE-2023-26475", "desc": "XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.", "poc": ["https://jira.xwiki.org/browse/XWIKI-20360"]}, {"cve": "CVE-2023-51384", "desc": "In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.", "poc": ["https://github.com/GitHubForSnap/openssh-server-gael", "https://github.com/firatesatoglu/iot-searchengine"]}, {"cve": "CVE-2023-39475", "desc": "Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is not required to exploit this vulnerability.The specific flaw exists within the ParameterVersionJavaSerializationCodec class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20290.", "poc": ["https://github.com/TecR0c/DoubleTrouble"]}, {"cve": "CVE-2023-44824", "desc": "An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0267", "desc": "The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/7ba7849d-e07b-465a-bfb7-10c8186be140"]}, {"cve": "CVE-2023-1017", "desc": "An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/bollwarm/SecToolSet", "https://github.com/vSphere8upgrade/7u3-to-8u1", "https://github.com/vSphere8upgrade/7u3-to-8u2"]}, {"cve": "CVE-2023-21744", "desc": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6147", "desc": "Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data", "poc": ["https://www.qualys.com/security-advisories/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42465", "desc": "Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43766", "desc": "Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33758", "desc": "Splicecom Maximiser Soft PBX v1.5 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the CLIENT_NAME and DEVICE_GUID fields in the login component.", "poc": ["https://github.com/twignet/splicecom", "https://github.com/twignet/splicecom"]}, {"cve": "CVE-2023-1546", "desc": "The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting", "poc": ["https://wpscan.com/vulnerability/bb065397-370f-4ee1-a2c8-20e4dc4415a0"]}, {"cve": "CVE-2023-0297", "desc": "Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.", "poc": ["http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html", "http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html", "https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Acaard/HTB-PC", "https://github.com/CVEDB/PoC-List", "https://github.com/CVEDB/top", "https://github.com/Fanxiaoyao66/Hack-The-Box-PC", "https://github.com/JacobEbben/CVE-2023-0297", "https://github.com/R4be1/Vulnerability-reports-on-two-websites-affiliated-with-the-European-Union", "https://github.com/Small-ears/CVE-2023-0297", "https://github.com/b11y/CVE-2023-0297", "https://github.com/bAuh0lz/CVE-2023-0297_Pre-auth_RCE_in_pyLoad", "https://github.com/bAuh0lz/Vulnerabilities", "https://github.com/gudetem/CVE-2023-0297", "https://github.com/hktalent/TOP", "https://github.com/jonasw234/attackerkb_checker", "https://github.com/k0mi-tg/CVE-POC", "https://github.com/linuskoester/writeups", "https://github.com/manas3c/CVE-POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/overgrowncarrot1/CVE-2023-0297", "https://github.com/sota70/PC-Easy-Writeup", "https://github.com/whoforget/CVE-POC", "https://github.com/youwizard/CVE-POC"]}, {"cve": "CVE-2023-28434", "desc": "Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/AbelChe/evil_minio", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/MiracleAnameke/Cybersecurity-Vulnerability-and-Exposure-Report", "https://github.com/Mr-xn/CVE-2023-28432", "https://github.com/Mr-xn/CVE-2023-28434", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/aneasystone/github-trending", "https://github.com/hktalent/TOP", "https://github.com/johe123qwe/github-trending", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/oxMdee/Cybersecurity-Vulnerability-and-Exposure-Report", "https://github.com/taielab/awesome-hacking-lists"]}, {"cve": "CVE-2023-29753", "desc": "An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreference files.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29753/CVE%20detailed.md"]}, {"cve": "CVE-2023-27117", "desc": "WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.", "poc": ["https://github.com/WebAssembly/wabt/issues/1989"]}, {"cve": "CVE-2023-30259", "desc": "A Buffer Overflow vulnerability in importshp plugin in LibreCAD 2.2.0 allows attackers to obtain sensitive information via a crafted DBF file.", "poc": ["https://github.com/LibreCAD/LibreCAD/issues/1481"]}, {"cve": "CVE-2023-3163", "desc": "A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of the argument value leads to resource consumption. VDB-231090 is the identifier assigned to this vulnerability.", "poc": ["https://gitee.com/y_project/RuoYi/issues/I78DOR", "https://github.com/George0Papasotiriou/CVE-2023-3163-SQL-Injection-Prevention", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-51770", "desc": "Arbitrary File Read Vulnerability in Apache Dolphinscheduler.This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.", "poc": ["https://github.com/Snakinya/Snakinya", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37240", "desc": "Vulnerability of missing input length verification in the distributed file system. Successful exploitation of this vulnerability may cause out-of-bounds read.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43879", "desc": "Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload into the Global Content Blocks in the Administration Menu.", "poc": ["https://github.com/sromanhu/RiteCMS-Stored-XSS---GlobalContent/tree/main", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43879-RiteCMS-Stored-XSS---GlobalContent"]}, {"cve": "CVE-2023-41840", "desc": "A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious OpenSSL engine library in the search path.", "poc": ["https://github.com/chnzzh/OpenSSL-CVE-lib"]}, {"cve": "CVE-2023-37582", "desc": "The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.", "poc": ["https://github.com/20142995/sectool", "https://github.com/Malayke/CVE-2023-37582_EXPLOIT", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/CVE", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/hktalent/bug-bounty", "https://github.com/izj007/wechat", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/openeasm/punkmap"]}, {"cve": "CVE-2023-1426", "desc": "The WP Tiles WordPress plugin through 1.1.2 does not ensure that posts to be displayed are not draft/private, allowing any authenticated users, such as subscriber to retrieve the titles of draft and privates posts for example. AN attacker could also retrieve the title of any other type of post.", "poc": ["https://wpscan.com/vulnerability/fdd79bb4-d434-4635-bb2b-84d079ecc746"]}, {"cve": "CVE-2023-1759", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/e8109aed-d364-4c0c-9545-4de0347b10e1"]}, {"cve": "CVE-2023-4738", "desc": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.", "poc": ["https://github.com/vim/vim/commit/ced2c7394aafdc90fb7845e09b3a3fee23d48cb1", "https://huntr.dev/bounties/9fc7dced-a7bb-4479-9718-f956df20f612"]}, {"cve": "CVE-2023-49463", "desc": "libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.", "poc": ["https://github.com/strukturag/libheif/issues/1042"]}, {"cve": "CVE-2023-3216", "desc": "Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/em1ga3l/cve-msrc-extractor"]}, {"cve": "CVE-2023-6564", "desc": "An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46978", "desc": "TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication.", "poc": ["https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20X6000R/1/README.md"]}, {"cve": "CVE-2023-42812", "desc": "Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious to issue arbitrary HTTP/HTTPS requests from the application server to internal hosts and read their responses. Version 22.05 contains a patch for this issue.", "poc": ["https://github.com/galaxyproject/galaxy/security/advisories/GHSA-vf5q-r8p9-35xh"]}, {"cve": "CVE-2023-0579", "desc": "The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks.", "poc": ["https://wpscan.com/vulnerability/574f7607-96d8-4ef8-b96c-0425ad7e7690"]}, {"cve": "CVE-2023-30701", "desc": "PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20879", "desc": "VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application can gain root access to the underlying operating system.", "poc": ["https://github.com/thiscodecc/thiscodecc"]}, {"cve": "CVE-2023-1326", "desc": "A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate privilege. It is extremely unlikely that a system administrator would configure sudo to allow unprivileged users to perform this class of exploit.", "poc": ["https://github.com/canonical/apport/commit/e5f78cc89f1f5888b6a56b785dddcb0364c48ecb", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Archan6el/Devvortex-Writeup", "https://github.com/Archan6el/Devvortex-Writeup-HackTheBox", "https://github.com/Pol-Ruiz/CVE-2023-1326", "https://github.com/diego-tella/CVE-2023-1326-PoC", "https://github.com/jbiniek/cyberpoligon23", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ssst0n3/ssst0n3"]}, {"cve": "CVE-2023-22906", "desc": "Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password.", "poc": ["https://github.com/nonamecoder/CVE-2023-22906", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/nonamecoder/CVE-2023-22906"]}, {"cve": "CVE-2023-48946", "desc": "An issue in the box_mpy function of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1178"]}, {"cve": "CVE-2023-5528", "desc": "A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.", "poc": ["https://github.com/tomerpeled92/CVE"]}, {"cve": "CVE-2023-50007", "desc": "Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via theav_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component.", "poc": ["https://trac.ffmpeg.org/ticket/10700"]}, {"cve": "CVE-2023-23932", "desc": "OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input. This issue has been patched in version 3.23.1.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-43358", "desc": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu component.", "poc": ["https://github.com/sromanhu/CMSmadesimple-Stored-XSS---News", "https://github.com/sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News"]}, {"cve": "CVE-2023-20162", "desc": "Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sg-web-multi-S9g4Nkgv"]}, {"cve": "CVE-2023-1654", "desc": "Denial of Service in GitHub repository gpac/gpac prior to 2.4.0.", "poc": ["https://huntr.dev/bounties/33652b56-128f-41a7-afcc-10641f69ff14"]}, {"cve": "CVE-2023-1197", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.", "poc": ["https://huntr.dev/bounties/97d226ea-2cd8-4f4d-9360-aa46c37fdd26"]}, {"cve": "CVE-2023-6250", "desc": "The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag", "poc": ["https://wpscan.com/vulnerability/6cad602b-7414-4867-8ae2-f0b846c4c8f0"]}, {"cve": "CVE-2023-5861", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.", "poc": ["https://huntr.com/bounties/7baecef8-6c59-42fc-bced-886c4929e220"]}, {"cve": "CVE-2023-20098", "desc": "A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files.\nThis vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could exploit this vulnerability by running a system command containing directory traversal character sequences to target an arbitrary file. A successful exploit could allow the attacker to delete arbitrary files from the system, including files owned by root.", "poc": ["https://github.com/orangecertcc/security-research/security/advisories/GHSA-5j43-q336-92ch"]}, {"cve": "CVE-2023-50889", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder \u2013 WordPress Page Builder allows Stored XSS.This issue affects Beaver Builder \u2013 WordPress Page Builder: from n/a through 2.7.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33882", "desc": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22653", "desc": "An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to command execution. An authenticated attacker can send an HTTP request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1714"]}, {"cve": "CVE-2023-50035", "desc": "PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of \"password\" parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6861", "desc": "The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24689", "desc": "An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webserver via manipulation of the \"s\" parameter in /DesignTools/ManageSkin.aspx", "poc": ["https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/blakduk/Advisories"]}, {"cve": "CVE-2023-24571", "desc": "Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with administrator privileges could potentially exploit this vulnerability to perform arbitrary code execution.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-33196", "desc": "Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.", "poc": ["https://github.com/craftcms/cms/security/advisories/GHSA-cjmm-x9x9-m2w5"]}, {"cve": "CVE-2023-24366", "desc": "An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request.", "poc": ["https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2023-24366.md", "https://github.com/mrojz/rconfig-exploit/blob/main/rconfigV6_Local_File_Disclosure.md"]}, {"cve": "CVE-2023-33831", "desc": "A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.", "poc": ["https://github.com/codeb0ss/CVE-2023-33831-PoC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831"]}, {"cve": "CVE-2023-4201", "desc": "A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file ex_catagory_data.php. The manipulation of the argument columns[1][data] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236291.", "poc": ["https://github.com/Yesec/Inventory-Management-System/blob/main/SQL%20Injection%20in%20ex_catagory_data.php/vuln.md"]}, {"cve": "CVE-2023-38702", "desc": "Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload `template file` on the server, but does not need any authorization to be reached. When the JSP file is uploaded, the attacker just needs to connect to `/knowageqbeengine/foo.jsp` to gain code execution on the server. By exploiting this vulnerability, an attacker with low privileges can upload a JSP file to the `knowageqbeengine` directory and gain code execution capability on the server. This issue has been patched in Knowage version 8.1.8.", "poc": ["https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-7mjh-73q3-c3fc", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2299", "desc": "The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.2.10 due to a missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the plugin's settings.", "poc": ["https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita"]}, {"cve": "CVE-2023-6621", "desc": "The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/b49ca336-5bc2-4d72-a9a5-b8c020057928", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2647", "desc": "A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/utility_all.php of the component File Upload Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/sunyixuan1228/cve/blob/main/weaver%20exec.md"]}, {"cve": "CVE-2023-21968", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-47994", "desc": "An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a denial of service and/or run arbitrary code.", "poc": ["https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47994", "https://github.com/thelastede/FreeImage-cve-poc"]}, {"cve": "CVE-2023-21750", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/170948/Windows-Kernel-Virtualizable-Hive-Key-Deletion.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-2934", "desc": "Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/173259/Chrome-Mojo-Message-Validation-Bypass.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-26776", "desc": "Cross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of the post_receiver-services.php file.", "poc": ["http://packetstormsecurity.com/files/171705/Monitorr-1.7.6-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-43757", "desc": "Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated attacker to guess the encryption key used for wireless LAN communication and intercept the communication. As for the affected products/versions, see the information provided by the vendor under [References] section.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sharmashreejaa/CVE-2023-43757"]}, {"cve": "CVE-2023-5352", "desc": "The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not have permission.", "poc": ["https://wpscan.com/vulnerability/d32b2136-d923-4f36-bd76-af4578deb23b"]}, {"cve": "CVE-2023-41047", "desc": "OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract data managed by OctoPrint, or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. OctoPrint versions from 1.9.3 onward have been patched. Administrators of OctoPrint instances are advised to make sure they can trust all other administrators on their instance and to also not blindly configure arbitrary GCODE scripts found online or provided to them by third parties.", "poc": ["https://github.com/numencyber/Vulnerability_PoC", "https://github.com/rggu2zr/rggu2zr"]}, {"cve": "CVE-2023-2989", "desc": "Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited", "poc": ["https://www.rapid7.com/blog/post/2023/06/22/multiple-vulnerabilities-in-fortra-globalscape-eft-administration-server-fixed/", "https://github.com/rbowes-r7/gestalt"]}, {"cve": "CVE-2023-6274", "desc": "A vulnerability was found in Byzoro Smart S80 up to 20231108. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /sysmanage/updatelib.php of the component PHP File Handler. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246103. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Carol7S/cve/blob/main/rce.md", "https://vuldb.com/?id.246103"]}, {"cve": "CVE-2023-0375", "desc": "The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/915d6add-d3e2-4ced-969e-9523981ac886"]}, {"cve": "CVE-2023-30449", "desc": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 253439.", "poc": ["https://www.ibm.com/support/pages/node/7010557"]}, {"cve": "CVE-2023-26157", "desc": "Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c.", "poc": ["https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBREDWG-6070730", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4228", "desc": "A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41098", "desc": "An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26913", "desc": "** UNSUPPORTED WHEN ASSIGNED ** EVOLUCARE ECSIMAGING (aka ECS Imaging) < 6.21.5 is vulnerable to Cross Site Scripting (XSS) via new_movie. php.", "poc": ["https://wanheiqiyihu.top/2023/02/13/Evolucare-Ecsimaging-new-movie-php%E5%8F%8D%E5%B0%84%E6%80%A7xss/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31753", "desc": "SQL injection vulnerability in diskusi.php in eNdonesia 8.7, allows an attacker to execute arbitrary SQL commands via the \"rid=\" parameter.", "poc": ["https://github.com/khmk2k/CVE-2023-31753/", "https://github.com/khmk2k/CVE-2023-31753", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0550", "desc": "The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided to the AJAX action is indeed a menu item. This makes it possible for authenticated attackers, with subscriber-level access or higher, to modify or delete arbitrary posts.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-44263", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Riyaz Social Metrics plugin <=\u00a02.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38501", "desc": "copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.", "poc": ["http://packetstormsecurity.com/files/173821/Copyparty-1.8.6-Cross-Site-Scripting.html", "https://github.com/9001/copyparty/security/advisories/GHSA-f54q-j679-p9hh", "https://github.com/codeb0ss/CVE-2023-38501-Exploit", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6778", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository allegroai/clearml-server prior to 1.13.0.", "poc": ["https://huntr.com/bounties/5f3fffac-0358-48e6-a500-81bac13e0e2b"]}, {"cve": "CVE-2023-32560", "desc": "An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.Thanks to a Researcher at Tenable for finding and reporting.Fixed in version 6.4.1.", "poc": ["http://packetstormsecurity.com/files/174459/Ivanti-Avalance-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/174698/Ivanti-Avalanche-MDM-Buffer-Overflow.html", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/x0rb3l/CVE-2023-32560"]}, {"cve": "CVE-2023-44765", "desc": "A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.", "poc": ["https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Associations", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-44765_ConcreteCMS-Stored-XSS---Associations"]}, {"cve": "CVE-2023-29458", "desc": "Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5718", "desc": "The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web page with an iFrame targeting a sensitive resource (i.e. a locally accessible file or sensitive website), and registering a listener on the web page, the extension sent messages back to the listener, containing the base64 encoded screenshot data of the sensitive resource.", "poc": ["https://gist.github.com/CalumHutton/bdb97077a66021ed455f87823cd7c7cb"]}, {"cve": "CVE-2023-26083", "desc": "Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.", "poc": ["https://github.com/0x36/Pixel_GPU_Exploit", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/jiayy/android_vuln_poc-exp", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-24941", "desc": "Windows Network File System Remote Code Execution Vulnerability", "poc": ["https://github.com/mawinkler/c1-ws-ansible"]}, {"cve": "CVE-2023-0143", "desc": "The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.", "poc": ["https://wpscan.com/vulnerability/c4cd3d98-9678-49cb-9d1a-551ef8a810b9"]}, {"cve": "CVE-2023-21952", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). The supported version that is affected is 6.4.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-46025", "desc": "SQL Injection vulnerability in teacher-info.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to obtain sensitive information via the 'editid' parameter.", "poc": ["https://github.com/ersinerenler/phpgurukul-Teacher-Subject-Allocation-Management-System-1.0/blob/main/CVE-2023-46025-phpgurukul-Teacher-Subject-Allocation-Management-System-1.0-SQL-Injection-Vulnerability.md", "https://github.com/ersinerenler/PHPGurukul-Teacher-Subject-Allocation-Management-System-1.0"]}, {"cve": "CVE-2023-26597", "desc": "Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41724", "desc": "A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-37990", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Mike Perelink Pro plugin <=\u00a02.1.4 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36828", "desc": "Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.", "poc": ["https://github.com/statamic/cms/security/advisories/GHSA-6r5g-cq4q-327g"]}, {"cve": "CVE-2023-45006", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ByConsole WooODT Lite \u2013 WooCommerce Order Delivery or Pickup with Date Time Location plugin <=\u00a02.4.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25815", "desc": "In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\\mingw64\\share\\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\\` (and since `C:\\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\\`.", "poc": ["https://github.com/9069332997/session-1-full-stack", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27992", "desc": "The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to\u00a0V5.21(AAZF.14)C0, NAS540 firmware versions prior to\u00a0V5.21(AATB.11)C0, and NAS542\u00a0firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/todb-cisa/kev-cwes"]}, {"cve": "CVE-2023-39379", "desc": "Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As a result, the password for the proxy server that is configured in ISM may be retrieved. Affected products and versions are as follows: Fujitsu Software Infrastructure Manager Advanced Edition V2.8.0.060, Fujitsu Software Infrastructure Manager Advanced Edition for PRIMEFLEX V2.8.0.060, and Fujitsu Software Infrastructure Manager Essential Edition V2.8.0.060.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37602", "desc": "An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.", "poc": ["https://www.exploit-db.com/exploits/51564", "https://github.com/capture0x/My-CVE"]}, {"cve": "CVE-2023-27788", "desc": "An issue found in TCPrewrite v.4.4.3 allows a remote attacker to cause a denial of service via the ports2PORT function at the portmap.c:69 endpoint.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Marsman1996/pocs"]}, {"cve": "CVE-2023-46722", "desc": "The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually.", "poc": ["https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-jfxw-6c5v-c42f", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-33641", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/SycYkOj42"]}, {"cve": "CVE-2023-23914", "desc": "A cleartext transmission of sensitive information vulnerability exists in curl leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249003.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/E-Commerce_Website/E-Commerce%20Website%20-%20Stored%20Cross-site%20Scripting.md", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-50470", "desc": "A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.", "poc": ["https://blog.csdn.net/weixin_72610998/article/details/134784075?spm=1001.2014.3001.5502"]}, {"cve": "CVE-2023-23529", "desc": "A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "poc": ["http://seclists.org/fulldisclosure/2023/Mar/20", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Threekiii/CVE", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-34724", "desc": "An issue was discovered in TECHView LA5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via the UART interface.", "poc": ["http://packetstormsecurity.com/files/174553/TECHView-LA5570-Wireless-Gateway-1.0.19_T53-Traversal-Privilege-Escalation.html", "https://www.exploitsecurity.io/post/cve-2023-34723-cve-2023-34724-cve-2023-34725"]}, {"cve": "CVE-2023-45252", "desc": "DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the service in a directory that grants write privileges to standard users, allows attackers to manipulate files, execute arbitrary code, and escalate privileges.", "poc": ["https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253/"]}, {"cve": "CVE-2023-46378", "desc": "Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23731", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <=\u00a01.3.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5306", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31471", "desc": "An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install software from the filesystem, the package list, or a URL.", "poc": ["https://github.com/gl-inet/CVE-issues/blob/main/3.215/Abuse_of_Functionality_leads_to_RCE.md"]}, {"cve": "CVE-2023-38366", "desc": "IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 261115.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/kosmosec/CVE-numbers"]}, {"cve": "CVE-2023-37917", "desc": "KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-757p-vx43-fp9r"]}, {"cve": "CVE-2023-27421", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest themes Everest News theme <=\u00a01.1.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36025", "desc": "Windows SmartScreen Security Feature Bypass Vulnerability", "poc": ["https://github.com/J466Y/test_CVE-2023-36025", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/coolman6942o/-EXPLOIT-CVE-2023-36025", "https://github.com/ka7ana/CVE-2023-36025", "https://github.com/knowitsakey/elusiver", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/onhexgroup/Malware-Sample", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-26912", "desc": "Cross site scripting (XSS) vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows local attackers to execute arbitrary code via the evaluate button.", "poc": ["https://github.com/xenv/S-mall-ssm/issues/37"]}, {"cve": "CVE-2023-3423", "desc": "Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0.", "poc": ["https://huntr.dev/bounties/dd19c7d0-70f1-4d86-a552-611dfa8e0139"]}, {"cve": "CVE-2023-43791", "desc": "Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.", "poc": ["https://github.com/HumanSignal/label-studio/security/advisories/GHSA-f475-x83m-rx5m", "https://github.com/elttam/publications"]}, {"cve": "CVE-2023-47130", "desc": "Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection"]}, {"cve": "CVE-2023-42449", "desc": "Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed check for burning the head ST in the `initial` validator. This is possible because it is not checked in `HeadTokens.hs` that the datums of the outputs at the `initial` validator are equal to the real head ID, and it is also not checked in the `off-chain code`.During the `Initial` state of the protocol, if the malicious initializer removes a PT from the Hydra scripts it becomes impossible for any other participant to reclaim any funds they have attempted to commit into the head, as to do so the Abort transaction must burn all the PTs for the head, but they cannot burn the PT which the attacker controls and so cannot satisfy this requirement. That means the initializer can lock the other participants committed funds forever or until they choose to return the PT (ransom).The malicious initializer can also use the PT to spoof that they have committed a particular TxO when progressing the head into the `Open` state. For example, they could say they committed a TxO residing at their address containing 100 ADA, but in fact this 100 ADA was not moved into the head, and thus in order for an other participant to perform the fanout they will be forced to pay the attacker the 100 ADA out of their own funds, as the fanout transaction must pay all the committed TxOs (even though the attacker did not really commit that TxO). They can do this by placing the PT in a UTxO with a well-formed `Commit` datum with whatever contents they like, then use this UTxO in the `collectCom` transaction. There may be other possible ways to abuse having control of a PT.Version 0.13.0 fixes this issue.", "poc": ["https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0130---2023-10-03", "https://github.com/input-output-hk/hydra/security/advisories/GHSA-9m8q-7wxv-v65p"]}, {"cve": "CVE-2023-6867", "desc": "The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1863863", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5572", "desc": "Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0.", "poc": ["https://huntr.dev/bounties/db649f1b-8578-4ef0-8df3-d320ab33f1be", "https://github.com/l0kihardt/l0kihardt"]}, {"cve": "CVE-2023-32603", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy \u2013 Smart Donations plugin <=\u00a04.0.12 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33131", "desc": "Microsoft Outlook Remote Code Execution Vulnerability", "poc": ["http://packetstormsecurity.com/files/173361/Microsoft-365-MSO-2306-Build-16.0.16529.20100-Remote-Code-Execution.html", "https://github.com/2lambda123/CVE-mitre", "https://github.com/nu11secur1ty/CVE-mitre"]}, {"cve": "CVE-2023-30740", "desc": "SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality, limited impact on integrity and availability of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-52461", "desc": "In the Linux kernel, the following vulnerability has been resolved:drm/sched: Fix bounds limiting when given a malformed entityIf we're given a malformed entity in drm_sched_entity_init()--shouldn'thappen, but we verify--with out-of-bounds priority value, we set it to anallowed value. Fix the expression which sets this limit.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7125", "desc": "The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which could allow attackers to make logged in users perform such action via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/cac12b64-ed25-4ee2-933f-8ff722605271/"]}, {"cve": "CVE-2023-33761", "desc": "eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /view/cb/format_642.php.", "poc": ["https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33761", "https://github.com/rauschecker/CVEs"]}, {"cve": "CVE-2023-39834", "desc": "PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.", "poc": ["https://github.com/Pbootcms/Pbootcms/issues/8"]}, {"cve": "CVE-2023-5402", "desc": "A CWE-269: Improper Privilege Management vulnerability exists that could cause a remotecode execution when the transfer command is used over the network.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4798", "desc": "The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.", "poc": ["https://wpscan.com/vulnerability/273a95bf-39fe-4ba7-bc14-9527acfd9f42"]}, {"cve": "CVE-2023-45499", "desc": "VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.", "poc": ["http://packetstormsecurity.com/files/175397/VinChin-VMWare-Backup-7.0-Hardcoded-Credential-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176289/Vinchin-Backup-And-Recovery-Command-Injection.html", "http://seclists.org/fulldisclosure/2023/Oct/31", "https://blog.leakix.net/2023/10/vinchin-backup-rce-chain/"]}, {"cve": "CVE-2023-27742", "desc": "IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.", "poc": ["https://github.com/G37SYS73M/CVE-2023-27742", "https://github.com/G37SYS73M/CVE-2023-27742", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-49242", "desc": "Free broadcast vulnerability in the running management module. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46863", "desc": "Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33269", "desc": "An issue was discovered in DTS Monitoring 3.57.0. The parameter options within the WGET check function is vulnerable to OS command injection (blind).", "poc": ["https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33269.md", "https://github.com/dtssec/CVE-Disclosures", "https://github.com/l4rRyxz/CVE-Disclosures"]}, {"cve": "CVE-2023-28489", "desc": "A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter \u201cRemote Operation\u201d is enabled. The parameter is disabled by default.\nThe vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device.", "poc": ["http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html", "http://seclists.org/fulldisclosure/2023/Jul/14"]}, {"cve": "CVE-2023-23854", "desc": "SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-5557", "desc": "A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45106", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Fedor Urvanov, Aram Kocharyan Urvanov Syntax Highlighter plugin <=\u00a02.8.33 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4321", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.", "poc": ["https://huntr.dev/bounties/fce38751-bfd6-484c-b6e1-935e0aa8ffdc"]}, {"cve": "CVE-2023-3537", "desc": "A vulnerability classified as problematic has been found in SimplePHPscripts News Script PHP Pro 2.4. This affects an unknown part of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-233289 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.233289"]}, {"cve": "CVE-2023-23936", "desc": "Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Extiri/extiri-web"]}, {"cve": "CVE-2023-44398", "desc": "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, `BmffImage::brotliUncompress`, is new in v0.28.0, so earlier versions of Exiv2 are _not_ affected. The out-of-bounds write is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. This bug is fixed in version v0.28.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/Exiv2/exiv2/commit/e884a0955359107f4031c74a07406df7e99929a5", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40609", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aiyaz, maheshpatel Contact form 7 Custom validation allows SQL Injection.This issue affects Contact form 7 Custom validation: from n/a through 1.1.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21846", "desc": "Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/yycunhua/4ra1n"]}, {"cve": "CVE-2023-39618", "desc": "TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1956", "desc": "A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=delete_img of the component Image Handler. The manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225343.", "poc": ["https://vuldb.com/?id.225343"]}, {"cve": "CVE-2023-0565", "desc": "Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-36366", "desc": "An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/Sedar2024/Sedar"]}, {"cve": "CVE-2023-1660", "desc": "The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard", "poc": ["https://wpscan.com/vulnerability/1a5cbcfc-fa55-433a-a76b-3881b6c4bea2"]}, {"cve": "CVE-2023-37715", "desc": "Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function frmL7ProtForm.", "poc": ["https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/fmL7ProtForm/reprot.md"]}, {"cve": "CVE-2023-45143", "desc": "Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29300", "desc": "Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.", "poc": ["https://github.com/20142995/sectool", "https://github.com/DarkFunct/CVE_Exploits", "https://github.com/Ostorlab/KEV", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/Vulhub-Reproduce", "https://github.com/XRSec/AWVS-Update", "https://github.com/Y4tacker/JavaSec", "https://github.com/ggjkjk/1444", "https://github.com/gobysec/Research", "https://github.com/ibaiw/2023Hvv", "https://github.com/passwa11/2023Hvv_"]}, {"cve": "CVE-2023-27032", "desc": "Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().", "poc": ["https://friends-of-presta.github.io/security-advisories/modules/2023/04/11/advancedpopupcreator.html"]}, {"cve": "CVE-2023-37141", "desc": "ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray().", "poc": ["https://github.com/chakra-core/ChakraCore/issues/6886"]}, {"cve": "CVE-2023-37686", "desc": "Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Nurse Page in the Admin portal.", "poc": ["https://github.com/rt122001/CVES/blob/main/CVE-2023-37686.txt", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38253", "desc": "An out-of-bounds read flaw was found in w3m, in the growbuf_to_Str function in indep.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.", "poc": ["https://github.com/tats/w3m/issues/271", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45852", "desc": "In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.", "poc": ["https://github.com/Push3AX/vul/blob/main/viessmann/Vitogate300_RCE.md", "https://github.com/komodoooo/Some-things", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-1639", "desc": "A vulnerability classified as problematic has been found in IObit Malware Fighter 9.4.0.776. This affects the function 0x8001E04C in the library ImfRegistryFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224019.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1639", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-1249", "desc": "A use-after-free flaw was found in the Linux kernel\u2019s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 (\"coredump: Use the vma snapshot in fill_files_note\") not applied yet, then kernel could be affected.", "poc": ["http://packetstormsecurity.com/files/171912/CentOS-Stream-9-Missing-Kernel-Security-Fix.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-28432", "desc": "Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.", "poc": ["https://github.com/0day404/vulnerability-poc", "https://github.com/0x783kb/Security-operation-book", "https://github.com/0xRulez/CVE-2023-28432", "https://github.com/20142995/Goby", "https://github.com/20142995/sectool", "https://github.com/ARPSyndicate/cvemon", "https://github.com/AbelChe/evil_minio", "https://github.com/Awrrays/FrameVul", "https://github.com/C1ph3rX13/CVE-2023-28432", "https://github.com/CHINA-china/MinIO_CVE-2023-28432_EXP", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/Chocapikk/CVE-2023-28432", "https://github.com/Cuerz/CVE-2023-28432", "https://github.com/Henry4E36/POCS", "https://github.com/KayCHENvip/vulnerability-poc", "https://github.com/LHXHL/Minio-CVE-2023-28432", "https://github.com/Loginsoft-LLC/Linux-Exploit-Detection", "https://github.com/Loginsoft-Research/Linux-Exploit-Detection", "https://github.com/Majus527/MinIO_CVE-2023-28432", "https://github.com/Mr-xn/CVE-2023-28432", "https://github.com/MzzdToT/CVE-2023-28432", "https://github.com/Okaytc/minio_unauth_check", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Romanc9/Gui-poc-test", "https://github.com/SrcVme50/Skyfall", "https://github.com/TaroballzChen/CVE-2023-28432-metasploit-scanner", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/CVE", "https://github.com/Threekiii/Vulhub-Reproduce", "https://github.com/acheiii/CVE-2023-28432", "https://github.com/atk7r/Taichi", "https://github.com/bakery312/Vulhub-Reproduce", "https://github.com/bingtangbanli/CVE-2023-28432", "https://github.com/bingtangbanli/VulnerabilityTools", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/gmh5225/Awesome-ML-Security_", "https://github.com/gobysec/CVE-2023-28432", "https://github.com/h0ng10/CVE-2023-28432_docker", "https://github.com/hktalent/TOP", "https://github.com/izj007/wechat", "https://github.com/komodoooo/Some-things", "https://github.com/komodoooo/some-things", "https://github.com/netuseradministrator/CVE-2023-28432", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/soxoj/information-disclosure-writeups-and-pocs", "https://github.com/steponeerror/Cve-2023-28432-", "https://github.com/trailofbits/awesome-ml-security", "https://github.com/unam4/CVE-2023-28432-minio_update_rce", "https://github.com/whoami13apt/files2", "https://github.com/xk-mt/CVE-2023-28432", "https://github.com/yTxZx/CVE-2023-28432", "https://github.com/yuyongxr/minio_cve-2023-28432"]}, {"cve": "CVE-2023-28349", "desc": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be compelled to write arbitrary files to arbitrary locations on disk with NT AUTHORITY/SYSTEM level permissions, enabling remote code execution.", "poc": ["https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/", "https://research.nccgroup.com/?research=Technical%20advisories"]}, {"cve": "CVE-2023-49769", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49093", "desc": "HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker\u2019s webpage. This vulnerability has been patched in version 3.9.0", "poc": ["https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7"]}, {"cve": "CVE-2023-2751", "desc": "The Upload Resume WordPress plugin through 1.2.0 does not validate the captcha parameter when uploading a resume via the resume_upload_form shortcode, allowing unauthenticated visitors to upload arbitrary media files to the site.", "poc": ["https://wpscan.com/vulnerability/1b0fe0ac-d0d1-473d-af5b-dad6217933d4"]}, {"cve": "CVE-2023-2631", "desc": "A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.", "poc": ["https://github.com/jenkinsci/codedx-plugin"]}, {"cve": "CVE-2023-27234", "desc": "A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application.", "poc": ["https://github.com/Cherry-toto/jizhicms/issues/85"]}, {"cve": "CVE-2023-1385", "desc": "Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services.This issue affects:Amazon Fire TV Stick 3rd gen\u00a0versions prior to 6.2.9.5.Insignia TV with FireOS\u00a07.6.3.3.", "poc": ["https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/"]}, {"cve": "CVE-2023-0401", "desc": "A NULL pointer can be dereferenced when signatures are beingverified on PKCS7 signed or signedAndEnveloped data. In case the hashalgorithm used for the signature is known to the OpenSSL library butthe implementation of the hash algorithm is not available the digestinitialization will fail. There is a missing check for the returnvalue from the initialization function which later leads to invalidusage of the digest API most likely leading to a crash.The unavailability of an algorithm can be caused by using FIPSenabled configuration of providers or more commonly by not loadingthe legacy provider.PKCS7 data is processed by the SMIME library calls and also by thetime stamp (TS) library calls. The TLS implementation in OpenSSL doesnot call these functions however third party applications would beaffected if they call these functions to verify signatures on untrusteddata.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Tuttu7/Yum-command", "https://github.com/a23au/awe-base-images", "https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/stkcat/awe-base-images"]}, {"cve": "CVE-2023-5256", "desc": "In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.The core REST and contributed GraphQL modules are not affected.", "poc": ["https://github.com/elttam/publications"]}, {"cve": "CVE-2023-39434", "desc": "A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.", "poc": ["https://github.com/dlehgus1023/dlehgus1023"]}, {"cve": "CVE-2023-45396", "desc": "An Insecure Direct Object Reference (IDOR) vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12.", "poc": ["https://github.com/strik3r0x1/Vulns/blob/main/(IDOR)%20leads%20to%20events%20profiles%20access%20-%20Elenos.md"]}, {"cve": "CVE-2023-29457", "desc": "Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts.", "poc": ["https://github.com/Hritikpatel/InsecureTrust_Bank", "https://github.com/Hritikpatel/SecureTrust_Bank", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/futehc/tust5"]}, {"cve": "CVE-2023-43183", "desc": "Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows read-only users to arbitrarily change the password of an admin and hijack their account.", "poc": ["http://seclists.org/fulldisclosure/2024/Jan/43", "https://packetstormsecurity.com/files/176841/Reprise-License-Manager-15.1-Privilege-Escalation-File-Write.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35088", "desc": "Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.\u00a0In the toAuditCkSql method, the groupId, streamId, auditId, and dt are directly concatenated into the SQL query statement, which may lead to SQL injection attacks.Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.[1] https://github.com/apache/inlong/pull/8198", "poc": ["http://seclists.org/fulldisclosure/2023/Jul/43"]}, {"cve": "CVE-2023-2831", "desc": "Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a large number of escaped characters.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-2482", "desc": "The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/c0f73781-be7e-482e-91de-ad7991ad4bd5"]}, {"cve": "CVE-2023-42644", "desc": "In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21826", "desc": "Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hospitality Reporting and Analytics. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-0566", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-2391", "desc": "A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This issue affects some unknown processing of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ntp.server2 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227669 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/11"]}, {"cve": "CVE-2023-23596", "desc": "jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an authenticated attacker to execute arbitrary commands on the system. NOTE: this is not part of any NGINX software shipped by F5.", "poc": ["https://advisory.dw1.io/57"]}, {"cve": "CVE-2023-4393", "desc": "HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against an organization.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47612", "desc": "A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to obtain a read/write access to any files and directories on the targeted system, including hidden files and directories.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6077", "desc": "The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected", "poc": ["https://wpscan.com/vulnerability/1afc0e4a-f712-47d4-bf29-7719ccbbbb1b"]}, {"cve": "CVE-2023-23131", "desc": "Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/l00neyhacker/CVE-2023-23131"]}, {"cve": "CVE-2023-28260", "desc": ".NET DLL Hijacking Remote Code Execution Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/ycdxsb/ycdxsb"]}, {"cve": "CVE-2023-31433", "desc": "A SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated attackers to execute SQL statements via the welche parameter.", "poc": ["https://cves.at/posts/cve-2023-31433/writeup/", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/trustcves/CVE-2023-31433"]}, {"cve": "CVE-2023-43890", "desc": "Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. This vulnerability is exploited via a crafted HTTP request.", "poc": ["https://github.com/adhikara13/CVE/blob/main/netis_N3/command%20injection%20bypass%20filter.md", "https://github.com/Luwak-IoT-Security/CVEs"]}, {"cve": "CVE-2023-6374", "desc": "Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51437", "desc": "Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification.Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the `saslJaasServerRoleTokenSignerSecretPath` file.Any component matching an above version running the SASL Authentication Provider is affected. That includes the Pulsar Broker, Proxy, Websocket Proxy, or Function Worker.2.11 Pulsar users should upgrade to at least 2.11.3.3.0 Pulsar users should upgrade to at least 3.0.2.3.1 Pulsar users should upgrade to at least 3.1.1.Any users running Pulsar 2.8, 2.9, 2.10, and earlier should upgrade to one of the above patched versions.For additional details on this attack vector, please refer to https://codahale.com/a-lesson-in-timing-attacks/ .", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32749", "desc": "Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted.", "poc": ["http://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.html", "http://seclists.org/fulldisclosure/2023/May/18", "https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses", "https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-003/-pydio-cells-unauthorised-role-assignments", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-7215", "desc": "A vulnerability, which was classified as problematic, has been found in Chanzhaoyu chatgpt-web 2.11.1. This issue affects some unknown processing. The manipulation of the argument Description with the input leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249779.", "poc": ["https://github.com/Chanzhaoyu/chatgpt-web/issues/2001", "https://vuldb.com/?id.249779", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2585", "desc": "Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48728", "desc": "A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1883", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1883"]}, {"cve": "CVE-2023-50339", "desc": "Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.", "poc": ["https://github.com/a-zara-n/a-zara-n"]}, {"cve": "CVE-2023-44832", "desc": "D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the MacAddress parameter in the SetWanSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.", "poc": ["https://github.com/password123456/cve-collector"]}, {"cve": "CVE-2023-38672", "desc": "FPE in paddle.trace in PaddlePaddle before 2.5.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-004.md"]}, {"cve": "CVE-2023-37049", "desc": "emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\\template.php.", "poc": ["https://github.com/Num-Nine/CVE/issues/1"]}, {"cve": "CVE-2023-40158", "desc": "Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21536", "desc": "Event Tracing for Windows Information Disclosure Vulnerability", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5313", "desc": "A vulnerability classified as problematic was found in phpkobo Ajax Poll Script 3.18. Affected by this vulnerability is an unknown functionality of the file ajax-poll.php of the component Poll Handler. The manipulation leads to improper enforcement of a single, unique action. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240949 was assigned to this vulnerability.", "poc": ["https://github.com/tht1997/WhiteBox/blob/main/PHPKOBO/ajax_pool_script.md", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-25804", "desc": "Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a limited path traversal vulnerability. An SSH key can be saved into an unintended location, for example the `/tmp` folder using a payload `../../../../../tmp/test111_dev`. This issue has been fixed in version 6.3.5.0.", "poc": ["https://github.com/Sim4n6/Sim4n6"]}, {"cve": "CVE-2023-38267", "desc": "IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 260584.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43514", "desc": "Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41000", "desc": "GPAC through 2.2.1 has a use-after-free vulnerability in the function gf_bifs_flush_command_list in bifs/memory_decoder.c.", "poc": ["https://github.com/gpac/gpac/issues/2550"]}, {"cve": "CVE-2023-45142", "desc": "OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.", "poc": ["https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmr", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22009", "desc": "Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workforce Management). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Self-Service Human Resources. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Self-Service Human Resources accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-50292", "desc": "Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr.This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0.The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets.However, when the feature was created, the \"trust\" (authentication) of these configSets was not considered.External library loading is only available to configSets that are \"trusted\" (created by authenticated users), thus non-authenticated users are unable to perform Remote Code Execution.Since the Schema Designer loaded configSets without taking their \"trust\" into account, configSets that were created by unauthenticated users were allowed to load external libraries when used in the Schema Designer.Users are recommended to upgrade to version 9.3.0, which fixes the issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5319", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.", "poc": ["https://huntr.dev/bounties/e2542cbe-41ab-4a90-b6a4-191884c1834d"]}, {"cve": "CVE-2023-27062", "desc": "Tenda V15V1.0 was discovered to contain a buffer overflow vulnerability via the gotoUrl parameter in the formPortalAuth function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.", "poc": ["https://github.com/didi-zhiyuan/vuln/blob/main/iot/Tenda/W15EV1/formPortalAuth.md"]}, {"cve": "CVE-2023-7104", "desc": "A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.", "poc": ["https://github.com/GrigGM/05-virt-04-docker-hw", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26152", "desc": "All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server.js.", "poc": ["https://gist.github.com/lirantal/1f7021703a2065ecaf9ec9e06a3a346d", "https://security.snyk.io/vuln/SNYK-JS-STATICSERVER-5722341", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28746", "desc": "Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26451", "desc": "Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44764", "desc": "A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).", "poc": ["https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Site_Installation", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-44764_ConcreteCMS-Stored-XSS---Site_Installation"]}, {"cve": "CVE-2023-38357", "desc": "Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.", "poc": ["http://packetstormsecurity.com/files/173609/RWS-WorldServer-11.7.3-Session-Token-Enumeration.html", "http://seclists.org/fulldisclosure/2023/Jul/30", "https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-001/-session-token-enumeration-in-rws-worldserver"]}, {"cve": "CVE-2023-29986", "desc": "spring-boot-actuator-logview 0.2.13 allows Directory Traversal to sibling directories via LogViewEndpoint.view.", "poc": ["https://github.com/davidfortytwo/SpringBootChecker"]}, {"cve": "CVE-2023-41605", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21773", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/170946/Windows-Kernel-Key-Replication-Issues.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/SirCryptic/PoC"]}, {"cve": "CVE-2023-45629", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery \u2013 Image and Video Gallery with Thumbnails plugin <=\u00a02.0.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41800", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in UniConsent UniConsent CMP for GDPR CPRA GPP TCF plugin <=\u00a01.4.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2791", "desc": "When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-26122", "desc": "All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation.\nExploiting this vulnerability might result in remote code execution (\"RCE\").\n**Vulnerable functions:**\n__defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(), valueOf().", "poc": ["https://github.com/hacksparrow/safe-eval/issues/27", "https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373064", "https://github.com/exoad/ProgrammingDisc"]}, {"cve": "CVE-2023-0466", "desc": "The function X509_VERIFY_PARAM_add0_policy() is documented toimplicitly enable the certificate policy check when doing certificateverification. However the implementation of the function does notenable the check which allows certificates with invalid or incorrectpolicies to pass the certificate verification.As suddenly enabling the policy check could break existing deployments it wasdecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()function.Instead the applications that require OpenSSL to perform certificatepolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitlyenable the policy check by calling X509_VERIFY_PARAM_set_flags() withthe X509_V_FLAG_POLICY_CHECK flag argument.Certificate policy checks are disabled by default in OpenSSL and are notcommonly used by applications.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/bluesentinelsec/landing-zone", "https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20766", "desc": "In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07573237; Issue ID: ALPS07573202.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25260", "desc": "Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.", "poc": ["https://cves.at/posts/cve-2023-25260/writeup/", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/trustcves/CVE-2023-25260"]}, {"cve": "CVE-2023-22629", "desc": "An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem.", "poc": ["http://packetstormsecurity.com/files/171737/Titan-FTP-Path-Traversal.html", "https://f20.be/cves/titan-ftp-vulnerabilities", "https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf"]}, {"cve": "CVE-2023-21840", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 5.7.40 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-5981", "desc": "A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.", "poc": ["https://github.com/bartvoet/assignment-ehb-security-review-adamlenez", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-25261", "desc": "Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 2023.1.4 and Stimulsoft Designer (Web) 2023.1.3 and Stimulsoft Viewer (Web) 2023.1.3. Access to the local file system is not prohibited in any way. Therefore, an attacker may include source code which reads or writes local directories and files. It is also possible for the attacker to prepare a report which has a variable that holds the gathered data and render it in the report.", "poc": ["https://cves.at/posts/cve-2023-25261/writeup/", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/trustcves/CVE-2023-25261"]}, {"cve": "CVE-2023-38497", "desc": "Cargo downloads the Rust project\u2019s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.", "poc": ["https://github.com/lucas-cauhe/cargo-perm", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5839", "desc": "Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.", "poc": ["https://huntr.com/bounties/21125f12-64a0-42a3-b218-26b9945a5bc0"]}, {"cve": "CVE-2023-27803", "desc": "H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.", "poc": ["https://hackmd.io/@0dayResearch/EdittriggerList"]}, {"cve": "CVE-2023-29459", "desc": "The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity, which accepts a data: URI. The target of this URI is subsequently loaded into the application's webview, thus allowing the loading of arbitrary content into the context of the application. This can occur via the fcrbs schema or an explicit intent invocation.", "poc": ["http://packetstormsecurity.com/files/172701/FC-Red-Bull-Salzburg-App-5.1.9-R-Improper-Authorization.html", "https://github.com/MrTuxracer/advisories"]}, {"cve": "CVE-2023-5105", "desc": "The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as `wp-config.php`", "poc": ["https://wpscan.com/vulnerability/d40c7108-bad6-4ed3-8539-35c0f57e62cc"]}, {"cve": "CVE-2023-52031", "desc": "TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the UploadFirmwareFile function.", "poc": ["https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R_UploadFirmwareFile/"]}, {"cve": "CVE-2023-37769", "desc": "stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c.", "poc": ["https://github.com/adegoodyer/kubernetes-admin-toolkit", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49003", "desc": "An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity.", "poc": ["https://github.com/actuator/com.simplemobiletools.dialer/blob/main/CWE-928.md", "https://github.com/actuator/com.simplemobiletools.dialer", "https://github.com/actuator/cve", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-24755", "desc": "libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_weighted_pred_8_fallback function at fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.", "poc": ["https://github.com/strukturag/libde265/issues/384"]}, {"cve": "CVE-2023-34356", "desc": "An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1778"]}, {"cve": "CVE-2023-41999", "desc": "An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication.", "poc": ["https://www.tenable.com/security/research/tra-2023-37"]}, {"cve": "CVE-2023-52462", "desc": "In the Linux kernel, the following vulnerability has been resolved:bpf: fix check for attempt to corrupt spilled pointerWhen register is spilled onto a stack as a 1/2/4-byte register, we setslot_type[BPF_REG_SIZE - 1] (plus potentially few more below it,depending on actual spill size). So to check if some stack slot hasspilled register we need to consult slot_type[7], not slot_type[0].To avoid the need to remember and double-check this in the future, justuse is_spilled_reg() helper.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0488", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.", "poc": ["https://huntr.dev/bounties/4311d8d7-682c-4f2a-b92c-3f9f1a36255a", "https://github.com/ARPSyndicate/cvemon", "https://github.com/bAuh0lz/Vulnerabilities"]}, {"cve": "CVE-2023-1037", "desc": "A vulnerability was found in SourceCodester Dental Clinic Appointment Reservation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /APR/login.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221795.", "poc": ["https://github.com/nightcloudos/bug_report/blob/main/vendors/jkev/Dental%20Clinic%20Appointment%20Reservation%20System/SQLi-1.md", "https://vuldb.com/?id.221795"]}, {"cve": "CVE-2023-27422", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NsThemes NS Coupon To Become Customer plugin <=\u00a01.2.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45463", "desc": "Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.", "poc": ["https://github.com/adhikara13/CVE/blob/main/netis_N3/buffer%20overflow%20in%20hostname%20parameter%20leads%20to%20DOS.md", "https://github.com/Luwak-IoT-Security/CVEs"]}, {"cve": "CVE-2023-28871", "desc": "Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic link.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0005/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33789", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.", "poc": ["https://github.com/anhdq201/netbox/issues/7"]}, {"cve": "CVE-2023-41871", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Poll Maker Team Poll Maker plugin <=\u00a04.7.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51609", "desc": "Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of JP2 files.The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21834.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49256", "desc": "It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34151", "desc": "A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546).", "poc": ["https://github.com/ImageMagick/ImageMagick/issues/6341", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51633", "desc": "Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. User interaction is required to exploit this vulnerability.The specific flaw exists within the processing of the sysName OID in SNMP. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-20731.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48796", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.The information exposed to unauthorized actors may include sensitive data such as database credentials.Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file```management:\u00a0 endpoints:\u00a0 \u00a0 web:\u00a0 \u00a0 \u00a0 exposure:\u00a0 \u00a0 \u00a0 \u00a0 include: health,metrics,prometheus```This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2.Users are recommended to upgrade to version 3.0.2, which fixes the issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37860", "desc": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40276", "desc": "An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFile.jsp.", "poc": ["https://github.com/BugBountyHunterCVE/CVE-2023-40276", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-45878", "desc": "GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).", "poc": ["https://herolab.usd.de/security-advisories/usd-2023-0025/"]}, {"cve": "CVE-2023-33669", "desc": "Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c function.", "poc": ["https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N1/README.md", "https://github.com/DDizzzy79/Tenda-CVE/tree/main/AC8V4.0/N1", "https://github.com/DDizzzy79/Tenda-CVE", "https://github.com/retr0reg/Tenda-CVE"]}, {"cve": "CVE-2023-27061", "desc": "Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the wifiFilterListRemark parameter in the modifyWifiFilterRules function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.", "poc": ["https://github.com/didi-zhiyuan/vuln/blob/main/iot/Tenda/W15EV1/formWifiFilterRulesModify.md"]}, {"cve": "CVE-2023-49297", "desc": "PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/iterative/PyDrive2/security/advisories/GHSA-v5f6-hjmf-9mc5"]}, {"cve": "CVE-2023-34026", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BrokenCrust This Day In History plugin <=\u00a03.10.1 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-36011", "desc": "Win32k Elevation of Privilege Vulnerability", "poc": ["https://github.com/myseq/ms_patch_tuesday"]}, {"cve": "CVE-2023-49746", "desc": "Server-Side Request Forgery (SSRF) vulnerability in Softaculous Team SpeedyCache \u2013 Cache, Optimization, Performance.This issue affects SpeedyCache \u2013 Cache, Optimization, Performance: from n/a through 1.1.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1810", "desc": "Heap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-25732", "desc": "When encoding data from an . but some other popular e-mail servers do not. To prevent attack variants (by always disallowing without ), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.", "poc": ["https://github.com/duy-31/CVE-2023-51764", "https://github.com/eeenvik1/CVE-2023-51764", "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/", "https://github.com/Double-q1015/CVE-2023-51764", "https://github.com/d4op/CVE-2023-51764-POC", "https://github.com/duy-31/CVE-2023-51764", "https://github.com/eeenvik1/CVE-2023-51764", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hannob/smtpsmug", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1529", "desc": "Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a malicious HID device. (Chromium security severity: High)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-23477", "desc": "IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. IBM X-Force ID: 245513.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Threekiii/CVE"]}, {"cve": "CVE-2023-48784", "desc": "A\u00a0use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all versions command line interface may allow a local\u00a0privileged attacker with super-admin profile and CLI access\u00a0to execute arbitrary code or commands via specially crafted requests.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4135", "desc": "A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39109", "desc": "rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.", "poc": ["https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_path_a.md", "https://github.com/zer0yu/CVE_Request"]}, {"cve": "CVE-2023-29325", "desc": "Windows OLE Remote Code Execution Vulnerability", "poc": ["https://github.com/a-bazi/test-CVE-2023-29325", "https://github.com/a-bazi/test2-CVE-2023-29325", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6119", "desc": "An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files that usually require a higher privilege level. This is caused by GetSusp not correctly protecting a directory that it creates during execution, allowing an attacker to take over file handles used by GetSusp. As this runs with high privileges, the attacker gains elevated permissions. The file handles are opened as read-only.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10412", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21969", "desc": "Vulnerability in Oracle SQL Developer (component: Installation). Supported versions that are affected are Prior to 23.1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle SQL Developer executes to compromise Oracle SQL Developer. Successful attacks of this vulnerability can result in takeover of Oracle SQL Developer. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html", "https://github.com/George0Papasotiriou/CVE-2023-3163-SQL-Injection-Prevention"]}, {"cve": "CVE-2023-32679", "desc": "Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTemplate() -> _resolveTemplateInternal() -> _resolveTemplate() function, it returns directly without extension verification, so that arbitrary extension files are rendered as twig templates. When attacker with admin privileges on a DEV or an improperly configured STG or PROD environment, they can exploit this vulnerability to remote code execution. Code execution may grant the attacker access to the host operating system. This issue has been addressed in version 4.4.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/craftcms/cms/security/advisories/GHSA-vqxf-r9ph-cc9c"]}, {"cve": "CVE-2023-41708", "desc": "References to the \"app loader\" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/177130/OX-App-Suite-7.10.6-Cross-Site-Scirpting-Denial-Of-Service.html"]}, {"cve": "CVE-2023-0879", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.", "poc": ["https://huntr.dev/bounties/9464e3c6-961d-4e23-8b3d-07cbb31de541"]}, {"cve": "CVE-2023-50357", "desc": "A cross site scripting vulnerability in the AREAL SAS Websrv1 ASP website allows a remote low-privileged attacker to gain escalated privileges of other non-admin users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35809", "desc": "An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected.", "poc": ["http://packetstormsecurity.com/files/174301/SugarCRM-12.2.0-Bean-Manipulation.html"]}, {"cve": "CVE-2023-28142", "desc": "A Race Condition exists in the Qualys Cloud Agent for Windowsplatform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers toescalate privileges limited on the local machine during uninstallation of theQualys Cloud Agent for Windows. Attackers may gain SYSTEM level privileges onthat asset to run arbitrary commands.At the time of this disclosure, versions before 4.0 are classified as Endof Life.", "poc": ["https://www.qualys.com/security-advisories/"]}, {"cve": "CVE-2023-40238", "desc": "A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.", "poc": ["https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40590", "desc": "GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\\\Program Files\\\\Git\\\\cmd\\\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.", "poc": ["https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4", "https://github.com/PBorocz/manage", "https://github.com/PBorocz/raindrop-io-py"]}, {"cve": "CVE-2023-51199", "desc": "** DISPUTED ** Buffer Overflow vulnerability in ROS2 Foxy Fitzroy ROS_VERSION=2 and ROS_PYTHON_VERSION=3 allows attackers to run arbitrary code or cause a denial of service via improper handling of arrays or strings. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/16yashpatel/CVE-2023-51199", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2023-51199"]}, {"cve": "CVE-2023-38651", "desc": "Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is zero.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38560", "desc": "An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.", "poc": ["https://github.com/fullwaywang/QlRules"]}, {"cve": "CVE-2023-34830", "desc": "i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.", "poc": ["https://medium.com/@ray.999/cve-2023-34830-reflected-xss-on-i-doit-open-v24-and-below-ad58036f5407", "https://github.com/leekenghwa/CVE-2023-34830---Reflected-XSS-found-in-I-doit-Open-v24-and-below", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-21824", "desc": "Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Customer, Config, Pricing Manager). Supported versions that are affected are 12.0.0.3.0-12.0.0.7.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-3536", "desc": "A vulnerability was found in SimplePHPscripts Funeral Script PHP 3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233288.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21856", "desc": "Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSetup. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iSetup accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-20880", "desc": "VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'.", "poc": ["https://github.com/thiscodecc/thiscodecc"]}, {"cve": "CVE-2023-37988", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Creative Solutions Contact Form Generator plugin <=\u00a02.5.5 versions.", "poc": ["http://packetstormsecurity.com/files/174896/WordPress-Contact-Form-Generator-2.5.5-Cross-Site-Scripting.html", "https://github.com/codeb0ss/CVE-2023-37988-PoC", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-32875", "desc": "In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308607; Issue ID: ALPS08304217.", "poc": ["https://github.com/Resery/Resery"]}, {"cve": "CVE-2023-7008", "desc": "A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-33829", "desc": "A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field.", "poc": ["http://packetstormsecurity.com/files/172588/SCM-Manager-1.60-Cross-Site-Scripting.html", "https://github.com/n3gox/Stored-XSS-on-SCM-Manager-1.60", "https://github.com/CKevens/CVE-2023-33829-POC", "https://github.com/n3gox/CVE-2023-33829", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/wi1kwegam4a/VulhubExpand"]}, {"cve": "CVE-2023-36755", "desc": "A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The SCEP CA Certificate Name parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.", "poc": ["https://github.com/sudo-jtcsec/CVE"]}, {"cve": "CVE-2023-22006", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html", "https://github.com/motoyasu-saburi/reported_vulnerability"]}, {"cve": "CVE-2023-45672", "desc": "Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at `/config` or through a direct call to `/api/config/save`. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. Input is initially accepted through `http.py`. The user-provided input is then parsed and loaded by `load_config_with_no_duplicates`. However, `load_config_with_no_duplicates` does not sanitize this input by merit of using `yaml.loader.Loader` which can instantiate custom constructors. A provided payload will be executed directly at `frigate/util/builtin.py:110`. This issue may lead to pre-authenticated Remote Code Execution. Version 0.13.0 Beta 3 contains a patch.", "poc": ["https://github.com/blakeblackshear/frigate/security/advisories/GHSA-qp3h-4q62-p428", "https://securitylab.github.com/advisories/GHSL-2023-190_Frigate/"]}, {"cve": "CVE-2023-21223", "desc": "In LPP_ConvertGNSS_DataBitAssistance of LPP_CommonUtil.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-256047000References: N/A", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23161", "desc": "A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the artname parameter under ART TYPE option in the navigation bar.", "poc": ["http://packetstormsecurity.com/files/171642/Art-Gallery-Management-System-Project-1.0-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-21808", "desc": ".NET and Visual Studio Remote Code Execution Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/SohelParashar/.Net-Deserialization-Cheat-Sheet"]}, {"cve": "CVE-2023-21344", "desc": "In Job Scheduler, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44985", "desc": "Auth. (contributo+) Stored Cross-Site Scripting (XSS) vulnerability in Cytech BuddyMeet plugin <=\u00a02.2.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40140", "desc": "In android_view_InputDevice_create of android_view_InputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/hshivhare67/platform_frameworks_base_AOSP6_r22_CVE-2023-40140", "https://github.com/hshivhare67/platform_frameworks_base_android-4.2.2_r1_CVE-2023-40140", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-52758", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5284", "desc": "A vulnerability classified as critical has been found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file upload_save_student.php. The manipulation of the argument uploaded_file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240912.", "poc": ["https://vuldb.com/?id.240912"]}, {"cve": "CVE-2023-31406", "desc": "Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-48432", "desc": "An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for a webmail redirection endpoint) within en email message, e.g., if a victim clicks on that link within Zimbra webmail.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0114", "desc": "A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to cleartext storage in a file or on disk. Local access is required to approach this attack. The identifier of this vulnerability is VDB-217592.", "poc": ["https://vuldb.com/?id.217592"]}, {"cve": "CVE-2023-31554", "desc": "** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-2663. Reason: This record is a reservation duplicate of CVE-2023-2663. Notes: All CVE users should reference CVE-2023-2663 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.", "poc": ["https://forum.xpdfreader.com/viewtopic.php?t=42421"]}, {"cve": "CVE-2023-26144", "desc": "Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.\n**Note:** It was not proven that this vulnerability can crash the process.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tadhglewis/tadhglewis"]}, {"cve": "CVE-2023-43868", "desc": "D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via websGetVar function.", "poc": ["https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md"]}, {"cve": "CVE-2023-23570", "desc": "Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. This issue affects: Gallagher Command Centre 8.90 prior to vEL8.90.1620 (MR2), all versions of 8.80 and prior.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50898", "desc": "Missing Authorization vulnerability in sirv.Com Sirv.This issue affects Sirv: from n/a through 7.1.2.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21337", "desc": "In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0739", "desc": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1.0.4.", "poc": ["https://huntr.dev/bounties/93d7fac9-50be-4624-9096-45b89fbfd4ae"]}, {"cve": "CVE-2023-43893", "desc": "Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnerability is exploited via a crafted payload.", "poc": ["https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20wake%20on%20lan%20functionality%20in%20wakeup_mac%20parameter.md", "https://github.com/Luwak-IoT-Security/CVEs", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2113", "desc": "The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.", "poc": ["https://wpscan.com/vulnerability/ddb4c95d-bbee-4095-aed6-25f6b8e63011"]}, {"cve": "CVE-2023-5236", "desc": "A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21873", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-6918", "desc": "A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3319", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iDisplay PlatPlay DS allows Stored XSS.This issue affects PlatPlay DS: before 3.14.", "poc": ["https://github.com/ccelikanil/ccelikanil"]}, {"cve": "CVE-2023-31530", "desc": "Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the smartqos_priority_devices parameter.", "poc": ["https://github.com/leetsun/IoT/tree/main/Motorola-CX2L/CI4"]}, {"cve": "CVE-2023-21973", "desc": "Vulnerability in the Oracle iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iProcurement. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iProcurement, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iProcurement accessible data as well as unauthorized read access to a subset of Oracle iProcurement accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-25719", "desc": "ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executable can be used to execute malicious queries or as a denial-of-service vector. NOTE: this CVE Record is only about the parameters, such as the h parameter (this CVE Record is not about the separate issue of signed executable files that are supposed to have unique configurations across customers' installations).", "poc": ["https://cybir.com/2022/cve/hijacking-connectwise-control-and-ddos/", "https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity"]}, {"cve": "CVE-2023-0379", "desc": "The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/14b4f0c5-c7b1-4ac4-8c9c-f8c35ca5de4a"]}, {"cve": "CVE-2023-49070", "desc": "Pre-auth RCE in Apache Ofbiz 18.12.09.It's due to XML-RPC\u00a0no longer maintained\u00a0still present.This issue affects Apache OFBiz: before 18.12.10.\u00a0Users are recommended to upgrade to version 18.12.10", "poc": ["http://packetstormsecurity.com/files/176323/Apache-OFBiz-18.12.09-Remote-Code-Execution.html", "https://github.com/0xrobiul/CVE-2023-49070", "https://github.com/0xsyr0/OSCP", "https://github.com/Chocapikk/CVE-2023-51467", "https://github.com/D0g3-8Bit/OFBiz-Attack", "https://github.com/Jake123otte1/BadBizness-CVE-2023-51467", "https://github.com/Marco-zcl/POC", "https://github.com/Ostorlab/KEV", "https://github.com/Praison001/Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467", "https://github.com/Rishi-45/Bizness-Machine-htb", "https://github.com/SrcVme50/Bizness", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/CVE", "https://github.com/Threekiii/Vulhub-Reproduce", "https://github.com/UserConnecting/Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBiz", "https://github.com/Y4tacker/JavaSec", "https://github.com/abdoghazy2015/ofbiz-CVE-2023-49070-RCE-POC", "https://github.com/bakery312/Vulhub-Reproduce", "https://github.com/bruce120/Apache-OFBiz-Authentication-Bypass", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/jakabakos/Apache-OFBiz-Authentication-Bypass", "https://github.com/mintoolkit/mint", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/slimtoolkit/slim", "https://github.com/tanjiti/sec_profile", "https://github.com/txuswashere/OSCP", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-", "https://github.com/yukselberkay/CVE-2023-49070_CVE-2023-51467"]}, {"cve": "CVE-2023-29586", "desc": "Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. This leads to Arbitrary File Read by allowing any user to copy any directory in the system to a directory they control.", "poc": ["https://packetstormsecurity.com/files/143984/TeraCopyService-3.1-Unquoted-Service-Path-Privilege-Escalation.html"]}, {"cve": "CVE-2023-31272", "desc": "A stack-based buffer overflow vulnerability exists in the httpd do_wds functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to stack-based buffer overflow. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1765"]}, {"cve": "CVE-2023-26820", "desc": "siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js.", "poc": ["https://github.com/netptop/siteproxy/issues/67"]}, {"cve": "CVE-2023-51022", "desc": "TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the \u2018langFlag\u2019 parameter of the setLanguageCfg interface of the cstecgi .cgi.", "poc": ["https://815yang.github.io/2023/12/11/EX1800T/2/3/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setLanguageCfg-langFlag/"]}, {"cve": "CVE-2023-31919", "desc": "Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext_raise_exception at jerry-core/jcontext/jcontext.c.", "poc": ["https://github.com/jerryscript-project/jerryscript/issues/5069", "https://github.com/EJueon/EJueon"]}, {"cve": "CVE-2023-40752", "desc": "There is a Cross Site Scripting (XSS) vulnerability in the \"action\" parameter of index.php in PHPJabbers Make an Offer Widget v1.0.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23915", "desc": "A cleartext transmission of sensitive information vulnerability exists in curl leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/t34t/CVE"]}, {"cve": "CVE-2023-3704", "desc": "The vulnerability exists in CP-Plus DVR due to an improper input validation within the web-based management interface of the affected products. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.Successful exploitation of this vulnerability could allow the remote attacker to change system time of the targeted device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29842", "desc": "ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.", "poc": ["http://packetstormsecurity.com/files/175105/ChurchCRM-4.5.4-SQL-Injection.html", "https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/CVE-2023-29842.md", "https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/CVE-2023-29842.py"]}, {"cve": "CVE-2023-1190", "desc": "A vulnerability was found in xiaozhuai imageinfo up to 3.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file imageinfo.hpp. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. VDB-222362 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/10cksYiqiyinHangzhouTechnology/imageinfo_poc", "https://github.com/xiaozhuai/imageinfo/issues/1", "https://github.com/10cks/10cks", "https://github.com/10cksYiqiyinHangzhouTechnology/10cksYiqiyinHangzhouTechnology", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-5978", "desc": "In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constraints are strictly subsets of the active constraints. \u00a0When only a list\u00a0of resolvable domain names was specified without setting any other limitations, an application could submit a new list of domains including include entries not previously listed. \u00a0This could permit the application to resolve domain names that were previously restricted.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4453", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.", "poc": ["https://huntr.dev/bounties/245a8785-0fc0-4561-b181-fa20f869d993"]}, {"cve": "CVE-2023-42445", "desc": "Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24398", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Snap Creek Software EZP Coming Soon Page plugin <= 1.0.7.3 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/yaudahbanh/CVE-Archive"]}, {"cve": "CVE-2023-27645", "desc": "An issue found in POWERAMP audioplayer build 925 bundle play and build 954 allows a remote attacker to gain privileges via the reverb and EQ preset parameters.", "poc": ["https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27645/CVE%20detail.md"]}, {"cve": "CVE-2023-24480", "desc": "Controller DoS due to stack overflow when decoding a message from the server.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24045", "desc": "In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request.", "poc": ["https://dataiku.com", "https://gist.github.com/alert3/04e2d0a934001180104f846cfa00552b"]}, {"cve": "CVE-2023-4703", "desc": "The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation.", "poc": ["https://wpscan.com/vulnerability/83278bbb-90e6-4465-a46d-60b4c703c11a/"]}, {"cve": "CVE-2023-21716", "desc": "Microsoft Word Remote Code Execution Vulnerability", "poc": ["https://github.com/0day404/vulnerability-poc", "https://github.com/0xsyr0/OSCP", "https://github.com/ARPSyndicate/cvemon", "https://github.com/CKevens/CVE-2023-21716-POC", "https://github.com/CVEDB/PoC-List", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/DevAkabari/CVE-2024-21413", "https://github.com/FeatherStark/CVE-2023-21716", "https://github.com/JMousqueton/CVE-2023-21716", "https://github.com/KayCHENvip/vulnerability-poc", "https://github.com/MojithaR/CVE-2023-21716-EXPLOIT.py", "https://github.com/SirElmard/ethical_hacking", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/CVE", "https://github.com/Xnuvers007/CVE-2023-21716", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/dshabani96/CVE-2024-21413", "https://github.com/duy-31/CVE-2024-21413", "https://github.com/gyaansastra/CVE-2023-21716", "https://github.com/hktalent/TOP", "https://github.com/hv0l/CVE-2023-21716_exploit", "https://github.com/izj007/wechat", "https://github.com/jake-44/Research", "https://github.com/karimhabush/cyberowl", "https://github.com/kgwanjala/oscp-cheatsheet", "https://github.com/labesterOct/CVE-2024-21413", "https://github.com/maldev866/WordExp_CVE_2023_21716", "https://github.com/mikesxrs/CVE-2023-21716_YARA_Results", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/oscpname/OSCP_cheat", "https://github.com/r00tb1t/CVE-2024-21413-POC", "https://github.com/revanmalang/OSCP", "https://github.com/tib36/PhishingBook", "https://github.com/whoami13apt/files2", "https://github.com/xhref/OSCP"]}, {"cve": "CVE-2023-31853", "desc": "Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parameter.", "poc": ["https://github.com/CalfCrusher/CVE-2023-31853", "https://github.com/CalfCrusher/CVE-2023-31853", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-32409", "desc": "The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-49923", "desc": "An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by changing the log level at which these are logged to DEBUG, which is disabled by default.", "poc": ["https://www.elastic.co/community/security"]}, {"cve": "CVE-2023-32205", "desc": "In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1753339", "https://bugzilla.mozilla.org/show_bug.cgi?id=1753341"]}, {"cve": "CVE-2023-4799", "desc": "The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/04c71873-5ae7-4f94-8ba9-03e03ff55180"]}, {"cve": "CVE-2023-30226", "desc": "An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to cause a denial of service via crafted elf file.", "poc": ["https://github.com/ifyGecko/CVE-2023-30226", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26919", "desc": "delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process.", "poc": ["https://github.com/javadelight/delight-nashorn-sandbox/issues/135"]}, {"cve": "CVE-2023-44000", "desc": "An issue in Otakara lapis totuka mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43767", "desc": "Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26078", "desc": "Privilege escalation vulnerability was discovered in Atera Agent 1.8.4.4 and prior on Windows due to mishandling of privileged APIs.", "poc": ["https://github.com/vulerols/msiner"]}, {"cve": "CVE-2023-40933", "desc": "A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-33637", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/r1azLeWz3"]}, {"cve": "CVE-2023-4655", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.", "poc": ["https://huntr.dev/bounties/e2189ad5-b665-4ba5-b6c4-112e58ae9a97"]}, {"cve": "CVE-2023-32401", "desc": "A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur 11.7.7, macOS Ventura 13.4. Parsing an office document may lead to an unexpected app termination or arbitrary code execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43336", "desc": "Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.", "poc": ["https://medium.com/@janirudransh/security-disclosure-of-vulnerability-cve-2023-23336-4429d416f826", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5190", "desc": "Open redirect vulnerability in the Countries Management\u2019s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6895", "desc": "A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/FuBoLuSec/CVE-2023-6895", "https://github.com/Marco-zcl/POC", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/nles-crt/CVE-2023-6895", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-"]}, {"cve": "CVE-2023-39007", "desc": "/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.", "poc": ["https://logicaltrust.net/blog/2023/08/opnsense.html"]}, {"cve": "CVE-2023-50009", "desc": "Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component.", "poc": ["https://ffmpeg.org/", "https://trac.ffmpeg.org/ticket/10699"]}, {"cve": "CVE-2023-0818", "desc": "Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.", "poc": ["https://huntr.dev/bounties/038e7472-f3e9-46c2-9aea-d6dafb62a18a"]}, {"cve": "CVE-2023-40547", "desc": "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2602", "desc": "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.", "poc": ["https://github.com/kholia/chisel-examples"]}, {"cve": "CVE-2023-6985", "desc": "The 10Web AI Assistant \u2013 AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.", "poc": ["https://github.com/RandomRobbieBF/CVE-2023-6985", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1349", "desc": "A vulnerability, which was classified as problematic, has been found in Hsycms 3.1. Affected by this issue is some unknown functionality of the file controller\\cate.php of the component Add Category Module. The manipulation of the argument title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-222842 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.222842"]}, {"cve": "CVE-2023-30082", "desc": "A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory.", "poc": ["https://blog.manavparekh.com/2023/06/cve-2023-30082.html", "https://github.com/manavparekh/CVEs/blob/main/CVE-2023-30082/Steps%20to%20reproduce.txt"]}, {"cve": "CVE-2023-20634", "desc": "In widevine, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07635697; Issue ID: ALPS07635697.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Resery/Resery"]}, {"cve": "CVE-2023-6238", "desc": "A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memory corruption.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34797", "desc": "Broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 allows attackers to access sensitive information.", "poc": ["https://github.com/WhiteBearVN/CWX-Registration-Broken-Access-Control"]}, {"cve": "CVE-2023-4434", "desc": "Missing Authorization in GitHub repository hamza417/inure prior to build88.", "poc": ["https://huntr.dev/bounties/19e68377-e071-4a8e-aa4c-cd84a426602e", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0630", "desc": "The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.", "poc": ["https://wpscan.com/vulnerability/b82bdd02-b699-4527-86cc-d60b56ab0c55", "https://github.com/RandomRobbieBF/CVE-2023-0630", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26033", "desc": "Gentoo soko is the code that powers packages.gentoo.org. Versions prior to 1.0.1 are vulnerable to SQL Injection, leading to a Denial of Service. If the user selects (in user preferences) the \"Recently Visited Packages\" view for the index page, the value of the `search_history` cookie is used as a base64 encoded comma separated list of atoms. These are string loaded directly into the SQL query with `atom = '%s'` format string. As a result, any user can modify the browser's cookie value and inject most SQL queries. A proof of concept malformed cookie was generated that wiped the database or changed it's content. On the database, only public data is stored, so there is no confidentiality issues to site users. If it is known that the database was modified, a full restoration of data is possible by performing a full database wipe and performing full update of all components. This issue is patched with commit id 5ae9ca83b73. Version 1.0.1 contains the patch. If users are unable to upgrade immediately, the following workarounds may be applied: (1.) Use a proxy to always drop the `search_history` cookie until upgraded. The impact on user experience is low. (2.) Sanitize to the value of `search_history` cookie after base64 decoding it.", "poc": ["https://github.com/gentoo/soko/security/advisories/GHSA-gp8g-jfq9-5q2g"]}, {"cve": "CVE-2023-27796", "desc": "RG-EW1200G PRO Wireless Routers EW_3.0(1)B11P204, RG-EW1800GX PRO Wireless Routers EW_3.0(1)B11P204, and RG-EW3200GX PRO Wireless Routers EW_3.0(1)B11P204 were discovered to contain multiple command injection vulnerabilities via the data.ip, data.protocal, data.iface and data.package parameters in the runPackDiagnose function of diagnose.lua.", "poc": ["https://github.com/winmt/my-vuls/tree/main/RG-EW%20PRO%20Series"]}, {"cve": "CVE-2023-28017", "desc": "HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks.", "poc": ["https://github.com/JoshuaMart/JoshuaMart", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41748", "desc": "Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-0787", "desc": "Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.", "poc": ["https://huntr.dev/bounties/87397c71-7b84-4617-a66e-fa6c73be9024", "https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-43867", "desc": "D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanL2TP function.", "poc": ["https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md"]}, {"cve": "CVE-2023-2030", "desc": "An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-21944", "desc": "Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-46304", "desc": "modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/jselliott/CVE-2023-46304", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30564", "desc": "Alaris Systems Manager does not perform input validation during the Device Import Function.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50364", "desc": "A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.6.2722 build 20240402 and laterQuTS hero h5.1.6.2734 build 20240414 and later", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28343", "desc": "OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.", "poc": ["http://packetstormsecurity.com/files/171775/Altenergy-Power-Control-Software-C1.2.5-Command-Injection.html", "https://github.com/ahmedalroky/Disclosures/blob/main/apesystems/os_command_injection.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/gobysec/CVE-2023-28343", "https://github.com/hba343434/CVE-2023-28343", "https://github.com/karimhabush/cyberowl", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/superzerosec/CVE-2023-28343", "https://github.com/superzerosec/poc-exploit-index"]}, {"cve": "CVE-2023-25181", "desc": "A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted set of network packets can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1726"]}, {"cve": "CVE-2023-47511", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SO WP Pinyin Slugs plugin <=\u00a02.3.0 versions.", "poc": ["https://github.com/senlin/pinyin-slugs"]}, {"cve": "CVE-2023-48078", "desc": "SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter.", "poc": ["https://github.com/esasadam06/Simple-CRUD-Functionality-SQLi-POC", "https://github.com/esasadam06/Simple-CRUD-Functionality-SQLi-POC"]}, {"cve": "CVE-2023-30861", "desc": "Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.2. The application sets `session.permanent = True`3. The application does not access or modify the session at any point during a request.4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.", "poc": ["https://github.com/HotDB-Community/HotDB-Engine", "https://github.com/JawadPy/CVE-2023-30861-Exploit", "https://github.com/SenhorDosSonhos1/projeto-voluntario-lacrei", "https://github.com/crumpman/pulsecheck", "https://github.com/elifesciences/github-repo-security-alerts", "https://github.com/mansi1811-s/samp", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/saxetr/dependabot_vulnerabilities_check"]}, {"cve": "CVE-2023-23305", "desc": "The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources. A malicious application embedding specially crafted resources could hijack the execution of the device's firmware.", "poc": ["https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23305.md"]}, {"cve": "CVE-2023-37647", "desc": "SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26998", "desc": "Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Alert Configuration page.", "poc": ["https://piotrryciak.com/posts/netscout-multiple-vulnerabilities/"]}, {"cve": "CVE-2023-36377", "desc": "Buffer Overflow vulnerability in mtrojnar osslsigncode v.2.3 and before allows a local attacker to execute arbitrary code via a crafted .exe, .sys, and .dll files.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50424", "desc": "SAP\u00a0BTP\u00a0Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.", "poc": ["https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4476", "desc": "The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/3ca22b22-fe89-42be-94ec-b164838bcf50"]}, {"cve": "CVE-2023-3222", "desc": "Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user\u00b4s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7227", "desc": "SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior are vulnerable to a command injection vulnerability in the dynamic domain name system (DDNS) settings that could allow an attacker to execute arbitrary commands with root privileges.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-02"]}, {"cve": "CVE-2023-44811", "desc": "Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function.", "poc": ["https://github.com/ahrixia/CVE-2023-44811", "https://github.com/ahrixia/CVE-2023-44811", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0080", "desc": "The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.", "poc": ["https://wpscan.com/vulnerability/6b0d63ed-e244-4f20-8f10-a6e0c7ccadd4"]}, {"cve": "CVE-2023-26369", "desc": "Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Threekiii/CVE", "https://github.com/jonaslejon/malicious-pdf"]}, {"cve": "CVE-2023-50028", "desc": "In the module \"Sliding cart block\" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a guest can perform SQL injection.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1355", "desc": "NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.", "poc": ["https://huntr.dev/bounties/4d0a9615-d438-4f5c-8dd6-aa22f4b716d9"]}, {"cve": "CVE-2023-50096", "desc": "STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeA_ReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications (1.2.0), and thus can affect user-written code that was derived from a published sample application.", "poc": ["https://github.com/elttam/publications/blob/master/writeups/CVE-2023-50096.md", "https://github.com/elttam/publications", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33781", "desc": "An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file.", "poc": ["https://github.com/s0tr/CVE-2023-33781", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/s0tr/CVE-2023-33781"]}, {"cve": "CVE-2023-7089", "desc": "The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.", "poc": ["https://wpscan.com/vulnerability/3b8ba734-7764-4ab6-a7e2-8de55bd46bed/"]}, {"cve": "CVE-2023-34133", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.", "poc": ["http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html"]}, {"cve": "CVE-2023-25193", "desc": "hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.", "poc": ["https://github.com/adegoodyer/kubernetes-admin-toolkit"]}, {"cve": "CVE-2023-42308", "desc": "Cross Site Scripting (XSS) vulnerability in Manage Fastrack Subjects in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via the \"Subject Name\" and \"Subject Code\" Section.", "poc": ["https://github.com/ASR511-OO7/CVE-2023-42308", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-36239", "desc": "libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c.", "poc": ["https://github.com/libming/libming/issues/273"]}, {"cve": "CVE-2023-36213", "desc": "SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function.", "poc": ["https://packetstormsecurity.com/files/172698/MotoCMS-3.4.3-SQL-Injection.html", "https://www.exploit-db.com/exploits/51504", "https://github.com/capture0x/My-CVE"]}, {"cve": "CVE-2023-5343", "desc": "The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.", "poc": ["https://wpscan.com/vulnerability/74613b38-48f2-43d5-bae5-25c89ba7db6e"]}, {"cve": "CVE-2023-27524", "desc": "Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.Add a strong SECRET_KEY to your `superset_config.py` file like:SECRET_KEY = Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.", "poc": ["http://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html", "http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html", "https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html", "https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html", "https://github.com/0day404/vulnerability-poc", "https://github.com/20142995/sectool", "https://github.com/Awrrays/FrameVul", "https://github.com/CN016/Apache-Superset-SECRET_KEY-CVE-2023-27524-", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/KayCHENvip/vulnerability-poc", "https://github.com/MaanVader/CVE-2023-27524-POC", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/NguyenCongHaiNam/Research-CVE-2023-27524", "https://github.com/Okaytc/Superset_auth_bypass_check", "https://github.com/Ostorlab/KEV", "https://github.com/Pari-Malam/CVE-2023-27524", "https://github.com/TardC/CVE-2023-27524", "https://github.com/ThatNotEasy/CVE-2023-27524", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/CVE", "https://github.com/XRSec/AWVS-Update", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/aleksey-vi/offzone_2023", "https://github.com/aleksey-vi/presentation-report", "https://github.com/antx-code/CVE-2023-27524", "https://github.com/d-rn/vulBox", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/gobysec/Research", "https://github.com/hktalent/TOP", "https://github.com/horizon3ai/CVE-2023-27524", "https://github.com/jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/machevalia/ButProxied", "https://github.com/necroteddy/CVE-2023-27524", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/nvn1729/advisories", "https://github.com/summerainX/vul_poc", "https://github.com/todb-cisa/kev-cwes", "https://github.com/togacoder/superset_study"]}, {"cve": "CVE-2023-27535", "desc": "An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.", "poc": ["https://github.com/1g-v/DevSec_Docker_lab", "https://github.com/L-ivan7/-.-DevSec_Docker", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-47445", "desc": "Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page.", "poc": ["https://github.com/termanix/PHPGrukul-Pre-School-Enrollment-System-v1.0/blob/main/CVE-2023-47445%20PHPGurukul-Pre-School-Enrollment-System-v1.0%20SQL%20Injection.md", "https://github.com/termanix/PHPGrukul-Pre-School-Enrollment-System-v1.0"]}, {"cve": "CVE-2023-44266", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jewel Theme WP Adminify plugin <=\u00a03.1.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31616", "desc": "An issue in the bif_mod component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1122"]}, {"cve": "CVE-2023-1985", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. This issue affects the function save_brand of the file /classes/Master.php?f=save_brand. The manipulation of the argument name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225533 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.225533"]}, {"cve": "CVE-2023-39810", "desc": "An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.", "poc": ["https://www.pentagrid.ch/en/blog/busybox-cpio-directory-traversal-vulnerability/"]}, {"cve": "CVE-2023-28438", "desc": "Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-5260", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Simple Membership System 1.0. This issue affects some unknown processing of the file group_validator.php. The manipulation of the argument club_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240869 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1170", "desc": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.", "poc": ["https://huntr.dev/bounties/286e0090-e654-46d2-ac60-29f81799d0a4"]}, {"cve": "CVE-2023-1032", "desc": "The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.", "poc": ["https://ubuntu.com/security/notices/USN-6024-1", "https://ubuntu.com/security/notices/USN-6033-1", "https://github.com/ARPSyndicate/cvemon", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4090", "desc": "Cross-site Scripting (XSS) reflected vulnerability on WideStand until 5.3.5 version, which generates one of the meta tags directly using the content of the queried URL, which would allow an attacker to inject HTML/Javascript code into the response.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35744", "desc": "D-Link DAP-2622 DDP Configuration Restore Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20071.", "poc": ["https://github.com/ADSSA-IT/CVE-2023-35744", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-44227", "desc": "Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9.", "poc": ["https://github.com/codeb0ss/CVE-2023-44227-PoC"]}, {"cve": "CVE-2023-27746", "desc": "BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is intercepted.", "poc": ["https://github.com/eyJhb/blackvue-cve-2023", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-37404", "desc": "IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS poisoning attack. IBM X-Force ID: 259789.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0634", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/PajakAlexandre/wik-dps-tp02"]}, {"cve": "CVE-2023-29914", "desc": "H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/H1Cn2sAk3"]}, {"cve": "CVE-2023-37857", "desc": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37758", "desc": "D-LINK DIR-815 v1.01 was discovered to contain a buffer overflow via the component /web/captcha.cgi.", "poc": ["https://hackmd.io/@pSgS7xsnS5a4K7Y0yiB43g/rJr8oNn_n"]}, {"cve": "CVE-2023-39211", "desc": "Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52146", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.33.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37250", "desc": "Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in \"Per User\" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs. This affects Parsec Loader versions through 8. Parsec Loader 9 is a fixed version.", "poc": ["https://github.com/ewilded/CVE-2023-37250", "https://github.com/ewilded/CVE-2023-37250-POC", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-33885", "desc": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6625", "desc": "The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/d483f7ce-cb3f-4fcb-b060-005cec0ea10f/"]}, {"cve": "CVE-2023-45639", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Codex-m Sort SearchResult By Title plugin <=\u00a010.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6139", "desc": "The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.", "poc": ["https://wpscan.com/vulnerability/96396a22-f523-4c51-8b72-52be266988aa"]}, {"cve": "CVE-2023-49912", "desc": "A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `profile` parameter at offset `0x4224b0` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45661", "desc": "stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3028", "desc": "Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too.Multiple vulnerabilities were identified:- The MQTT backend does not require authentication, allowing unauthorized connections from an attacker.- The vehicles publish their telemetry data (e.g. GPS Location, speed, odometer, fuel, etc) as messages in public topics. The backend also sends commands to the vehicles as MQTT posts in public topics. As a result, an attacker can access the confidential data of the entire fleet that is managed by the backend.- The MQTT messages sent by the vehicles or the backend are not encrypted or authenticated. An attacker can create and post messages to impersonate a vehicle or the backend. The attacker could then, for example, send incorrect information to the backend about the vehicle's location.- The backend can inject data into a vehicle\u00b4s CAN bus by sending a specific MQTT message on a public topic. Because these messages are not authenticated or encrypted, an attacker could impersonate the backend, create a fake message and inject CAN data in any vehicle managed by the backend.The confirmed version is\u00a0201808021036, however further versions have been also identified as potentially impacted.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/V33RU/IoTSecurity101", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-31935", "desc": "Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the emial parameter of admin-profile.php.", "poc": ["https://github.com/DiliLearngent/BugReport"]}, {"cve": "CVE-2023-3580", "desc": "Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.", "poc": ["https://huntr.dev/bounties/4eed53ca-06c2-43aa-aea8-c03ea5f13ce4"]}, {"cve": "CVE-2023-46385", "desc": "LOYTEC electronics GmbH LINX Configurator 7.4.10 is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration.", "poc": ["https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html"]}, {"cve": "CVE-2023-45955", "desc": "An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32378", "desc": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41257", "desc": "A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1838"]}, {"cve": "CVE-2023-46445", "desc": "An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a \"Rogue Extension Negotiation.\"", "poc": ["http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html", "https://github.com/advisories/GHSA-cfc2-wr2v-gxm5", "https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst", "https://github.com/ronf/asyncssh/security/advisories/GHSA-cfc2-wr2v-gxm5", "https://github.com/RUB-NDS/Terrapin-Artifacts"]}, {"cve": "CVE-2023-27903", "desc": "Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-5762", "desc": "The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges.", "poc": ["https://wpscan.com/vulnerability/6ad99725-eccc-4b61-bce2-668b62619deb"]}, {"cve": "CVE-2023-2326", "desc": "The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/f922695a-b803-4edf-aadc-80c79d99bebb"]}, {"cve": "CVE-2023-31476", "desc": "An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working directory is /www).", "poc": ["https://github.com/gl-inet/CVE-issues/blob/main/3.215/GL-MV1000_Arbitrary_File_Creation.md"]}, {"cve": "CVE-2023-52387", "desc": "Resource reuse vulnerability in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29808", "desc": "Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code.", "poc": ["https://packetstormsecurity.com/files/172145/Companymaps-8.0-Cross-Site-Scripting.html", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zPrototype/CVE-2023-29808"]}, {"cve": "CVE-2023-39600", "desc": "IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.", "poc": ["https://icewarp.com"]}, {"cve": "CVE-2023-52028", "desc": "TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setTracerouteCfg function.", "poc": ["https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R_setTracerouteCfg/"]}, {"cve": "CVE-2023-1745", "desc": "A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73. This issue affects some unknown processing in the library SHFOLDER.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224633 was assigned to this vulnerability.", "poc": ["https://github.com/10cksYiqiyinHangzhouTechnology/KMPlayer_Poc", "https://youtu.be/7bh2BQOqxFo", "https://github.com/10cks/10cks", "https://github.com/10cksYiqiyinHangzhouTechnology/10cksYiqiyinHangzhouTechnology", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-43340", "desc": "Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters", "poc": ["https://github.com/sromanhu/-CVE-2023-43340-Evolution-Reflected-XSS---Installation-Admin-Options", "https://github.com/sromanhu/Evolution-Reflected-XSS---Installation-Admin-Options", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/-CVE-2023-43340-Evolution-Reflected-XSS---Installation-Admin-Options"]}, {"cve": "CVE-2023-5899", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.", "poc": ["https://huntr.com/bounties/0c7f1981-3bba-4508-a07e-4cb9a2553216"]}, {"cve": "CVE-2023-6799", "desc": "The WP Reset \u2013 Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 via the use of insufficiently random snapshot names. This makes it possible for unauthenticated attackers to extract sensitive data including site backups by brute-forcing the snapshot filenames. Please note that the vendor does not plan to do any further hardening on this functionality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37386", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <=\u00a01.2.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6982", "desc": "The Display custom fields in the frontend \u2013 Post and User Profile Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and postmeta in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2259", "desc": "Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.", "poc": ["https://huntr.dev/bounties/e753bce0-ce82-463b-b344-2f67b39b60ff"]}, {"cve": "CVE-2023-32407", "desc": "A logic issue was addressed with improved state management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to bypass Privacy preferences.", "poc": ["https://github.com/gergelykalman/CVE-2023-32407-a-macOS-TCC-bypass-in-Metal", "https://github.com/houjingyi233/macOS-iOS-system-security", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-23900", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in YIKES, Inc. Easy Forms for Mailchimp plugin <=\u00a06.8.8 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31626", "desc": "An issue in the gpf_notice component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1129"]}, {"cve": "CVE-2023-0841", "desc": "A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded. This issue affects the function mp3_dmx_process of the file filters/reframe_mp3.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221087.", "poc": ["https://github.com/qianshuidewajueji/poc/blob/main/gpac/mp3_dmx_process_poc3"]}, {"cve": "CVE-2023-23162", "desc": "Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at product.php.", "poc": ["http://packetstormsecurity.com/files/171643/Art-Gallery-Management-System-Project-1.0-SQL-Injection.html"]}, {"cve": "CVE-2023-38029", "desc": "Saho\u2019s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24114", "desc": "typecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php.", "poc": ["https://github.com/typecho/typecho/issues/1523", "https://github.com/youyou-pm10/MyCVEs"]}, {"cve": "CVE-2023-24671", "desc": "VX Search v13.8 and v14.7 was discovered to contain an unquoted service path vulnerability which allows attackers to execute arbitrary commands at elevated privileges via a crafted executable file.", "poc": ["https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae", "https://packetstormsecurity.com/files/171300/VX-Search-13.8-Unquoted-Service-Path.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-37242", "desc": "Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerability to rewrite the non-volatile random-access memory (NVRAM), or facilitate the exploitation of other vulnerabilities.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33518", "desc": "emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request.", "poc": ["https://github.com/emoncms/emoncms/issues/1856"]}, {"cve": "CVE-2023-48949", "desc": "An issue in the box_add function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1173"]}, {"cve": "CVE-2023-33107", "desc": "Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-38060", "desc": "Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment.\u00a0This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1049", "desc": "A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists thatcould cause execution of malicious code when an unsuspicious user loads a project file from thelocal filesystem into the HMI.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4586", "desc": "A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.", "poc": ["https://github.com/Keymaster65/copper2go", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/jwulf/release-note-poc-mvp"]}, {"cve": "CVE-2023-30799", "desc": "MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary code on the system.", "poc": ["https://github.com/MarginResearch/FOISted", "https://github.com/Untrust3dX/cve_2023_30799"]}, {"cve": "CVE-2023-21879", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-22467", "desc": "Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-34198", "desc": "In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot results in the usage of an object of the :any\" type, which may have unexpected results for access control.", "poc": ["https://advisories.stormshield.eu/2023-019"]}, {"cve": "CVE-2023-38814", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not in the allowed scope of that CNA's CVE ID assignments. Notes: none.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-42653", "desc": "In faceid service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31609", "desc": "An issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1126", "https://github.com/Sedar2024/Sedar"]}, {"cve": "CVE-2023-33241", "desc": "Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signatures or more fully exfiltrate the other parties' private key shares.", "poc": ["https://github.com/fireblocks-labs/safeheron-gg20-exploit-poc", "https://www.fireblocks.com/blog/gg18-and-gg20-paillier-key-vulnerability-technical-report/", "https://github.com/BitizenWallet/tech-share", "https://github.com/getamis/alice"]}, {"cve": "CVE-2023-43222", "desc": "SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file.", "poc": ["https://blog.csdn.net/weixin_51394168/article/details/132817842"]}, {"cve": "CVE-2023-50344", "desc": "HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26469", "desc": "In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.", "poc": ["http://packetstormsecurity.com/files/174248/Jorani-Remote-Code-Execution.html", "https://github.com/Orange-Cyberdefense/CVE-repository/tree/master", "https://github.com/Orange-Cyberdefense/CVE-repository", "https://github.com/d0rb/CVE-2023-26469", "https://github.com/getdrive/PoC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-6222", "desc": "IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks", "poc": ["https://drive.google.com/file/d/1krgHH2NvVFr93VpErLkOjDV3L6M5yIA1/view?usp=sharing", "https://wpscan.com/vulnerability/df892e99-c0f6-42b8-a834-fc55d1bde130"]}, {"cve": "CVE-2023-37994", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Artem Abramovich Art Decoration Shortcode plugin <=\u00a01.5.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27102", "desc": "Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctx.cc.", "poc": ["https://github.com/strukturag/libde265/issues/393"]}, {"cve": "CVE-2023-26767", "desc": "Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the lou_logFile function at logginc.c endpoint.", "poc": ["https://github.com/liblouis/liblouis/issues/1292", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Marsman1996/pocs"]}, {"cve": "CVE-2023-34045", "desc": "VMware Fusion(13.x prior to 13.5)\u00a0contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade.\u00a0A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.", "poc": ["https://www.vmware.com/security/advisories/VMSA-2023-0022.html"]}, {"cve": "CVE-2023-39114", "desc": "ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerability is triggered when running the program SDLaffgif.", "poc": ["https://github.com/miniupnp/ngiflib/issues/29"]}, {"cve": "CVE-2023-32493", "desc": "Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. An unprivileged, remote attacker could potentially exploit this vulnerability, leading to denial of service, information disclosure and remote execution.", "poc": ["https://www.dell.com/support/kbdoc/en-us/000216717/dsa-2023-269-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"]}, {"cve": "CVE-2023-22365", "desc": "An OS command injection vulnerability exists in the ys_thirdparty check_system_user functionality of Milesight UR32L v32.3.0.5. A specially crafted set of network packets can lead to command execution. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1711"]}, {"cve": "CVE-2023-36262", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2023-48903", "desc": "Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary web script or HTML within parameter \"imgType\" via in uploadCarImages.php.", "poc": ["https://packetstormsecurity.com/files/177662/Tramyardg-Autoexpress-1.3.0-Cross-Site-Scripting.html", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-0756", "desc": "An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/390910"]}, {"cve": "CVE-2023-43268", "desc": "Deyue Remote Vehicle Management System v1.1 was discovered to contain a deserialization vulnerability.", "poc": ["https://github.com/Fliggyaaa/DeYue-remote-vehicle-management-system", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21339", "desc": "In Minikin, there is a possible way to trigger ANR by showing a malicious message due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27191", "desc": "An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.", "poc": ["https://apkpure.com/cn/super-security-virus-cleaner/com.ludashi.security", "https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27191/CVE%20detail.md"]}, {"cve": "CVE-2023-33658", "desc": "A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_msg_get_pub_pid() in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack.", "poc": ["https://github.com/emqx/nanomq/issues/1153"]}, {"cve": "CVE-2023-36621", "desc": "An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions temporarily or uninstall the application without the parents noticing.", "poc": ["https://seclists.org/fulldisclosure/2023/Jul/12"]}, {"cve": "CVE-2023-6802", "desc": "An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified\u00a0that could allow an attacker to gain access to the management console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs.\u00a0This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.", "poc": ["https://github.com/chompie1337/Windows_MSKSSRV_LPE_CVE-2023-36802"]}, {"cve": "CVE-2023-20010", "desc": "A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.\nThis vulnerability exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to read or modify any data on the underlying database or elevate their privileges.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-43998", "desc": "An issue in Books-futaba mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43199", "desc": "D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the prev parameter in the H5/login.cgi function.", "poc": ["https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7200GV2/bug6.md"]}, {"cve": "CVE-2023-29916", "desc": "H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/rkpbC1Jgh"]}, {"cve": "CVE-2023-23599", "desc": "When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1777800"]}, {"cve": "CVE-2023-6896", "desc": "A vulnerability was found in SourceCodester Simple Image Stack Website 1.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation of the argument search with the input sy2ap%22%3e%3cscript%3ealert(1)%3c%2fscript%3etkxh1 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248255.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27167", "desc": "Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.", "poc": ["https://packetstormsecurity.com/files/171523/Suprema-BioStar-2-2.8.16-SQL-Injection.html"]}, {"cve": "CVE-2023-49189", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Getsocial, S.A. Social Share Buttons & Analytics Plugin \u2013 GetSocial.Io allows Stored XSS.This issue affects Social Share Buttons & Analytics Plugin \u2013 GetSocial.Io: from n/a through 4.3.12.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-26494", "desc": "lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.", "poc": ["https://securitylab.github.com/advisories/GHSL-2022-138_lorawan-stack/"]}, {"cve": "CVE-2023-49909", "desc": "A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `action` parameter at offset `0x0045ab38` of the `httpd_portal` binary shipped with v5.1.0 Build 20220926 of the EAP225.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6009", "desc": "The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_update_user_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.", "poc": ["http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html", "https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681"]}, {"cve": "CVE-2023-33289", "desc": "The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs.", "poc": ["https://gist.github.com/6en6ar/b118888dc739e8979038f24c8ac33611"]}, {"cve": "CVE-2023-37460", "desc": "Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the `resolveFile()` function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later `Files.newOutputStream()`, that follows symlinks by default, will actually write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue.", "poc": ["https://github.com/codehaus-plexus/plexus-archiver/security/advisories/GHSA-wh3p-fphp-9h2m"]}, {"cve": "CVE-2023-6067", "desc": "The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/ae8e225a-5273-4db1-9c72-060304cca658/"]}, {"cve": "CVE-2023-33636", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/HyX6mgWz2"]}, {"cve": "CVE-2023-21965", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). The supported version that is affected is 6.4.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-41705", "desc": "Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/177130/OX-App-Suite-7.10.6-Cross-Site-Scirpting-Denial-Of-Service.html"]}, {"cve": "CVE-2023-34853", "desc": "Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of SmcSecurityEraseSetupVar variable.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/risuxx/CVE-2023-34853"]}, {"cve": "CVE-2023-36921", "desc": "SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to serve poisoned content to the server. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-32695", "desc": "socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.", "poc": ["https://github.com/OneIdentity/IdentityManager.Imx", "https://github.com/trong0dn/eth-todo-list"]}, {"cve": "CVE-2023-50781", "desc": "A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1605", "desc": "Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.", "poc": ["https://huntr.dev/bounties/9dddcf5b-7dd4-46cc-abf9-172dce20bab2"]}, {"cve": "CVE-2023-41099", "desc": "In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM).", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-33291", "desc": "In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. (It cannot be exploited with e-mail addresses or phone numbers that are registered in the application.)", "poc": ["http://packetstormsecurity.com/files/172476/eBankIT-6-Arbitrary-OTP-Generation.html"]}, {"cve": "CVE-2023-1537", "desc": "Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.", "poc": ["https://huntr.dev/bounties/171cde18-a447-446c-a9ab-297953ad9b86"]}, {"cve": "CVE-2023-21869", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-50303", "desc": "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 273333.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3535", "desc": "A vulnerability was found in SimplePHPscripts FAQ Script PHP 2.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233287.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3821", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.", "poc": ["https://huntr.dev/bounties/599ba4f6-c900-4161-9127-f1e6a6e29aaa"]}, {"cve": "CVE-2023-45898", "desc": "The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.4"]}, {"cve": "CVE-2023-3198", "desc": "The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message function. This makes it possible for unauthenticated attackers to update status order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-24124", "desc": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.", "poc": ["https://oxnan.com/posts/WifiBasic_wrlEn_DoS"]}, {"cve": "CVE-2023-28163", "desc": "When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user.
*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1817768"]}, {"cve": "CVE-2023-49844", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Kevin Ohashi WPPerformanceTester.This issue affects WPPerformanceTester: from n/a through 2.0.0.", "poc": ["https://github.com/kevinohashi/WPPerformanceTester"]}, {"cve": "CVE-2023-42320", "desc": "Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter in the GetParentControlInfo function.", "poc": ["https://github.com/aixiao0621/Tenda/blob/main/AC10/0.md", "https://github.com/aixiao0621/Tenda"]}, {"cve": "CVE-2023-41824", "desc": "An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34645", "desc": "jfinal CMS 5.1.0 has an arbitrary file read vulnerability.", "poc": ["https://github.com/jflyfox/jfinal_cms/issues/57"]}, {"cve": "CVE-2023-24730", "desc": "Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the user profile update function.", "poc": ["https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip"]}, {"cve": "CVE-2023-47996", "desc": "An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a denial of service.", "poc": ["https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47996", "https://github.com/thelastede/FreeImage-cve-poc"]}, {"cve": "CVE-2023-3024", "desc": "Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0179", "desc": "A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.", "poc": ["http://packetstormsecurity.com/files/171601/Kernel-Live-Patch-Security-Notice-LNS-0093-1.html", "https://seclists.org/oss-sec/2023/q1/20", "https://github.com/44maker/Linux-Privilege", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Awrrays/Pentest-Tips", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/EGI-Federation/SVG-advisories", "https://github.com/GhostTroops/TOP", "https://github.com/H4K6/CVE-2023-0179-PoC", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/TurtleARM/CVE-2023-0179-PoC", "https://github.com/aneasystone/github-trending", "https://github.com/h0pe-ay/Vulnerability-Reproduction", "https://github.com/hktalent/TOP", "https://github.com/johe123qwe/github-trending", "https://github.com/k0mi-tg/CVE-POC", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/manas3c/CVE-POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/taielab/awesome-hacking-lists", "https://github.com/tanjiti/sec_profile", "https://github.com/whoforget/CVE-POC", "https://github.com/xairy/linux-kernel-exploitation", "https://github.com/youwizard/CVE-POC"]}, {"cve": "CVE-2023-0845", "desc": "Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.", "poc": ["https://github.com/tdunlap607/docker_vs_cg"]}, {"cve": "CVE-2023-4432", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.", "poc": ["https://huntr.dev/bounties/69684663-6822-41ff-aa05-afbdb8f5268f"]}, {"cve": "CVE-2023-34563", "desc": "netgear R6250 Firmware Version 1.0.4.48 is vulnerable to Buffer Overflow after authentication.", "poc": ["https://github.com/D2y6p/CVE/blob/main/Netgear/CVE-2023-34563/EN.md"]}, {"cve": "CVE-2023-21870", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-31048", "desc": "The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely.", "poc": ["https://github.com/claroty/opcua-exploit-framework"]}, {"cve": "CVE-2023-0647", "desc": "A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/kickPlayer. The manipulation of the argument userId leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-220034 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/Ha0Liu/cveAdd/blob/developer/dst-admin%201.5.0%E5%90%8E%E5%8F%B0kickPlayer%E6%8E%A5%E5%8F%A3%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C/Dst-admin%201.5.0%20background%20kickPlayer%20interface%20remote%20command%20execution.md"]}, {"cve": "CVE-2023-36085", "desc": "The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its \"/sisqualIdentityServer/core/\" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to phishing attacks, malware distribution, and unauthorized access to sensitive resources.", "poc": ["http://packetstormsecurity.com/files/176991/SISQUAL-WFM-7.1.319.103-Host-Header-Injection.html", "https://github.com/omershaik0/Handmade_Exploits/tree/main/SISQUALWFM-Host-Header-Injection-CVE-2023-36085"]}, {"cve": "CVE-2023-46182", "desc": "IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 269692.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2640", "desc": "On Ubuntu kernels carrying both c914c0e27eb0 and \"UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs\", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.", "poc": ["https://github.com/0xWhoami35/root-kernel", "https://github.com/0xsyr0/OSCP", "https://github.com/Ev3rPalestine/Analytics-HTB-Walkthrough", "https://github.com/Kiosec/Linux-Exploitation", "https://github.com/Nkipohcs/CVE-2023-2640-CVE-2023-32629", "https://github.com/OllaPapito/gameoverlay", "https://github.com/PuguhDy/CVE-Root-Ubuntu", "https://github.com/SanjayRagavendar/Ubuntu-GameOver-Lay", "https://github.com/SanjayRagavendar/UbuntuPrivilegeEscalationV1", "https://github.com/SirElmard/ethical_hacking", "https://github.com/Snoopy-Sec/Localroot-ALL-CVE", "https://github.com/ThrynSec/CVE-2023-32629-CVE-2023-2640---POC-Escalation", "https://github.com/Umutkgz/CVE-2023-32629-CVE-2023-2640-Ubuntu-Privilege-Escalation-POC", "https://github.com/brimstone/stars", "https://github.com/churamanib/p0wny-shell", "https://github.com/cyberexpertsng/Cyber-Advisory", "https://github.com/druxter-x/PHP-CVE-2023-2023-2640-POC-Escalation", "https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629", "https://github.com/giterlizzi/secdb-feeds", "https://github.com/ilviborici/ubuntu-privesc", "https://github.com/johnlettman/juju-patch-gameoverlay", "https://github.com/johnlettman/juju-scripts", "https://github.com/k4but0/Ubuntu-LPE", "https://github.com/kaotickj/Check-for-CVE-2023-32629-GameOver-lay", "https://github.com/kgwanjala/oscp-cheatsheet", "https://github.com/luanoliveira350/GameOverlayFS", "https://github.com/musorblyat/CVE-2023-2640-CVE-2023-32629", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/oscpname/OSCP_cheat", "https://github.com/revanmalang/OSCP", "https://github.com/txuswashere/OSCP", "https://github.com/vinetsuicide/CVE-2023-2640-CVE-2023-32629", "https://github.com/xS9NTX/CVE-2023-32629-CVE-2023-2640-Ubuntu-Privilege-Escalation-POC", "https://github.com/xairy/linux-kernel-exploitation", "https://github.com/xhref/OSCP"]}, {"cve": "CVE-2023-32645", "desc": "A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1752"]}, {"cve": "CVE-2023-2753", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.", "poc": ["https://huntr.dev/bounties/eca2284d-e81a-4ab8-91bb-7afeca557628"]}, {"cve": "CVE-2023-27164", "desc": "An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.", "poc": ["https://gist.github.com/b33t1e/a1a0d81b1173d0d00de8f4e7958dd867"]}, {"cve": "CVE-2023-6599", "desc": "Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.", "poc": ["https://huntr.com/bounties/6198785c-bf60-422e-9b80-68a6e658a10e"]}, {"cve": "CVE-2023-47890", "desc": "pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.", "poc": ["https://github.com/pyload/pyload/security/advisories/GHSA-h73m-pcfw-25h2", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24520", "desc": "Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the trace tool utility.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1706"]}, {"cve": "CVE-2023-2089", "desc": "A vulnerability was found in SourceCodester Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/userprofile.php of the component GET Parameter Handler. The manipulation of the argument uid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226097 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.226097", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-6184", "desc": "Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting", "poc": ["https://github.com/SohelParashar/.Net-Deserialization-Cheat-Sheet"]}, {"cve": "CVE-2023-3346", "desc": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.", "poc": ["https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdf"]}, {"cve": "CVE-2023-29735", "desc": "An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29735/CVE%20detail.md"]}, {"cve": "CVE-2023-2431", "desc": "A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.", "poc": ["https://github.com/chen-keinan/k8s-vulndb-collector", "https://github.com/noirfate/k8s_debug"]}, {"cve": "CVE-2023-38433", "desc": "Fujitsu Real-time Video Transmission Gear \"IP series\" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as follows: IP-HE950E firmware versions V01L001 to V01L053, IP-HE950D firmware versions V01L001 to V01L053, IP-HE900E firmware versions V01L001 to V01L010, IP-HE900D firmware versions V01L001 to V01L004, IP-900E / IP-920E firmware versions V01L001 to V02L061, IP-900D / IP-900\u2161D / IP-920D firmware versions V01L001 to V02L061, IP-90 firmware versions V01L001 to V01L013, and IP-9610 firmware versions V01L001 to V02L007.", "poc": ["https://github.com/komodoooo/Some-things"]}, {"cve": "CVE-2023-3532", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.", "poc": ["https://huntr.dev/bounties/ebd2428a-e2cb-480e-ba37-dd89ad62cf1b", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21838", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/r00t4dm/r00t4dm"]}, {"cve": "CVE-2023-0439", "desc": "The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.", "poc": ["https://wpscan.com/vulnerability/04cea9aa-b21c-49f8-836b-2d312253e09a"]}, {"cve": "CVE-2023-22487", "desc": "Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@\"\"#p` syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post or not: A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number. The `mentionsPosts` relationship included in the `POST /api/posts` and `PATCH /api/posts/` JSON responses leaks the full JSON:API payload of all mentioned posts without any access control. This includes the content, date, number and attributes added by other extensions. An attacker only needs the ability to create new posts on the forum to exploit the vulnerability. This works even if new posts require approval. If they have the ability to edit posts, the attack can be performed even more discreetly by using a single post to scan any size of database and hiding the attack post content afterward. The attack allows the leaking of all posts in the forum database, including posts awaiting approval, posts in tags the user has no access to, and private discussions created by other extensions like FriendsOfFlarum Byobu. This also includes non-comment posts like tag changes or renaming events. The discussion payload is not leaked but using the mention HTML payload it's possible to extract the discussion ID of all posts and combine all posts back together into their original discussions even if the discussion title remains unknown. All Flarum versions prior to 1.6.3 are affected. The vulnerability has been fixed and published as flarum/core v1.6.3. As a workaround, user can disable the mentions extension.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/alopresto/epss_api_demo", "https://github.com/alopresto6m/epss_api_demo"]}, {"cve": "CVE-2023-34623", "desc": "An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.", "poc": ["https://github.com/trajano/jtidy/issues/4"]}, {"cve": "CVE-2023-40191", "desc": "Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the \u201cBlocked Email Domains\u201d text field", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3342", "desc": "The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in version 3.0.2 and fully patched in version 3.0.2.1.", "poc": ["http://packetstormsecurity.com/files/173434/WordPress-User-Registration-3.0.2-Arbitrary-File-Upload.html"]}, {"cve": "CVE-2023-2123", "desc": "The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.", "poc": ["https://github.com/daniloalbuqrque/poc-cve-xss-encoded-wp-inventory-manager-plugin", "https://wpscan.com/vulnerability/44448888-cd5d-482e-859e-123e442ce5c1", "https://github.com/0xn4d/poc-cve-xss-encoded-wp-inventory-manager-plugin", "https://github.com/daniloalbuqrque/poc-cve-xss-encoded-wp-inventory-manager-plugin", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1491", "desc": "A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been classified as critical. This affects the function 0x220020 in the library MaxCryptMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-223377 was assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1491", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-25156", "desc": "Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.", "poc": ["https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/"]}, {"cve": "CVE-2023-26118", "desc": "Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.", "poc": ["https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406326", "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406328", "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406327", "https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373046", "https://github.com/patrikx3/redis-ui"]}, {"cve": "CVE-2023-46980", "desc": "An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter.", "poc": ["https://github.com/sajaljat/CVE-2023-46980/tree/main", "https://youtu.be/3Mz2lSElg7Y", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sajaljat/CVE-2023-46980"]}, {"cve": "CVE-2023-36165", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/TraiLeR2/CVE-2023-36165", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27786", "desc": "An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the macinstring function.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Marsman1996/pocs"]}, {"cve": "CVE-2023-45820", "desc": "Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets.", "poc": ["https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m"]}, {"cve": "CVE-2023-31320", "desc": "Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display potentially resulting in denial of service.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/whypet/CVE-2023-31320"]}, {"cve": "CVE-2023-45159", "desc": "1E Client installer can perform arbitrary file deletion on protected files.\u00a0\u00a0A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. A hotfix is available from the 1E support portal that forces\u00a0the 1E Client to check for a symbolic link or junction and if it finds one refuses to use that path and instead creates a path involving a random GUID.for v8.1 use hotfix Q23097for v8.4 use hotfix Q23105for v9.0 use hotfix Q23115for SaaS customers, use 1EClient v23.7 plus hotfix Q23121", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34035", "desc": "Spring Security versions 5.8\u00a0prior to 5.8.5, 6.0\u00a0prior to 6.0.5,\u00a0and 6.1\u00a0prior to 6.1.2\u00a0could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String)\u00a0and multiple servlets, one of them being Spring MVC\u2019s DispatcherServlet.\u00a0(DispatcherServlet\u00a0is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)Specifically, an application is vulnerable when all of the following are true: * Spring MVC is on the classpath * Spring Security is securing more than one servlet in a single application (one of them being Spring MVC\u2019s DispatcherServlet) * The application uses requestMatchers(String)\u00a0to refer to endpoints that are not Spring MVC endpointsAn application is not vulnerable if any of the following is true: * The application does not have Spring MVC on the classpath * The application secures no servlets other than Spring MVC\u2019s DispatcherServlet * The application uses requestMatchers(String)\u00a0only for Spring MVC endpoints", "poc": ["https://github.com/AkagiYui/KenkoDrive", "https://github.com/ax1sX/SpringSecurity", "https://github.com/jzheaux/cve-2023-34035-mitigations", "https://github.com/mouadk/CVE-2023-34035-Poc", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sarasa0310/wanted-pre-onboarding-backend"]}, {"cve": "CVE-2023-34613", "desc": "An issue was discovered sojo thru 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.", "poc": ["https://github.com/maddingo/sojo/issues/15"]}, {"cve": "CVE-2023-45990", "desc": "Insecure Permissions vulnerability in WenwenaiCMS v.1.0 allows a remote attacker to escalate privileges.", "poc": ["https://github.com/PwnCYN/Wenwenai/issues/2"]}, {"cve": "CVE-2023-32681", "desc": "Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.", "poc": ["https://github.com/AppThreat/cpggen", "https://github.com/HotDB-Community/HotDB-Engine", "https://github.com/MaxymVlasov/renovate-vuln-alerts", "https://github.com/hardikmodha/POC-CVE-2023-32681", "https://github.com/jbugeja/test-repo", "https://github.com/mmbazm/device_api", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/renovate-reproductions/22747", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-35116", "desc": "** DISPUTED ** jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.", "poc": ["https://github.com/FasterXML/jackson-databind/issues/3972", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9", "https://github.com/scordero1234/java_sec_demo-main", "https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2023-51971", "desc": "Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function getIptvInfo.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40571", "desc": "weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deserialization vulnerability which may lead to remote code execution. When weblogic-framework gets the command echo, it directly deserializes the data returned by the server without verifying it. At the same time, the classloader loads a lot of deserialization calls. In this case, the malicious serialized data returned by the server will cause remote code execution. Version 0.2.4 contains a patch for this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4899", "desc": "SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.", "poc": ["https://huntr.dev/bounties/70a2fb18-f030-4abb-9ddc-13f94107ac9d"]}, {"cve": "CVE-2023-35311", "desc": "Microsoft Outlook Security Feature Bypass Vulnerability", "poc": ["https://github.com/Douda/PSSymantecCloud", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-3306", "desc": "A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. It has been declared as critical. This vulnerability affects unknown code of the file app.09df2a9e44ab48766f5f.js of the component Admin Password Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-231802 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/thedarknessdied/CVE-2023-4169_CVE-2023-3306_CVE-2023-4415"]}, {"cve": "CVE-2023-33485", "desc": "TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort in the addEffect function.", "poc": ["https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/5"]}, {"cve": "CVE-2023-1806", "desc": "The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.", "poc": ["https://wpscan.com/vulnerability/38d99c7d-2d10-4910-b95a-1cb545b813c4"]}, {"cve": "CVE-2023-46841", "desc": "Recent x86 CPUs offer functionality named Control-flow EnforcementTechnology (CET). A sub-feature of this are Shadow Stacks (CET-SS).CET-SS is a hardware feature designed to protect against Return OrientedProgramming attacks. When enabled, traditional stacks holding both dataand return addresses are accompanied by so called \"shadow stacks\",holding little more than return addresses. Shadow stacks aren'twritable by normal instructions, and upon function returns theircontents are used to check for possible manipulation of a return addresscoming from the traditional stack.In particular certain memory accesses need intercepting by Xen. Invarious cases the necessary emulation involves kind of replaying ofthe instruction. Such replaying typically involves filling and theninvoking of a stub. Such a replayed instruction may raise anexceptions, which is expected and dealt with accordingly.Unfortunately the interaction of both of the above wasn't right:Recovery involves removal of a call frame from the (traditional) stack.The counterpart of this operation for the shadow stack was missing.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-5806", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Injection.This issue affects Quality Management System: before v1.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25433", "desc": "libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/520", "https://github.com/13579and2468/Wei-fuzz", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-7116", "desc": "A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249086 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/20142995/sectool"]}, {"cve": "CVE-2023-0419", "desc": "The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/5ccfee43-920d-4613-b976-2ea8966696ba"]}, {"cve": "CVE-2023-4493", "desc": "Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the users_admin.ghp file that affects multiple parameters such as (firstname, homephone, lastname, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, workzip). This vulnerability allows a remote attacker to store a malicious JavaScript payload in the application to be executed when the page is loaded, resulting in an integrity impact.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49553", "desc": "An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file.", "poc": ["https://github.com/cesanta/mjs/issues/253"]}, {"cve": "CVE-2023-29188", "desc": "SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-3884", "desc": "A vulnerability has been found in Campcodes Beauty Salon Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/edit_product.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235246 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System/Beauty%20Salon%20Management%20System%20-%20vuln%2016.pdf"]}, {"cve": "CVE-2023-0220", "desc": "The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.", "poc": ["https://wpscan.com/vulnerability/d6d976be-31d1-419d-8729-4a36fbd2755c"]}, {"cve": "CVE-2023-38297", "desc": "An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufacturers. Certain software builds for various Android devices contain a vulnerable pre-installed app with a package name of com.factory.mmigroup (versionCode='3', versionName='2.1) that allows local third-party apps to perform various actions, due to inadequate access control, in its context (system user), but the functionalities exposed depend on the specific device. The following capabilities are exposed to zero-permission, third-party apps on the following devices: arbitrary AT command execution via AT command injection (T-Mobile Revvl 6 Pro 5G, T-Mobile Revvl V+ 5G, and Boost Mobile Celero 5G); programmatic factory reset (Samsung Galaxy A03S, T-Mobile Revvl 6 Pro 5G, T-Mobile Revvl V+ 5G, Boost Mobile Celero, Realme C25Y, and Lenovo Tab M8 HD), leaking IMEI (Samsung Galaxy A03S, T-Mobile Revvl 6 Pro 5G, T-Mobile Revvl V+ 5G, Boost Mobile Celero, and Realme C25Y); leaking serial number (Samsung Galaxy A03s, T-Mobile Revvl 6 Pro 5G, T-Mobile Revvl V+ 5G, Boost Mobile Celero, Realme C25Y, and Lenovo Tab M8 HD); powering off the device (Realme C25Y, Samsung Galaxy A03S, and T-Mobile Revvl 6 Pro 5G); and programmatically enabling/disabling airplane mode (Samsung Galaxy A03S, T-Mobile Revvl 6 Pro 5G, T-Mobile Revvl V+ 5G, Boost Mobile Celero, and Realme C25Y); and enabling Wi-Fi, Bluetooth, and GPS (Samsung Galaxy A03S, T-Mobile Revvl 6 Pro 5G, T-Mobile Revvl V+ 5G, Boost Mobile Celero, and Realme C25Y). No permissions or special privileges are necessary to exploit the vulnerabilities in the com.factory.mmigroup app. No user interaction is required beyond installing and running a third-party app. The software build fingerprints for each confirmed vulnerable device are as follows: Boost Mobile Celero 5G (Celero5G/Jupiter/Jupiter:11/RP1A.200720.011/SW_S98119AA1_V067:user/release-keys, Celero5G/Jupiter/Jupiter:11/RP1A.200720.011/SW_S98119AA1_V064:user/release-keys, Celero5G/Jupiter/Jupiter:11/RP1A.200720.011/SW_S98119AA1_V061:user/release-keys, and Celero5G/Jupiter/Jupiter:11/RP1A.200720.011/SW_S98119AA1_V052:user/release-keys); Samsung Galaxy A03S (samsung/a03sutfn/a03su:13/TP1A.220624.014/S134DLUDU6CWB6:user/release-keys and samsung/a03sutfn/a03su:12/SP1A.210812.016/S134DLUDS5BWA1:user/release-keys); Lenovo Tab M8 HD (Lenovo/LenovoTB-8505F/8505F:10/QP1A.190711.020/S300637_220706_BMP:user/release-keys and Lenovo/LenovoTB-8505F/8505F:10/QP1A.190711.020/S300448_220114_BMP:user/release-keys); T-Mobile Revvl 6 Pro 5G (T-Mobile/Augusta/Augusta:12/SP1A.210812.016/SW_S98121AA1_V070:user/release-keys and T-Mobile/Augusta/Augusta:12/SP1A.210812.016/SW_S98121AA1_V066:user/release-keys); T-Mobile Revvl V+ 5G (T-Mobile/Sprout/Sprout:11/RP1A.200720.011/SW_S98115AA1_V077:user/release-keys and T-Mobile/Sprout/Sprout:11/RP1A.200720.011/SW_S98115AA1_V060:user/release-keys); and Realme C25Y (realme/RMX3269/RED8F6:11/RP1A.201005.001/1675861640000:user/release-keys, realme/RMX3269/RED8F6:11/RP1A.201005.001/1664031768000:user/release-keys, realme/RMX3269/RED8F6:11/RP1A.201005.001/1652814687000:user/release-keys, and realme/RMX3269/RED8F6:11/RP1A.201005.001/1635785712000:user/release-keys). This malicious app sends a broadcast Intent to com.factory.mmigroup/.MMIGroupReceiver. This causes the com.factory.mmigroup app to dynamically register for various action strings. The malicious app can then send these strings, allowing it to perform various behaviors that the com.factory.mmigroup app exposes. The actual behaviors exposed by the com.factory.mmigroup app depend on device model and chipset. The com.factory.mmigroup app executes as the \"system\" user, allowing it to interact with the baseband processor and perform various other sensitive actions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38193", "desc": "An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2023-0015/"]}, {"cve": "CVE-2023-48309", "desc": "NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow (state, PKCE or nonce). Manually overriding the `next-auth.session-token` cookie value with this non-related JWT would let the user simulate a logged in user, albeit having no user information associated with it. (The only property on this user is an opaque randomly generated string). This vulnerability does not give access to other users' data, neither to resources that require proper authorization via scopes or other means. The created mock user has no information associated with it (ie. no name, email, access_token, etc.) This vulnerability can be exploited by bad actors to peek at logged in user states (e.g. dashboard layout). `next-auth` `v4.24.5` contains a patch for the vulnerability. As a workaround, using a custom authorization callback for Middleware, developers can manually do a basic authentication.", "poc": ["https://github.com/HarshKanjiya/talkative-nextjs", "https://github.com/dastaj/CVEs"]}, {"cve": "CVE-2023-32503", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <=\u00a00.4.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1318", "desc": "Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.", "poc": ["https://huntr.dev/bounties/e58b38e0-4897-4bb0-84e8-a7ad8efab338", "https://github.com/indevi0us/indevi0us"]}, {"cve": "CVE-2023-2519", "desc": "A vulnerability has been found in Caton CTP Relay Server 1.2.9 and classified as critical. This vulnerability affects unknown code of the file /server/api/v1/login of the component API. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. VDB-228010 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.228010"]}, {"cve": "CVE-2023-46191", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Niels van Renselaar Open Graph Metabox plugin <=\u00a01.4.4 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-2094", "desc": "A vulnerability has been found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/mechanics/manage_mechanic.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226102 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-39476", "desc": "Inductive Automation Ignition JavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is not required to exploit this vulnerability.The specific flaw exists within the JavaSerializationCodec class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20291.", "poc": ["https://github.com/TecR0c/DoubleTrouble"]}, {"cve": "CVE-2023-4238", "desc": "The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.", "poc": ["https://wpscan.com/vulnerability/53816136-4b1a-4b7d-b73b-08a90c2a638f", "https://github.com/codeb0ss/CVE-2023-4238-PoC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-44310", "desc": "Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's \"Name\" text field.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43666", "desc": "Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,\u00a0General user can view all user data like Admin account.Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.[1]\u00a0 https://github.com/apache/inlong/pull/8623", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4158", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.3.", "poc": ["https://huntr.dev/bounties/e0e462ae-d7cb-4a84-b6fe-5f5de20e3d15"]}, {"cve": "CVE-2023-27398", "desc": "A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20304)", "poc": ["https://github.com/linuxshark/meli-api-challenge"]}, {"cve": "CVE-2023-0154", "desc": "The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/5e66e173-776d-4423-b4a2-eb7316b2502f"]}, {"cve": "CVE-2023-49437", "desc": "Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.", "poc": ["https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetNetControlList-3.md"]}, {"cve": "CVE-2023-33741", "desc": "Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.", "poc": ["https://github.com/zzh-newlearner/record/blob/main/macrovideo_share.md"]}, {"cve": "CVE-2023-34092", "desc": "Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, and vite@2.9.16.", "poc": ["https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67", "https://github.com/FlapyPan/test-cve-2023-34092", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-21822", "desc": "Windows Graphics Component Elevation of Privilege Vulnerability", "poc": ["https://github.com/DashaMilitskaya/cve_2023_21822", "https://github.com/immortalp0ny/mypocs"]}, {"cve": "CVE-2023-6852", "desc": "A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The name of the patch is 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248220.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48974", "desc": "Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/vinnie1717/CVE-2023-48974"]}, {"cve": "CVE-2023-46447", "desc": "The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over BLE.", "poc": ["https://github.com/actuator/cve", "https://github.com/actuator/rebel", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3179", "desc": "The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).", "poc": ["https://wpscan.com/vulnerability/542caa40-b199-4397-90bb-4fdb693ebb24"]}, {"cve": "CVE-2023-30459", "desc": "SmartPTT SCADA 1.1.0.0 allows remote code execution (when the attacker has administrator privileges) by writing a malicious C# script and executing it on the server (via server settings in the administrator control panel on port 8101, by default).", "poc": ["https://github.com/Toxich4/CVE-2023-30459", "https://smartptt.com", "https://github.com/Toxich4/CVE-2023-30459", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1367", "desc": "Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.", "poc": ["https://huntr.dev/bounties/16bc74e2-1825-451f-bff7-bfdc1ea75cc2"]}, {"cve": "CVE-2023-0420", "desc": "The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF", "poc": ["https://wpscan.com/vulnerability/266e417f-ece7-4ff5-a724-4d9c8e2f3faa"]}, {"cve": "CVE-2023-3136", "desc": "The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52269", "desc": "MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrators to conduct attacks against global administrators.", "poc": ["https://github.com/vipercalling/XSSsecurityGateway/blob/main/finding"]}, {"cve": "CVE-2023-33633", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/UpdateWanParams"]}, {"cve": "CVE-2023-37450", "desc": "The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "poc": ["https://github.com/0x177git/grupo-de-noticias", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/exoForce01/grupo-de-noticias", "https://github.com/xaitax/cisa-catalog-known-vulnerabilities"]}, {"cve": "CVE-2023-6337", "desc": "HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.Fixed in\u00a0Vault 1.15.4, 1.14.8, 1.13.12.", "poc": ["https://github.com/bbhorrigan/Vaulthcsec", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25346", "desc": "A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.", "poc": ["https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25346", "https://github.com/10splayaSec/CVE-Disclosures", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-51683", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29209", "desc": "XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the legacy notification activity macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the macro parameters of the legacy notification activity macro. This macro is installed by default in XWiki. The vulnerability can be exploited via every wiki page that is editable including the user's profile, but also with just view rights using the HTMLConverter that is part of the CKEditor integration which is bundled with XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.", "poc": ["https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9pc2-x9qf-7j2q"]}, {"cve": "CVE-2023-34867", "desc": "Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_property_hashmap_create at jerry-core/ecma/base/ecma-property-hashmap.c.", "poc": ["https://github.com/jerryscript-project/jerryscript/issues/5084"]}, {"cve": "CVE-2023-30445", "desc": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253357.", "poc": ["https://www.ibm.com/support/pages/node/7010557", "https://github.com/vulsio/go-cve-dictionary"]}, {"cve": "CVE-2023-32308", "desc": "anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database. This issue has been fixed in version 1.22.11.5781. Users are advised to upgrade. Users unable to upgrade may insert an additional check for errors in a condition before calling `ttGroupHelper::getActiveInvoices()` in invoices.php.", "poc": ["https://github.com/indevi0us/indevi0us"]}, {"cve": "CVE-2023-45744", "desc": "A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to configuration modification. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866"]}, {"cve": "CVE-2023-49130", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23559", "desc": "In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/szymonh/szymonh"]}, {"cve": "CVE-2023-40800", "desc": "The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.", "poc": ["https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/compare_parentcontrol_time"]}, {"cve": "CVE-2023-5195", "desc": "Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4455", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.", "poc": ["https://huntr.dev/bounties/5ab1b206-5fe8-4737-b275-d705e76f193a", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-28121", "desc": "An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.", "poc": ["https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/", "https://github.com/1337nemojj/CVE-2023-28121", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Jenderal92/CVE-2023-28121", "https://github.com/Jenderal92/WP-CVE-2023-28121", "https://github.com/XRSec/AWVS-Update", "https://github.com/gbrsh/CVE-2023-28121", "https://github.com/getdrive/PoC", "https://github.com/iluaster/getdrive_PoC", "https://github.com/im-hanzou/Mass-CVE-2023-28121", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rio128128/Mass-CVE-2023-28121-kdoec"]}, {"cve": "CVE-2023-33568", "desc": "An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.", "poc": ["https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/", "https://github.com/XRSec/AWVS-Update", "https://github.com/komodoooo/Some-things", "https://github.com/komodoooo/some-things"]}, {"cve": "CVE-2023-3018", "desc": "A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/?page=user/list. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230362 is the identifier assigned to this vulnerability.", "poc": ["http://packetstormsecurity.com/files/172653/Lost-And-Found-Information-System-1.0-Broken-Access-Control-Privilege-Escalation.html", "https://medium.com/@akashpandey380/lost-and-found-information-system-v1-0-idor-cve-2023-977966c4450d"]}, {"cve": "CVE-2023-43535", "desc": "Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4682", "desc": "Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.", "poc": ["https://huntr.dev/bounties/15232a74-e3b8-43f0-ae8a-4e89d56c474c"]}, {"cve": "CVE-2023-0028", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+.", "poc": ["https://huntr.dev/bounties/bfd935f4-2d1d-4d3f-8b59-522abe7dd065"]}, {"cve": "CVE-2023-5901", "desc": "Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.", "poc": ["https://huntr.com/bounties/8fb9b06b-cadd-469e-862d-5ce026019597"]}, {"cve": "CVE-2023-43295", "desc": "Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted request.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50070", "desc": "Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/geraldoalcantara/CVE-2023-50070", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-49979", "desc": "A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49979", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5952", "desc": "The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog", "poc": ["https://wpscan.com/vulnerability/0acd613e-dbd6-42ae-9f3d-6d6e77a4c1b7"]}, {"cve": "CVE-2023-3507", "desc": "The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/e72bbe9b-e51d-40ab-820d-404e0cb86ee6"]}, {"cve": "CVE-2023-40028", "desc": "Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/0xyassine/CVE-2023-40028", "https://github.com/0xyassine/poc-seeker", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-49001", "desc": "An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrowswer.webview component.", "poc": ["https://github.com/actuator/com.gurry.kvbrowser/blob/main/CWE-94.md", "https://github.com/actuator/com.gurry.kvbrowser", "https://github.com/actuator/cve", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-50734", "desc": "A buffer overflow vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3173", "desc": "Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.", "poc": ["https://huntr.dev/bounties/4d715f76-950d-4251-8139-3dffea798f14"]}, {"cve": "CVE-2023-31587", "desc": "Tenda AC5 router V15.03.06.28 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/WriteFacMac.", "poc": ["https://github.com/yanbushuang/CVE/blob/main/TendaAC5.md"]}, {"cve": "CVE-2023-30096", "desc": "A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user information field.", "poc": ["https://www.edoardoottavianelli.it/CVE-2023-30096/", "https://www.youtube.com/watch?v=ZA7R001kE2w"]}, {"cve": "CVE-2023-29523", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The same vulnerability can also be exploited in other contexts where the `display` method on a document is used to display a field with wiki syntax, for example in applications created using `App Within Minutes`. This has been patched in XWiki 13.10.11, 14.4.8, 14.10.2 and 15.0RC1. There is no workaround apart from upgrading.", "poc": ["https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x764-ff8r-9hpx"]}, {"cve": "CVE-2023-5520", "desc": "Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.", "poc": ["https://huntr.dev/bounties/681e42d0-18d4-4ebc-aba0-c5b0f77ac74a"]}, {"cve": "CVE-2023-0975", "desc": "A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to replace one of the Agent\u2019s executables before it can be executed. This allows the user to elevate their permissions.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10396"]}, {"cve": "CVE-2023-26244", "desc": "An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDMClient binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the digital signature check of AppUpgrade and .lge.upgrade.xml files, which are used during the firmware installation process. This indirectly allows an attacker to use a custom version of AppUpgrade and .lge.upgrade.xml files.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-30454", "desc": "An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray POST parameter that will be passed to an eval() function and executed upon pressing the continue button.", "poc": ["https://packetstormsecurity.com/files/172063/ebankIT-6-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-41563", "desc": "Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter mac at url /goform/GetParentControlInfo.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/sinemsahn/Public-CVE-Analysis"]}, {"cve": "CVE-2023-45466", "desc": "Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings.", "poc": ["https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20pin_host%20parameter%20in%20wps%20setting.md", "https://github.com/Luwak-IoT-Security/CVEs"]}, {"cve": "CVE-2023-38687", "desc": "Svelecte is a flexible autocomplete/select component written in Svelte. Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be exploited to execute arbitrary JavaScript whenever a Svelecte dropdown is opened. Item names given to Svelecte appear to be directly rendered as HTML by the default item renderer. This means that any HTML tags in the name are rendered as HTML elements not as text. Note that the custom item renderer shown in https://mskocik.github.io/svelecte/#item-rendering is also vulnerable to the same exploit. Any site that uses Svelecte with dynamically created items either from an external source or from user-created content could be vulnerable to an XSS attack (execution of untrusted JavaScript), clickjacking or any other attack that can be performed with arbitrary HTML injection. The actual impact of this vulnerability for a specific application depends on how trustworthy the sources that provide Svelecte items are and the steps that the application has taken to mitigate XSS attacks. XSS attacks using this vulnerability are mostly mitigated by a Content Security Policy that blocks inline JavaScript. This issue has been addressed in version 3.16.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/mskocik/svelecte/security/advisories/GHSA-7h45-grc5-89wq"]}, {"cve": "CVE-2023-52345", "desc": "In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51448", "desc": "Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `\u2018managers.php\u2019`. An authenticated attacker with the \u201cSettings/Utilities\u201d permission can send a crafted HTTP GET request to the endpoint `\u2018/cacti/managers.php\u2019` with an SQLi payload in the `\u2018selected_graphs_array\u2019` HTTP GET parameter. As of time of publication, no patched versions exist.", "poc": ["https://github.com/gg0h/gg0h", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-6865", "desc": "`EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35925", "desc": "FastAsyncWorldEdit (FAWE) is designed for efficient world editing. This vulnerability enables the attacker to select a region with the `Infinity` keyword (case-sensitive!) and executes any operation. This has a possibility of bringing the performing server down. This issue has been fixed in version 2.6.3.", "poc": ["https://github.com/IntellectualSites/FastAsyncWorldEdit/security/advisories/GHSA-whj9-m24x-qhhp"]}, {"cve": "CVE-2023-26156", "desc": "Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system.\n**Note:**\nAn attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.", "poc": ["https://gist.github.com/mcoimbra/47b1da554a80795c45126d51e41b2b18", "https://security.snyk.io/vuln/SNYK-JS-CHROMEDRIVER-6049539"]}, {"cve": "CVE-2023-7082", "desc": "The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.", "poc": ["https://wpscan.com/vulnerability/7f947305-7a72-4c59-9ae8-193f437fd04e/"]}, {"cve": "CVE-2023-5857", "desc": "Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrary code via a malicious file. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24674", "desc": "Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter.", "poc": ["https://cupc4k3.medium.com/cve-2023-24674-uncovering-a-privilege-escalation-vulnerability-in-bludit-cms-dcf86c41107", "https://medium.com/@cupc4k3/privilege-scalation-in-bludit-cms-dcf86c41107"]}, {"cve": "CVE-2023-0431", "desc": "The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.", "poc": ["https://wpscan.com/vulnerability/fdcbd9a3-552d-439e-b283-1d3d934889af"]}, {"cve": "CVE-2023-3521", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.", "poc": ["https://huntr.dev/bounties/76a3441d-7f75-4a8d-a7a0-95a7f5456eb0"]}, {"cve": "CVE-2023-49100", "desc": "Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0 through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is possible. An attacker can still crash TF-A, however.", "poc": ["https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-11.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31628", "desc": "An issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1141"]}, {"cve": "CVE-2023-35194", "desc": "An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset `0x4bde44`.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1782"]}, {"cve": "CVE-2023-39005", "desc": "Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2.", "poc": ["https://logicaltrust.net/blog/2023/08/opnsense.html"]}, {"cve": "CVE-2023-1369", "desc": "A vulnerability was found in TG Soft Vir.IT eXplorer 9.4.86.0. It has been rated as problematic. This issue affects the function 0x82730088 in the library VIRAGTLT.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 9.5 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222875.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1369", "https://github.com/ARPSyndicate/cvemon", "https://github.com/karimhabush/cyberowl", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-0977", "desc": "A heap-based overflow vulnerability in Trellix Agent (Windows and Linux) version 5.7.8 and earlier, allows a remote user to alter the page heap in the macmnsvc process memory block resulting in the service becoming unavailable.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10396"]}, {"cve": "CVE-2023-5422", "desc": "The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured that the certificate satisfies all necessary security requirements.This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.", "poc": ["https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27847", "desc": "SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components.", "poc": ["https://friends-of-presta.github.io/security-advisories/modules/2023/03/23/xipblog.html"]}, {"cve": "CVE-2023-1836", "desc": "A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in \"raw\" mode, it can be made to render as HTML if viewed under specific circumstances", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/404613"]}, {"cve": "CVE-2023-5685", "desc": "A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43698", "desc": "Improper Neutralization of Input During Web Page Generation (\u2019Cross-site Scripting\u2019) in RDT400 in SICK APU allows an unprivileged remote attacker to run arbitrary code in the clientsbrowser via injecting code into the website.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32495", "desc": "Dell PowerScale OneFS, 8.2.x-9.5.x, contains a exposure of sensitive information to an unauthorized Actor vulnerability. An authorized local attacker could potentially exploit this vulnerability, leading to escalation of privileges.", "poc": ["https://www.dell.com/support/kbdoc/en-us/000216717/dsa-2023-269-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"]}, {"cve": "CVE-2023-1646", "desc": "A vulnerability was found in IObit Malware Fighter 9.4.0.776. It has been declared as critical. This vulnerability affects the function 0x8018E000/0x8018E004 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. VDB-224026 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1646", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-28708", "desc": "When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/DrC0okie/HEIG_SLH_Labo1", "https://github.com/Dzmitry-Basiachenka/dist-foreign-aliakh", "https://github.com/fernandoreb/dependency-check-springboot", "https://github.com/scordero1234/java_sec_demo-main", "https://github.com/trganda/dockerv"]}, {"cve": "CVE-2023-40660", "desc": "A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.", "poc": ["http://www.openwall.com/lists/oss-security/2023/12/13/2", "https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651"]}, {"cve": "CVE-2023-27263", "desc": "A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-4251", "desc": "The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.", "poc": ["https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19"]}, {"cve": "CVE-2023-3601", "desc": "The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.", "poc": ["https://wpscan.com/vulnerability/c0cc513e-c306-4920-9afb-e33d95a7292f"]}, {"cve": "CVE-2023-43786", "desc": "A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.", "poc": ["https://github.com/AWSXXF/xorg_mirror_libx11", "https://github.com/LingmoOS/libx11", "https://github.com/deepin-community/libx11", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/jfrog/jfrog-CVE-2023-43786-libX11_DoS", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-41763", "desc": "Skype for Business Elevation of Privilege Vulnerability", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/whitfieldsdad/cisa_kev"]}, {"cve": "CVE-2023-6753", "desc": "Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.", "poc": ["https://huntr.com/bounties/b397b83a-527a-47e7-b912-a12a17a6cfb4"]}, {"cve": "CVE-2023-0033", "desc": "The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.", "poc": ["https://wpscan.com/vulnerability/2d9ae43b-75a7-4fcc-bce3-d9e9d7a97ec0"]}, {"cve": "CVE-2023-43700", "desc": "Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20598", "desc": "An improper privilege management in the AMD Radeon\u2122\u00a0Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over arbitrary hardware ports or physical addresses resulting in a potential arbitrary code execution.", "poc": ["https://github.com/hfiref0x/KDU"]}, {"cve": "CVE-2023-33638", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/ryyALdiV3"]}, {"cve": "CVE-2023-49694", "desc": "A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP files in a Tomcat web application directory. The user can then execute the JSP files under the security context of SYSTEM.", "poc": ["https://www.tenable.com/security/research/tra-2023-39"]}, {"cve": "CVE-2023-45223", "desc": "Mattermost fails to properly validate the \"Show Full Name\" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25823", "desc": "Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=True`), a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides. This issue is patched in version 3.13.1, however, users are recommended to update to 3.19.1 or later where the FRP solution has been properly tested.", "poc": ["https://github.com/DummyOrganisationTest/test_dependabot2"]}, {"cve": "CVE-2023-25206", "desc": "PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.", "poc": ["https://friends-of-presta.github.io/security-advisories/modules/2023/03/14/ws_productreviews.html"]}, {"cve": "CVE-2023-33381", "desc": "A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0b7_2). The vulnerability allows an authenticated user to execute arbitrary OS commands by sending specially crafted input to the router via the ping function.", "poc": ["https://github.com/duality084/CVE-2023-33381-MitraStar-GPT-2741GNAC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6049", "desc": "The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog", "poc": ["https://wpscan.com/vulnerability/8cfd8c1f-2834-4a94-a3fa-c0cfbe78a8b7"]}, {"cve": "CVE-2023-47350", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the user password update functionality.", "poc": ["https://mechaneus.github.io/CVE-2023-47350.html", "https://github.com/mechaneus/mechaneus.github.io"]}, {"cve": "CVE-2023-50445", "desc": "Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.", "poc": ["http://packetstormsecurity.com/files/176708/GL.iNet-Unauthenticated-Remote-Command-Execution.html"]}, {"cve": "CVE-2023-52459", "desc": "In the Linux kernel, the following vulnerability has been resolved:media: v4l: async: Fix duplicated list deletionThe list deletion call dropped here is already called from thehelper function in the line before. Having a second list_del()call results in either a warning (with CONFIG_DEBUG_LIST=y):list_del corruption, c46c8198->next is LIST_POISON1 (00000100)If CONFIG_DEBUG_LIST is disabled the operation results in akernel error due to NULL pointer dereference.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50879", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS.This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21832", "desc": "Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/yycunhua/4ra1n"]}, {"cve": "CVE-2023-24080", "desc": "A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce attack.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/SirCryptic/resetryder"]}, {"cve": "CVE-2023-31290", "desc": "Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input seed, resulting in only four billion possible mnemonics. The affected versions of the browser extension are 0.0.172 through 0.0.182. To steal funds efficiently, an attacker can identify all Ethereum addresses created since the 0.0.172 release, and check whether they are Ethereum addresses that could have been created by this extension. To respond to the risk, affected users need to upgrade the product version and also move funds to a new wallet address.", "poc": ["https://github.com/00000rest/py_trustwallet_wasm", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3405", "desc": "Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42805", "desc": "quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.", "poc": ["https://github.com/QUICTester/QUICTester"]}, {"cve": "CVE-2023-1579", "desc": "Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64.", "poc": ["https://sourceware.org/bugzilla/show_bug.cgi?id=29988", "https://github.com/13579and2468/Wei-fuzz", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-5324", "desc": "A vulnerability has been found in eeroOS up to 6.16.4-11 and classified as critical. This vulnerability affects unknown code of the component Ethernet Interface. The manipulation leads to denial of service. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241024.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/nomis/eero-zero-length-ipv6-options-header-dos"]}, {"cve": "CVE-2023-35854", "desc": "** DISPUTED ** Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have \"found no evidence or detail of a security vulnerability.\"", "poc": ["https://github.com/970198175/Simply-use"]}, {"cve": "CVE-2023-49103", "desc": "An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.", "poc": ["https://github.com/20142995/sectool", "https://github.com/MixColumns/CVE-2023-49103", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/afonsovitorio/cve_sandbox", "https://github.com/ambionics/owncloud-exploits", "https://github.com/creacitysec/CVE-2023-49103", "https://github.com/ditekshen/ansible-cve-2023-49103", "https://github.com/merlin-ke/OwnCloud-CVE-2023-49103", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-2793", "desc": "Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-51614", "desc": "D-Link DIR-X3260 prog.cgi SetQuickVPNSettings Password Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21591.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36144", "desc": "An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.", "poc": ["https://github.com/leonardobg/CVE-2023-36144", "https://github.com/leonardobg/CVE-2023-36144", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-48058", "desc": "Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run", "poc": ["https://github.com/CP1379767017/cms/blob/main/CSRF%20exists%20at%20the%20task%20management%20execution%20task%20location.md"]}, {"cve": "CVE-2023-42642", "desc": "In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35356", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/174115/Microsoft-Windows-Kernel-Arbitrary-Read.html", "http://packetstormsecurity.com/files/174118/Microsoft-Windows-Kernel-Security-Descriptor-Use-After-Free.html", "http://packetstormsecurity.com/files/176451/Microsoft-Windows-Registry-Predefined-Keys-Privilege-Escalation.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25586", "desc": "A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.", "poc": ["https://sourceware.org/bugzilla/show_bug.cgi?id=29855", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52218", "desc": "Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.This issue affects Woocommerce Tranzila Payment Gateway: from n/a through 1.0.8.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4168", "desc": "A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of the component Redirect Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/174015/Adlisting-Classified-Ads-2.14.0-Information-Disclosure.html"]}, {"cve": "CVE-2023-5862", "desc": "Missing Authorization in GitHub repository hamza417/inure prior to Build95.", "poc": ["https://huntr.com/bounties/0e517db6-d8ba-4cb9-9339-7991dda52e6d"]}, {"cve": "CVE-2023-27592", "desc": "Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the `html.ServerError` is returned unescaped without the expected Content Security Policy header added to valid responses. By creating an RSS feed item with the inline description containing an `![]()
` tag with a `srcset` attribute pointing to an invalid URL like `http:a`, we can coerce the proxy handler into an error condition where the invalid URL is returned unescaped and in full. This results in JavaScript execution on the Miniflux instance as soon as the user is convinced (e.g. by a message in the alt text) to open the broken image. An attacker can execute arbitrary JavaScript in the context of a victim Miniflux user when they open a broken image in a crafted RSS feed. This can be used to perform actions on the Miniflux instance as that user and gain administrative access to the Miniflux instance if it is reachable and the victim is an administrator. A patch is available in version 2.0.43. As a workaround sisable image proxy; default value is `http-only`.", "poc": ["https://github.com/40826d/advisories", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-27953", "desc": "The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A remote user may be able to cause unexpected system termination or corrupt kernel memory.", "poc": ["https://github.com/houjingyi233/macOS-iOS-system-security"]}, {"cve": "CVE-2023-4277", "desc": "The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing nonce validation on the 'process_change_profile_form' function. This makes it possible for unauthenticated attackers to change user email via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39254", "desc": "Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access to the system could potentially exploit this vulnerability to run arbitrary code as admin.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2609", "desc": "NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.", "poc": ["https://huntr.dev/bounties/1679be5a-565f-4a44-a430-836412a0b622"]}, {"cve": "CVE-2023-23937", "desc": "Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain. This issue has been patched in version 10.5.16.", "poc": ["https://github.com/ctflearner/ctflearner"]}, {"cve": "CVE-2023-27318", "desc": "StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.13 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to a crash of the Local Distribution Router (LDR) service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47025", "desc": "An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component.", "poc": ["https://github.com/free5gc/free5gc/issues/501"]}, {"cve": "CVE-2023-49285", "desc": "Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/MegaManSec/Squid-Security-Audit"]}, {"cve": "CVE-2023-21850", "desc": "Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demantra Demand Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demantra Demand Management accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-46992", "desc": "TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset serveral critical passwords without authentication by visiting specific pages.", "poc": ["https://github.com/AuroraHaaash/vul_report/blob/main/TOTOLINK%20A3300R/readme.md"]}, {"cve": "CVE-2023-4708", "desc": "A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /collection/all of the component GET Parameter Handler. The manipulation of the argument tag leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-238571. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/174445/Clcknshop-1.0.0-SQL-Injection.html"]}, {"cve": "CVE-2023-1578", "desc": "SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.", "poc": ["https://huntr.dev/bounties/7e441a14-8e55-4ab4-932c-4dc56bb1bc2e"]}, {"cve": "CVE-2023-49433", "desc": "Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetVirtualServerCfg.", "poc": ["https://github.com/ef4tless/vuln/blob/master/iot/AX9/SetVirtualServerCfg.md"]}, {"cve": "CVE-2023-42940", "desc": "A session rendering issue was addressed with improved session tracking. This issue is fixed in macOS Sonoma 14.2.1. A user who shares their screen may unintentionally share the incorrect content.", "poc": ["http://seclists.org/fulldisclosure/2023/Dec/20"]}, {"cve": "CVE-2023-25435", "desc": "libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/518", "https://github.com/13579and2468/Wei-fuzz"]}, {"cve": "CVE-2023-38559", "desc": "A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.", "poc": ["https://github.com/fullwaywang/QlRules"]}, {"cve": "CVE-2023-4568", "desc": "PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.", "poc": ["https://www.tenable.com/security/research/tra-2023-31", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-44360", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2488", "desc": "The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/60226669-0b7b-441f-93d4-b5933e69478f"]}, {"cve": "CVE-2023-6257", "desc": "The Inline Related Posts WordPress plugin before 3.6.0 does not ensure that post content displayed via an AJAX action are accessible to the user, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts", "poc": ["https://wpscan.com/vulnerability/19a86448-8d7c-4f02-9290-d9f93810e6e1/"]}, {"cve": "CVE-2023-23752", "desc": "An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.", "poc": ["https://github.com/0day404/vulnerability-poc", "https://github.com/0x783kb/Security-operation-book", "https://github.com/0xNahim/CVE-2023-23752", "https://github.com/0xWhoami35/CVE-2023-23752", "https://github.com/0xWhoami35/Devvorte-Writeup", "https://github.com/20142995/Goby", "https://github.com/20142995/pocsuite3", "https://github.com/ARPSyndicate/cvemon", "https://github.com/ARPSyndicate/kenzer-templates", "https://github.com/ATIGNONWilliam/-Joomla-v4.2.8---Divulgation-d-informations-non-authentifi-es", "https://github.com/Acceis/exploit-CVE-2023-23752", "https://github.com/AkbarWiraN/Joomla-Scanner", "https://github.com/AlissoftCodes/CVE-2023-23752", "https://github.com/AlissonFaoli/CVE-2023-23752", "https://github.com/Anekant-Singhai/Exploits", "https://github.com/Archan6el/Devvortex-Writeup", "https://github.com/Archan6el/Devvortex-Writeup-HackTheBox", "https://github.com/BearClaw96/Joomla-v4.x-Unauthenticated-information-disclosure", "https://github.com/BugBlocker/lotus-scripts", "https://github.com/C1ph3rX13/CVE-2023-23752", "https://github.com/CVEDB/PoC-List", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/Fernando-olv/Joomla-CVE-2023-23752", "https://github.com/Ge-Per/Scanner-CVE-2023-23752", "https://github.com/Gerxnox/One-Liner-Collections", "https://github.com/GhostToKnow/CVE-2023-23752", "https://github.com/H454NSec/CVE-2023-23752", "https://github.com/Henry4E36/POCS", "https://github.com/Jenderal92/Joomla-CVE-2023-23752", "https://github.com/JeneralMotors/CVE-2023-23752", "https://github.com/JohnDoeAnonITA/CVE-2023-23752", "https://github.com/K3ysTr0K3R/CVE-2023-23752-EXPLOIT", "https://github.com/K3ysTr0K3R/K3ysTr0K3R", "https://github.com/KayCHENvip/vulnerability-poc", "https://github.com/Ly0kha/Joomla-CVE-2023-23752-Exploit-Script", "https://github.com/Marco-zcl/POC", "https://github.com/MrP4nda1337/CVE-2023-23752", "https://github.com/Ostorlab/KEV", "https://github.com/Pari-Malam/CVE-2023-23752", "https://github.com/Pari-Malam/DorkerW-CVE-2023-23752", "https://github.com/Pushkarup/CVE-2023-23752", "https://github.com/Rival420/CVE-2023-23752", "https://github.com/RootKRD/CVE-2023", "https://github.com/Saboor-Hakimi/CVE-2023-23752", "https://github.com/SrcVme50/Devvortex", "https://github.com/Sweelg/CVE-2023-23752", "https://github.com/ThatNotEasy/CVE-2023-23752", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/CVE", "https://github.com/Threekiii/Vulhub-Reproduce", "https://github.com/TindalyTn/CVE-2023-23752", "https://github.com/Vulnmachines/joomla_CVE-2023-23752", "https://github.com/WhiteOwl-Pub/CVE-2023-23752", "https://github.com/WhiteOwl-Pub/Joomla-PoC-CVE-2023-23752", "https://github.com/XRSec/AWVS-Update", "https://github.com/Youns92/Joomla-v4.2.8---CVE-2023-23752", "https://github.com/YusinoMy/CVE-2023-23752", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/adhikara13/CVE-2023-23752", "https://github.com/adriyansyah-mf/CVE-2023-23752", "https://github.com/aliestercrowleymv/CVE-2023-23752-Vulnerability-Scanner", "https://github.com/bakery312/Vulhub-Reproduce", "https://github.com/cybernetwiz/CVE-2023-23752", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/dravenww/curated-article", "https://github.com/equationsoftworks/Radiance", "https://github.com/fardeen-ahmed/Bug-bounty-Writeups", "https://github.com/gh1mau/nse", "https://github.com/gibran-abdillah/CVE-2023-23752", "https://github.com/gunzf0x/CVE-2023-23752", "https://github.com/hadrian3689/CVE-2023-23752_Joomla", "https://github.com/haxor1337x/Mass-Checker-CVE-2023-23752", "https://github.com/hktalent/TOP", "https://github.com/ibaiw/joomla_CVE-2023-23752", "https://github.com/ifacker/CVE-2023-23752-Joomla", "https://github.com/imnewbie1/JoomlaDB", "https://github.com/izj007/wechat", "https://github.com/k0valskia/CVE-2023-23752", "https://github.com/k8gege/Ladon", "https://github.com/karthikuj/CVE-2023-23752-Docker", "https://github.com/keyuan15/CVE-2023-23752", "https://github.com/lainonz/CVE-2023-23752", "https://github.com/luck-ying/Goby2.0-POC", "https://github.com/luck-ying/Library-POC", "https://github.com/malionnn/-Joomla-v4.2.8---Divulgation-d-informations-non-authentifi-es", "https://github.com/mariovata/CVE-2023-23752-Python", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/nu0y4/HScan", "https://github.com/r3dston3/CVE-2023-23752", "https://github.com/raystr-atearedteam/CVE2023-23752", "https://github.com/shellvik/CVE-2023-23752", "https://github.com/soryecker/HScan", "https://github.com/sponkmonk/Ladon_english_update", "https://github.com/svaltheim/CVE-2023-23752", "https://github.com/sw0rd1ight/CVE-2023-23752", "https://github.com/thecybertix/One-Liner-Collections", "https://github.com/trganda/dockerv", "https://github.com/txuswashere/OSCP", "https://github.com/wangking1/CVE-2023-23752-poc", "https://github.com/whoami13apt/files2", "https://github.com/wibuheker/Joomla-CVE-2023-23752", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-", "https://github.com/yTxZx/CVE-2023-23752", "https://github.com/yusinomy/CVE-2023-23752", "https://github.com/z3n70/CVE-2023-23752"]}, {"cve": "CVE-2023-51395", "desc": "The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48913", "desc": "Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete.", "poc": ["https://github.com/Tiamat-ron/cms/blob/main/The%20deletion%20function%20of%20the%20Article%20Management%20Office%20exists%20in%20CSRF.md"]}, {"cve": "CVE-2023-46574", "desc": "An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.", "poc": ["https://github.com/OraclePi/repo/blob/main/totolink%20A3700R/1/A3700R%20%20V9.1.2u.6165_20211012%20vuln.md", "https://github.com/Marco-zcl/POC", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-"]}, {"cve": "CVE-2023-46001", "desc": "Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/isom_read.c:2807:51 function in gf_isom_get_user_data.", "poc": ["https://github.com/gpac/gpac/issues/2629"]}, {"cve": "CVE-2023-38889", "desc": "An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4001", "desc": "An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the \"/boot/\" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0081", "desc": "The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/76d2963c-ebff-498f-9484-3c3008750c14"]}, {"cve": "CVE-2023-51501", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Uncode - Creative & WooCommerce WordPress Theme: from n/a through 2.8.6.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3906", "desc": "An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5408", "desc": "A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36434", "desc": "Windows IIS Server Elevation of Privilege Vulnerability", "poc": ["https://github.com/netlas-io/netlas-dorks", "https://github.com/netlas-io/netlas-scripts"]}, {"cve": "CVE-2023-3377", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection.This issue affects Veribase: through 20231123.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38829", "desc": "An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management interface.", "poc": ["https://github.com/adhikara13/CVE-2023-38829-NETIS-WF2409E", "https://github.com/Luwak-IoT-Security/CVEs", "https://github.com/adhikara13/CVE-2023-38829-NETIS-WF2409E", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1648", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-0326. Reason: This candidate is a duplicate of CVE-2023-0326. Notes: All CVE users should reference CVE-2023-0326 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/388132"]}, {"cve": "CVE-2023-0732", "desc": "A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is the function registration of the file oews/classes/Users.php of the component POST Request Handler. The manipulation of the argument firstname/middlename/lastname/email/contact leads to cross site scripting. The attack can be launched remotely. The identifier VDB-220369 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.220369", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Vinalti/cve-badge.li"]}, {"cve": "CVE-2023-3981", "desc": "Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.", "poc": ["https://huntr.dev/bounties/f5018226-0063-415d-9675-d7e30934ff78"]}, {"cve": "CVE-2023-27292", "desc": "An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters.", "poc": ["https://www.tenable.com/security/research/tra-2023-8", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-29580", "desc": "yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.", "poc": ["https://github.com/yasm/yasm/issues/215", "https://github.com/z1r00/fuzz_vuln/blob/main/yasm/segv/yasm_expr_create/readmd.md", "https://github.com/z1r00/fuzz_vuln"]}, {"cve": "CVE-2023-1486", "desc": "A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54. This vulnerability affects the function 0x220004 in the library WiseUnlock64.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223372.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1486", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/2023iThome", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-47271", "desc": "PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.", "poc": ["http://packetstormsecurity.com/files/176255/PKP-WAL-3.4.0-3-Remote-Code-Execution.html", "http://seclists.org/fulldisclosure/2023/Dec/23"]}, {"cve": "CVE-2023-5210", "desc": "The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/1c3ff47a-12a5-49c1-a166-2c57e5c0d0aa"]}, {"cve": "CVE-2023-31714", "desc": "Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.", "poc": ["https://www.exploit-db.com/exploits/51383", "https://github.com/msd0pe-1/CVE-2023-31714", "https://github.com/msd0pe-1/chitor-sqli", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-50861", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY \u2013 Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY \u2013 Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20771", "desc": "In display, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07671046; Issue ID: ALPS07671046.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24368", "desc": "** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/mrojz/T24"]}, {"cve": "CVE-2023-38565", "desc": "A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to gain root privileges.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-0764", "desc": "The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription vulnerability. The attacker must have at least the privileges of the Author role.", "poc": ["https://wpscan.com/vulnerability/d48c6c50-3734-4191-9833-0d9b09b1bd8a"]}, {"cve": "CVE-2023-46641", "desc": "Server-Side Request Forgery (SSRF) vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.24.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1776", "desc": "Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-36540", "desc": "Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44154", "desc": "Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23005", "desc": "** DISPUTED ** In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1496", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.", "poc": ["https://huntr.dev/bounties/de603972-935a-401a-96fb-17ddadd282b2"]}, {"cve": "CVE-2023-38337", "desc": "rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6421", "desc": "The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.", "poc": ["https://wpscan.com/vulnerability/244c7c00-fc8d-4a73-bbe0-7865c621d410"]}, {"cve": "CVE-2023-43240", "desc": "D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter.", "poc": ["https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/ipportFilter/1.md"]}, {"cve": "CVE-2023-4850", "desc": "A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=dashboard/position/del. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239259.", "poc": ["https://vuldb.com/?id.239259"]}, {"cve": "CVE-2023-24249", "desc": "An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.", "poc": ["https://flyd.uk/post/cve-2023-24249/"]}, {"cve": "CVE-2023-33901", "desc": "In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45605", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Christopher Finke Feed Statistics plugin <=\u00a04.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0341", "desc": "A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.", "poc": ["https://litios.github.io/2023/01/14/CVE-2023-0341.html"]}, {"cve": "CVE-2023-5045", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL Injection, Command Line Execution through SQL Injection.This issue affects Kayisi: before 1286.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46766", "desc": "Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44338", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3528", "desc": "A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument cat_id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-233252.", "poc": ["https://vuldb.com/?id.233252", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48395", "desc": "Kaifa Technology WebITR is an online attendance system, it has insufficient validation for user input within a special function. A remote attacker with regular user privilege can exploit this vulnerability to inject arbitrary SQL commands to read database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33903", "desc": "In FM service, there is a possible missing params check. This could lead to local denial of service with System execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5808", "desc": "SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would normally be barred to that specific administrative role.", "poc": ["https://github.com/Arszilla/CVE-2023-5808", "https://github.com/Arszilla/CVE-2023-6538", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30186", "desc": "A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.", "poc": ["https://github.com/merrychap/POC-onlyoffice"]}, {"cve": "CVE-2023-4007", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.", "poc": ["https://huntr.dev/bounties/e891dcbc-2092-49d3-9518-23e37187a5ea"]}, {"cve": "CVE-2023-3559", "desc": "A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability is an unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233353 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.233353"]}, {"cve": "CVE-2023-29915", "desc": "H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/HJBc2lyl2"]}, {"cve": "CVE-2023-23169", "desc": "Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal.", "poc": ["https://github.com/S4nshine/CVE-2023-23169", "https://github.com/S4nshine/CVE-2023-23169", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-21674", "desc": "Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/hd3s5aa/CVE-2023-21674", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/santosomar/kev_checker", "https://github.com/xaitax/cisa-catalog-known-vulnerabilities"]}, {"cve": "CVE-2023-3313", "desc": "An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed an unauthorized user to execute system command injection for the purpose of privilege escalation or to execute arbitrary commands.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10403"]}, {"cve": "CVE-2023-25000", "desc": "HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.", "poc": ["https://github.com/wavefnx/shamirs"]}, {"cve": "CVE-2023-37207", "desc": "A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1816287"]}, {"cve": "CVE-2023-0552", "desc": "The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability", "poc": ["https://wpscan.com/vulnerability/832c6155-a413-4641-849c-b98ba55e8551"]}, {"cve": "CVE-2023-44356", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34616", "desc": "An issue was discovered pbjson thru 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.", "poc": ["https://github.com/InductiveComputerScience/pbJson/issues/2"]}, {"cve": "CVE-2023-24685", "desc": "ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module.", "poc": ["http://packetstormsecurity.com/files/172047/ChurchCRM-4.5.3-SQL-Injection.html", "https://github.com/blakduk/Advisories/blob/main/ChurchCRM/README.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/blakduk/Advisories"]}, {"cve": "CVE-2023-32410", "desc": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may be able to leak sensitive kernel state.", "poc": ["https://github.com/p1ay8y3ar/crashdatas"]}, {"cve": "CVE-2023-37861", "desc": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a certificate to the device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31943", "desc": "SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the ticket_id parameter at ticket_detail.php.", "poc": ["https://github.com/DiliLearngent/BugReport"]}, {"cve": "CVE-2023-28872", "desc": "Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%\\Temp\\NcpSupport* location.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0006/"]}, {"cve": "CVE-2023-34320", "desc": "Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412where software, under certain circumstances, could deadlock a coredue to the execution of either a load to device or non-cacheable memory,and either a store exclusive or register read of the PhysicalAddress Register (PAR_EL1) in close proximity.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31983", "desc": "A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the mp function in /bin/webs without any limitations.", "poc": ["https://github.com/Erebua/CVE/blob/main/N300_BR-6428nS%20V4/2/Readme.md"]}, {"cve": "CVE-2023-5540", "desc": "A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.", "poc": ["https://github.com/cli-ish/cli-ish", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5155", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows SQL Injection.This issue affects SoliPay Mobile App: before 5.0.8.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44337", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4253", "desc": "The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/1cbbab9e-be3d-4081-bc0e-c52d500d9871", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6273", "desc": "Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerability may cause features to perform abnormally.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29535", "desc": "Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.", "poc": ["https://github.com/googleprojectzero/fuzzilli", "https://github.com/zhangjiahui-buaa/MasterThesis"]}, {"cve": "CVE-2023-33657", "desc": "A use-after-free vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_mqtt_msg_get_publish_property() in the file mqtt_msg.c. This vulnerability is caused by improper data tracing, and an attacker could exploit it to cause a denial of service attack.", "poc": ["https://github.com/emqx/nanomq/issues/1165#issue-1668648319"]}, {"cve": "CVE-2023-28077", "desc": "Dell BSAFE SSL-J, versions prior to 6.5, and versions 7.0 and 7.1 contain a debug message revealing unnecessary information vulnerability. This may lead to disclosing sensitive information to a locally privileged user.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38701", "desc": "Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the `commit` validator, where they remain until they are either collected into the `head` validator or the protocol initialisation is aborted and the value in the committed UTxOs is returned to the users who committed them. Prior to version 0.12.0, the `commit` validator contains a flawed check when the `ViaAbort` redeemer is used, which allows any user to spend any UTxO which is at the validator arbitrarily, meaning an attacker can steal the funds that users are trying to commit into the head validator. The intended behavior is that the funds must be returned to the user which committed the funds and can only be performed by a participant of the head. The `initial` validator also is similarly affected as the same flawed check is performed for the `ViaAbort` redeemer. Due to this issue, an attacker can steal any funds that user's try to commit into a Hydra head. Also, an attacker can prevent any Hydra head from being successfully opened. It does not allow an attacker to take funds which have been successfully collected into and currently reside in the `head` validator. Version 0.12.0 contains a fix for this issue.", "poc": ["https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0120---2023-08-18", "https://github.com/input-output-hk/hydra/security/advisories/GHSA-6x9v-7x5r-w8w6"]}, {"cve": "CVE-2023-21987", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html", "https://github.com/AtonceInventions/Hypervisor"]}, {"cve": "CVE-2023-6383", "desc": "The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data", "poc": ["https://wpscan.com/vulnerability/eae63103-3de6-4100-8f48-2bcf9a5c91fb", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5325", "desc": "The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS", "poc": ["https://wpscan.com/vulnerability/e93841ef-e113-41d3-9fa1-b21af85bd812"]}, {"cve": "CVE-2023-46021", "desc": "SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary commands via the 'reqid' parameter.", "poc": ["https://github.com/ersinerenler/CVE-2023-46021-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability", "https://github.com/ersinerenler/CVE-2023-46021-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability", "https://github.com/ersinerenler/Code-Projects-Blood-Bank-1.0", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-49044", "desc": "Stack Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the ssid parameter in the function form_fast_setting_wifi_set.", "poc": ["https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/form_fast_setting_wifi_set.md"]}, {"cve": "CVE-2023-5961", "desc": "A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.", "poc": ["https://github.com/HadessCS/CVE-2023-5961", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2546", "desc": "The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication checking in the 'wpus_allow_user_to_admin_bar_menu' function with the 'wpus_who_switch' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have access to the username.", "poc": ["https://github.com/LUUANHDUC/KhaiThacLoHongPhanMem", "https://github.com/hung1111234/KhaiThacLoHongPhanMem"]}, {"cve": "CVE-2023-31725", "desc": "yasm 1.3.0.55.g101bc was discovered to contain a heap-use-after-free via the function expand_mmac_params at yasm/modules/preprocs/nasm/nasm-pp.c.", "poc": ["https://github.com/DaisyPo/fuzzing-vulncollect/tree/main/yasm/heap-use-after-free/nasm-pp.c:3878%20in%20expand_mmac_params", "https://github.com/yasm/yasm/issues/221"]}, {"cve": "CVE-2023-28310", "desc": "Microsoft Exchange Server Remote Code Execution Vulnerability", "poc": ["https://github.com/gobysec/Vulnerability-Alert", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/wh-gov/cve-2023-28310"]}, {"cve": "CVE-2023-49000", "desc": "An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the com.artis.browser.IntentReceiverActivity component.", "poc": ["https://github.com/actuator/com.artis.browser/blob/main/CWE-94.md", "https://github.com/actuator/com.artis.browser", "https://github.com/actuator/cve", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5971", "desc": "The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/03a201d2-535e-4574-afac-791dcf23e6e1/"]}, {"cve": "CVE-2023-5474", "desc": "Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5470", "desc": "The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29084", "desc": "Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.", "poc": ["http://packetstormsecurity.com/files/172755/ManageEngine-ADManager-Plus-Command-Injection.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ohnonoyesyes/CVE-2023-29084", "https://github.com/xu-xiang/awesome-security-vul-llm"]}, {"cve": "CVE-2023-20819", "desc": "In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: MOLY01068234; Issue ID: ALPS08010003.", "poc": ["https://github.com/N3vv/N3vv"]}, {"cve": "CVE-2023-30084", "desc": "An issue found in libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the stackVal function in util/decompile.c.", "poc": ["https://github.com/libming/libming/issues/268"]}, {"cve": "CVE-2023-1712", "desc": "Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.", "poc": ["https://huntr.dev/bounties/9a6b1fb4-ec9b-4cfa-af1e-9ce304924829"]}, {"cve": "CVE-2023-40762", "desc": "User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37581", "desc": "Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature.", "poc": ["http://seclists.org/fulldisclosure/2023/Jul/43"]}, {"cve": "CVE-2023-42861", "desc": "A logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. An attacker with knowledge of a standard user's credentials can unlock another standard user's locked screen on the same Mac.", "poc": ["https://github.com/fractal-visi0n/security-assessement"]}, {"cve": "CVE-2023-46805", "desc": "An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.", "poc": ["http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html", "https://github.com/20142995/sectool", "https://github.com/Chocapikk/CVE-2023-46805", "https://github.com/H4lo/awesome-IoT-security-article", "https://github.com/HiS3/Ivanti-ICT-Snapshot-decryption", "https://github.com/Ostorlab/KEV", "https://github.com/TheRedDevil1/Check-Vulns-Script", "https://github.com/cbeek-r7/CVE-2023-46805", "https://github.com/duy-31/CVE-2023-46805_CVE-2024-21887", "https://github.com/emo-crab/attackerkb-api-rs", "https://github.com/farukokutan/Threat-Intelligence-Research-Reports", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/inguardians/ivanti-VPN-issues-2024-research", "https://github.com/jake-44/Research", "https://github.com/jamesfed/0DayMitigations", "https://github.com/jaredfolkins/5min-cyber-notes", "https://github.com/mickdec/CVE-2023-46805_CVE-2024-21887_scan_grouped", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887", "https://github.com/rxwx/pulse-meter", "https://github.com/seajaysec/Ivanti-Connect-Around-Scan", "https://github.com/stephen-murcott/Ivanti-ICT-Snapshot-decryption", "https://github.com/tanjiti/sec_profile", "https://github.com/toxyl/lscve", "https://github.com/w2xim3/CVE-2023-46805", "https://github.com/yoryio/CVE-2023-46805", "https://github.com/zwxxb/CVE-2023-21887"]}, {"cve": "CVE-2023-22518", "desc": "All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to\u00a0Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.\u00a0Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.", "poc": ["http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html", "https://github.com/0x00sector/CVE_2023_22518_Checker", "https://github.com/0x0d3ad/CVE-2023-22518", "https://github.com/C1ph3rX13/CVE-2023-22518", "https://github.com/ForceFledgling/CVE-2023-22518", "https://github.com/Lilly-dox/Exploit-CVE-2023-22518", "https://github.com/Marco-zcl/POC", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/RevoltSecurities/CVE-2023-22518", "https://github.com/Threekiii/CVE", "https://github.com/altima/awesome-stars", "https://github.com/bibo318/CVE-2023-22518", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/davidfortytwo/CVE-2023-22518", "https://github.com/ditekshen/ansible-cve-2023-22518", "https://github.com/duggytuxy/malicious_ip_addresses", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sanjai-AK47/CVE-2023-22518", "https://github.com/securitycipher/daily-bugbounty-writeups", "https://github.com/tanjiti/sec_profile", "https://github.com/thecybertix/One-Liner-Collections", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-"]}, {"cve": "CVE-2023-42822", "desc": "xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/seyrenus/trace-release"]}, {"cve": "CVE-2023-49079", "desc": "Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1.", "poc": ["https://github.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgc"]}, {"cve": "CVE-2023-31132", "desc": "Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP files in a web document directory. The user can then execute the PHP files under the security context of SYSTEM. This allows an attacker to escalate privilege from a normal user account to SYSTEM. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-rf5w-pq3f-9876"]}, {"cve": "CVE-2023-51806", "desc": "File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.", "poc": ["https://github.com/ujcms/ujcms/issues/8"]}, {"cve": "CVE-2023-1221", "desc": "Insufficient policy enforcement in Extensions API in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-21909", "desc": "Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework). Supported versions that are affected are 23.3 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-5154", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-8000 up to 20151231 and classified as critical. This vulnerability affects unknown code of the file /sysmanage/changelogo.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-240250 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.", "poc": ["https://github.com/tanjiti/sec_profile", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC"]}, {"cve": "CVE-2023-49970", "desc": "Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?action=save_ticket.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49970", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6741", "desc": "The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.", "poc": ["https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a/"]}, {"cve": "CVE-2023-1742", "desc": "A vulnerability was found in IBOS 4.5.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /?r=report/api/getlist of the component Report Search. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-224630 is the identifier assigned to this vulnerability.", "poc": ["https://gitee.com/wkstestete/cve/blob/master/sql/ibos%20sql%20injection3.md"]}, {"cve": "CVE-2023-51068", "desc": "An authenticated reflected cross-site scripting (XSS) vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 allows attackers to execute arbitrary javascript on a victim's browser via a crafted link.", "poc": ["https://github.com/Oracle-Security/CVEs/blob/main/QStar%20Archive%20Solutions/CVE-2023-51068.md"]}, {"cve": "CVE-2023-37151", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-2246. Reason: This candidate is a reservation duplicate of CVE-2023-2246. Notes: All CVE users should reference CVE-2023-2246 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.", "poc": ["https://www.exploit-db.com/exploits/51431"]}, {"cve": "CVE-2023-52450", "desc": "In the Linux kernel, the following vulnerability has been resolved:perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()Get logical socket id instead of physical id in discover_upi_topology()to avoid out-of-bound access on 'upi = &type->topology[nid][idx];' linethat leads to NULL pointer dereference in upi_fill_topology()", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29478", "desc": "BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem. This includes the Minecraft mods folder, which results in code execution.", "poc": ["https://github.com/Exopteron/BiblioRCE", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Exopteron/BiblioRCE", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0005", "desc": "A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.", "poc": ["https://security.paloaltonetworks.com/CVE-2023-0005"]}, {"cve": "CVE-2023-6140", "desc": "The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.", "poc": ["https://wpscan.com/vulnerability/c837eaf3-fafd-45a2-8f5e-03afb28a765b"]}, {"cve": "CVE-2023-34868", "desc": "Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start at jerry-core/parser/js/js-parser-statm.c.", "poc": ["https://github.com/jerryscript-project/jerryscript/issues/5083"]}, {"cve": "CVE-2023-45688", "desc": "Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp \"SIZE\" command", "poc": ["https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/"]}, {"cve": "CVE-2023-24527", "desc": "SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability and integrity.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-49987", "desc": "A cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tname parameter.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49987", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2684", "desc": "The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/42b1f017-c497-4825-b12a-8dce3e108a55"]}, {"cve": "CVE-2023-24394", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy iframe popup plugin <=\u00a03.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38059", "desc": "The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3772", "desc": "A flaw was found in the Linux kernel\u2019s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.", "poc": ["http://www.openwall.com/lists/oss-security/2023/08/10/1", "https://bugzilla.redhat.com/show_bug.cgi?id=2218943"]}, {"cve": "CVE-2023-2004", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://bugzilla.redhat.com/show_bug.cgi?id=2186428"]}, {"cve": "CVE-2023-43872", "desc": "A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).", "poc": ["https://github.com/sromanhu/CMSmadesimple-File-Upload--XSS---File-Manager", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43872-CMSmadesimple-Arbitrary-File-Upload--XSS---File-Manager"]}, {"cve": "CVE-2023-33716", "desc": "mp4v2 v2.1.3 was discovered to contain a memory leak via the class MP4StringProperty at mp4property.cpp.", "poc": ["https://github.com/enzo1982/mp4v2/issues/36"]}, {"cve": "CVE-2023-41915", "desc": "OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.", "poc": ["https://github.com/EGI-Federation/SVG-advisories"]}, {"cve": "CVE-2023-2943", "desc": "Code Injection in GitHub repository openemr/openemr prior to 7.0.1.", "poc": ["https://huntr.dev/bounties/4190f944-dc2c-4624-9abf-31479456faa9"]}, {"cve": "CVE-2023-4119", "desc": "A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The manipulation of the argument query/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-235966 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/173941/Academy-LMS-6.0-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-0930", "desc": "Heap buffer overflow in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-38709", "desc": "Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.This issue affects Apache HTTP Server: through 2.4.58.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52729", "desc": "TCPServer.cpp in SimpleNetwork through 29bc615 has an off-by-one error that causes a buffer overflow when trying to add '\\0' to the end of long msg data. It can be exploited via crafted TCP packets.", "poc": ["https://github.com/Halcy0nic/Trophies"]}, {"cve": "CVE-2023-6814", "desc": "Insertion of Sensitive Information into Log File vulnerability in Hitachi Cosminexus Component Container allows local users to gain sensitive information.This issue affects Cosminexus Component Container: from 11-30 before 11-30-05, from 11-20 before 11-20-07, from 11-10 before 11-10-10, from 11-00 before 11-00-12, All versions of V8 and V9.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1108", "desc": "A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/muneebaashiq/MBProjects"]}, {"cve": "CVE-2023-35818", "desc": "An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit another behavior in the chip to gain unauthorized access to the ROM download mode. Access to ROM download mode may be further exploited to read the encrypted flash content in cleartext format or execute stub code.", "poc": ["https://espressif.com"]}, {"cve": "CVE-2023-51399", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget allows Stored XSS.This issue affects Back Button Widget: from n/a through 1.6.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2924", "desc": "A vulnerability, which was classified as critical, has been found in Supcon SimField up to 1.80.00.00. Affected by this issue is some unknown functionality of the file /admin/reportupload.aspx. The manipulation of the argument files[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230078 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/RCEraser/cve/blob/main/SimField.md"]}, {"cve": "CVE-2023-31137", "desc": "MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.", "poc": ["https://github.com/samboy/MaraDNS/security/advisories/GHSA-58m7-826v-9c3c"]}, {"cve": "CVE-2023-24782", "desc": "Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.", "poc": ["https://github.com/funadmin/funadmin/issues/3"]}, {"cve": "CVE-2023-27843", "desc": "SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct component.", "poc": ["https://friends-of-presta.github.io/security-advisories/modules/2023/04/25/askforaquote.html"]}, {"cve": "CVE-2023-3501", "desc": "The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/d3fb4a2b-ed51-4654-b7c1-4b0f59cd1ecf", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49082", "desc": "aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.", "poc": ["https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b", "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-qvrw-v9rv-5rjx"]}, {"cve": "CVE-2023-36822", "desc": "Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. Before a plugin is downloaded, the plugin installation directory is checked for existence. If it exists, it's removed before the plugin installation. Because the plugin is not validated against the official list of plugins or sanitized, the check for existence and the removal of the plugin installation directory are prone to path traversal. This vulnerability allows an authenticated attacker to delete files from the server Uptime Kuma is running on. Depending on which files are deleted, Uptime Kuma or the whole system may become unavailable due to data loss.", "poc": ["https://github.com/louislam/uptime-kuma/security/advisories/GHSA-vr8x-74pm-6vj7"]}, {"cve": "CVE-2023-36319", "desc": "File Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute arbitrary code via the action parameter of the compress-inc.php file.", "poc": ["https://github.com/Lowalu/CVE-2023-36319", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-24721", "desc": "A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.", "poc": ["https://github.com/marcovntr/CVE/blob/main/2023/CVE-2023-24721/CVE-2023-24721.md"]}, {"cve": "CVE-2023-31546", "desc": "Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ran9ege/CVE-2023-31546"]}, {"cve": "CVE-2023-1258", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footprinting.This issue affects Flow-X: before 4.0.", "poc": ["http://packetstormsecurity.com/files/173610/ABB-FlowX-4.00-Information-Disclosure.html"]}, {"cve": "CVE-2023-43826", "desc": "Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.Users are recommended to upgrade to version 1.5.4, which fixes this issue.", "poc": ["https://github.com/elttam/publications"]}, {"cve": "CVE-2023-1875", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/39715aaf-e798-4c60-97c4-45f4f2cd5c61", "https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-24212", "desc": "Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the timeType function at /goform/SetSysTimeCfg.", "poc": ["https://github.com/Venus-WQLab/bug_report/blob/main/Tenda/CVE-2023-24212.md", "https://github.com/w0x68y/cve-lists/blob/main/Tenda/vuln/readme.md"]}, {"cve": "CVE-2023-37436", "desc": "Multiple vulnerabilities in the web-based management\u00a0interface of EdgeConnect SD-WAN Orchestrator could allow\u00a0an authenticated remote attacker to conduct SQL injection\u00a0attacks against the EdgeConnect SD-WAN Orchestrator\u00a0instance. An attacker could exploit these vulnerabilities to\u00a0 \u00a0 obtain and modify sensitive information in the underlying\u00a0database potentially leading to the exposure and corruption\u00a0of sensitive data controlled by the EdgeConnect SD-WAN\u00a0Orchestrator host.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49684", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0927", "desc": "Use after free in Web Payments API in Google Chrome on Android prior to 110.0.5481.177 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-29323", "desc": "ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection from a local, scoped IPv6 address.", "poc": ["https://github.com/bioly230/THM_Skynet"]}, {"cve": "CVE-2023-25740", "desc": "After downloading a Windows
*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-45847", "desc": "Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24269", "desc": "An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file.", "poc": ["https://github.com/s4n-h4xor/CVE-Publications/blob/main/CVE-2023-24269/CVE-2023-24269.md"]}, {"cve": "CVE-2023-26954", "desc": "onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.", "poc": ["https://github.com/keheying/onekeyadmin/issues/11"]}, {"cve": "CVE-2023-25734", "desc": "After downloading a Windows
*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1809923", "https://bugzilla.mozilla.org/show_bug.cgi?id=1810143"]}, {"cve": "CVE-2023-27100", "desc": "Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.", "poc": ["http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html", "https://github.com/DarokNET/CVE-2023-27100", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27119", "desc": "WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.", "poc": ["https://github.com/WebAssembly/wabt/issues/1990"]}, {"cve": "CVE-2023-31698", "desc": "** DISPUTED ** Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).", "poc": ["http://packetstormsecurity.com/files/172462/Bludit-CMS-3.14.1-Cross-Site-Scripting.html", "https://github.com/bludit/bludit/issues/1369#issuecomment-940806199", "https://github.com/bludit/bludit/issues/1509"]}, {"cve": "CVE-2023-1091", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpata Licensed Warehousing Automation System allows Command Line Execution through SQL Injection.This issue affects Licensed Warehousing Automation System: through 2023.1.01.", "poc": ["https://github.com/karimhabush/cyberowl", "https://github.com/kolewttd/wtt"]}, {"cve": "CVE-2023-49897", "desc": "An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.", "poc": ["https://github.com/Ostorlab/KEV"]}, {"cve": "CVE-2023-27890", "desc": "** UNSUPPORTED WHEN ASSIGNED ** The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["http://packetstormsecurity.com/files/171421/MyBB-Export-User-2.0-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-36243", "desc": "FLVMeta v1.2.1 was discovered to contain a buffer overflow via the xml_on_metadata_tag_only function at dump_xml.c.", "poc": ["https://github.com/noirotm/flvmeta/issues/19"]}, {"cve": "CVE-2023-31061", "desc": "Repetier Server through 1.4.10 does not have CSRF protection.", "poc": ["https://cybir.com/2023/cve/poc-repetier-server-140/"]}, {"cve": "CVE-2023-44091", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.\u00a0This ulnerability allowed SQL injections to be made even if authentication failed.This issue affects Pandora FMS: from 700 through <776.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-0982", "desc": "A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Add Class Entry. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-221677 was assigned to this vulnerability.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-4869", "desc": "A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file update.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-239354 is the identifier assigned to this vulnerability.", "poc": ["https://skypoc.wordpress.com/2023/09/05/vuln1/"]}, {"cve": "CVE-2023-3887", "desc": "A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235249 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.235249"]}, {"cve": "CVE-2023-2770", "desc": "A vulnerability classified as critical was found in SourceCodester Online Exam System 1.0. This vulnerability affects unknown code of the file /kelasdosen/data. The manipulation of the argument columns[1][data] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229276.", "poc": ["https://github.com/tht1997/CVE_2023/blob/main/online_exam/kelasdosen.md", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-4314", "desc": "The wpDataTables WordPress plugin before 2.1.66 does not validate the \"Serialized PHP array\" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.", "poc": ["https://wpscan.com/vulnerability/1ab192d7-72ac-4f12-8a51-f28ee4db91bc"]}, {"cve": "CVE-2023-0461", "desc": "There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS\u00a0or CONFIG_XFRM_ESPINTCP\u00a0has to be configured, but the operation does not require any privilege.There is a use-after-free bug of icsk_ulp_data\u00a0of a struct inet_connection_sock.When CONFIG_TLS\u00a0is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.The setsockopt\u00a0TCP_ULP\u00a0operation does not require any privilege.We recommend upgrading past commit\u00a02c02d41d71f90a5168391b6a5f2954112ba2307c", "poc": ["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2c02d41d71f90a5168391b6a5f2954112ba2307c", "https://github.com/ARPSyndicate/cvemon", "https://github.com/EGI-Federation/SVG-advisories", "https://github.com/borzakovskiy/CoolSols", "https://github.com/c0debatya/CoolSols", "https://github.com/hheeyywweellccoommee/linux-4.19.72_CVE-2023-0461-ycnbd", "https://github.com/hshivhare67/kernel_v4.19.72_CVE-2023-0461", "https://github.com/nidhi7598/linux-4.19.72_CVE-2023-0461", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rockrid3r/CoolSols", "https://github.com/sysca11/CoolSols", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-1390", "desc": "A remote denial of service vulnerability was found in the Linux kernel\u2019s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.", "poc": ["https://gist.github.com/netspooky/bee2d07022f6350bb88eaa48e571d9b5"]}, {"cve": "CVE-2023-27532", "desc": "Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/fardeen-ahmed/Bug-bounty-Writeups", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hktalent/TOP", "https://github.com/horizon3ai/CVE-2023-27532", "https://github.com/karimhabush/cyberowl", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sfewer-r7/CVE-2023-27532"]}, {"cve": "CVE-2023-51026", "desc": "TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the \u2018hour\u2019 parameter of the setRebootScheCfg interface of the cstecgi .cgi.", "poc": ["https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setRebootScheCfg-hour/"]}, {"cve": "CVE-2023-39981", "desc": "A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authentication measures, potentially leading to the disclosure of device information by a remote attacker.", "poc": ["https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3445", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.", "poc": ["https://huntr.dev/bounties/18a74a9d-4a2d-4bf8-ae62-56a909427070"]}, {"cve": "CVE-2023-21145", "desc": "In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/nidhi7598/frameworks_base_AOSP_10_r33_CVE-2023-21145"]}, {"cve": "CVE-2023-20116", "desc": "A vulnerability in the Administrative XML Web Service (AXL) API of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\nThis vulnerability is due to insufficient validation of user-supplied input to the web UI of the Self Care Portal. An attacker could exploit this vulnerability by sending crafted HTTP input to an affected device. A successful exploit could allow the attacker to cause a DoS condition on the affected device.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-dos-4Ag3yWbD"]}, {"cve": "CVE-2023-2817", "desc": "A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.", "poc": ["https://www.tenable.com/security/research/tra-2023-20,"]}, {"cve": "CVE-2023-21902", "desc": "Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Application). The supported version that is affected is 8.0.8.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Financial Services Behavior Detection Platform accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-6082", "desc": "The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/c3d43aac-66c8-4218-b3f0-5256f895eda3/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25653", "desc": "node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default \"fallback\" crypto back-end, ECC operations in `node-jose` can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input. The issue has been patched in version 2.2.0. Since this issue is only present in the \"fallback\" crypto implementation, it can be avoided by ensuring that either WebCrypto or the Node `crypto` module is available in the JS environment where `node-jose` is being run.", "poc": ["https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-0277", "desc": "The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/69ffb2f1-b291-49bf-80a8-08d03ceca53b"]}, {"cve": "CVE-2023-43201", "desc": "D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ext.asp function.", "poc": ["https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7200GV2/bug2.md"]}, {"cve": "CVE-2023-38865", "desc": "COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.", "poc": ["https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject5"]}, {"cve": "CVE-2023-6595", "desc": "In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sharmashreejaa/CVE-2023-6595"]}, {"cve": "CVE-2023-0063", "desc": "The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/2262f2fc-8122-46ed-8e67-8c34ee35fc97"]}, {"cve": "CVE-2023-47623", "desc": "Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the login page via the `redirect_uri` parameter. By specifying a url with the javascript scheme (`javascript:`), an attacker can run arbitrary JavaScript code after the login.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-218_GHSL-2023-219_scrypted/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21938", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/runner361/CVE-List"]}, {"cve": "CVE-2023-25113", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_l2tp function with the key variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-43790", "desc": "iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22884", "desc": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.", "poc": ["https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/jakabakos/CVE-2023-22884-Airflow-SQLi", "https://github.com/kohnakagawa/kohnakagawa", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1668", "desc": "A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40758", "desc": "User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6941", "desc": "The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).", "poc": ["https://wpscan.com/vulnerability/58f7c9aa-5e59-468f-aba9-b15e7942fd37/"]}, {"cve": "CVE-2023-46755", "desc": "Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerability may cause the launcher to restart.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24181", "desc": "LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.", "poc": ["https://github.com/ABB-EL/external-vulnerability-disclosures/security/advisories/GHSA-9gqg-pp5p-q9hg"]}, {"cve": "CVE-2023-45889", "desc": "A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.8 allows remote attackers to inject JavaScript into any webpage. NOTE: this issue exists because of an incomplete fix for CVE-2022-48612.", "poc": ["https://blog.zerdle.net/classlink/", "https://blog.zerdle.net/classlink2/"]}, {"cve": "CVE-2023-29696", "desc": "H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function version_set.", "poc": ["https://github.com/Stevenbaga/fengsha/blob/main/H3C/GR-1200W/aVersionSet.md"]}, {"cve": "CVE-2023-6811", "desc": "The Language Translate Widget for WordPress \u2013 ConveyThis plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key\u2019 parameter in all versions up to, and including, 223 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41822", "desc": "An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36753", "desc": "A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The uninstall-app App-name parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.", "poc": ["https://github.com/sudo-jtcsec/CVE"]}, {"cve": "CVE-2023-40753", "desc": "There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6574", "desc": "A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php of the component HTTP POST Request Handler. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247154 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-42802", "desc": "GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server.", "poc": ["https://github.com/NH-RED-TEAM/GLPI-PoC"]}, {"cve": "CVE-2023-4596", "desc": "The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.", "poc": ["https://www.exploit-db.com/exploits/51664", "https://github.com/AlabamicHero/caldera_sandcat-usecase", "https://github.com/E1A/CVE-2023-4596", "https://github.com/LUUANHDUC/KhaiThacLoHongPhanMem", "https://github.com/devmehedi101/bugbounty-CVE-Report", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/getdrive/PoC", "https://github.com/hung1111234/KhaiThacLoHongPhanMem", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/securi3ytalent/bugbounty-CVE-Report"]}, {"cve": "CVE-2023-21611", "desc": "Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-6019", "desc": "A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023", "poc": ["https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe", "https://github.com/Clydeston/CVE-2023-6019", "https://github.com/FireWolfWang/CVE-2023-6019", "https://github.com/miguelc49/CVE-2023-6019-1", "https://github.com/miguelc49/CVE-2023-6019-2", "https://github.com/miguelc49/CVE-2023-6019-3", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-33763", "desc": "eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/index.php.", "poc": ["https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33763", "https://github.com/rauschecker/CVEs"]}, {"cve": "CVE-2023-21144", "desc": "In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-252766417", "poc": ["https://github.com/hshivhare67/Framework_base_AOSP10_r33_CVE-2023-21144", "https://github.com/hshivhare67/Framework_base_AOSP10_r33_CVE-2023-21144_new", "https://github.com/hshivhare67/Framework_base_AOSP10_r33_CVE-2023-21144_old", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26557", "desc": "io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. (bnb-chain/tss-lib and thorchain/tss are also affected.)", "poc": ["https://medium.com/@iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b"]}, {"cve": "CVE-2023-43356", "desc": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component.", "poc": ["https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings"]}, {"cve": "CVE-2023-24033", "desc": "The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly check format types specified by the Session Description Protocol (SDP) module, which can lead to a denial of service.", "poc": ["http://packetstormsecurity.com/files/172137/Shannon-Baseband-accept-type-SDP-Attribute-Memory-Corruption.html"]}, {"cve": "CVE-2023-2610", "desc": "Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.", "poc": ["https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d"]}, {"cve": "CVE-2023-27830", "desc": "TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted files when executing a file transfer. This is due to the fact that TightVNC runs in the backend as a high-privileges account.", "poc": ["https://medium.com/nestedif/vulnerability-disclosure-privilege-escalation-tightvnc-8165208cce"]}, {"cve": "CVE-2023-40277", "desc": "An issue was discovered in OpenClinic GA 5.247.01. A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in the login.jsp message parameter.", "poc": ["https://github.com/BugBountyHunterCVE/CVE-2023-40277", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31300", "desc": "An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via transmission of unencrypted, cleartext credentials during Password Reset feature.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0057/"]}, {"cve": "CVE-2023-1542", "desc": "Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.", "poc": ["https://huntr.dev/bounties/d947417c-5a12-407a-9a2f-fa696f65126f"]}, {"cve": "CVE-2023-7081", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHS\u0130L Online Payment System allows SQL Injection.This issue affects Online Payment System: before 14.02.2024.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1719", "desc": "Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.", "poc": ["https://starlabs.sg/advisories/23/23-1719/", "https://github.com/20142995/sectool"]}, {"cve": "CVE-2023-26458", "desc": "An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.The disclosed information is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-43871", "desc": "A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).", "poc": ["https://github.com/sromanhu/CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media/blob/main/README.md", "https://github.com/sromanhu/WBCE-File-Upload--XSS---Media/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media"]}, {"cve": "CVE-2023-34434", "desc": "Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.\u00a0The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .", "poc": ["http://seclists.org/fulldisclosure/2023/Jul/43"]}, {"cve": "CVE-2023-38434", "desc": "xHTTP 72f812d has a double free in close_connection in xhttp.c via a malformed HTTP request method.", "poc": ["https://github.com/cozis/xHTTP/issues/1", "https://github.com/Halcy0nic/CVE-2023-38434", "https://github.com/Halcy0nic/Trophies", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/skinnyrad/Trophies"]}, {"cve": "CVE-2023-23560", "desc": "In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Threekiii/CVE"]}, {"cve": "CVE-2023-46866", "desc": "In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-of-bounds indexes.", "poc": ["https://github.com/InternationalColorConsortium/DemoIccMAX/issues/54", "https://github.com/InternationalColorConsortium/DemoIccMAX/pull/53", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/xsscx/DemoIccMAX", "https://github.com/xsscx/xnuimagefuzzer"]}, {"cve": "CVE-2023-5235", "desc": "The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'users_can_register' and 'default_role'. It also unserializes user input in the process, which may lead to Object Injection attacks.", "poc": ["https://wpscan.com/vulnerability/35c9a954-37fc-4818-a71f-34aaaa0fa3db"]}, {"cve": "CVE-2023-1443", "desc": "A vulnerability was found in Filseclab Twister Antivirus 8. It has been declared as problematic. This vulnerability affects the function 0x80112053 in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223288.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1443", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-5090", "desc": "A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47038", "desc": "A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/bartvoet/assignment-ehb-security-review-adamlenez", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/raylivesun/pldo", "https://github.com/raylivesun/ploa"]}, {"cve": "CVE-2023-39184", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1408", "desc": "The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/baf7ef4d-b2ba-48e0-9c17-74fa27e0c15b"]}, {"cve": "CVE-2023-44031", "desc": "Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows attackers to arbitrarily save sensitive files in insecure locations via a crafted POST request.", "poc": ["http://seclists.org/fulldisclosure/2024/Jan/43", "https://packetstormsecurity.com/files/176841/Reprise-License-Manager-15.1-Privilege-Escalation-File-Write.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32725", "desc": "The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.", "poc": ["https://github.com/SAP/cloud-active-defense", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-49985", "desc": "A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cname parameter.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49985", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-25033", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Sumo Social Share Boost plugin <=\u00a04.5 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0368", "desc": "The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/b41e5c09-1034-48a7-ac0f-d4db6e7a3b3e"]}, {"cve": "CVE-2023-31902", "desc": "RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).", "poc": ["https://www.exploit-db.com/exploits/51010", "https://www.redpacketsecurity.com/mobile-mouse-code-execution/", "https://github.com/DevAkabari/Mobile-Mouse-3.6.0.4-RCE", "https://github.com/blue0x1/mobilemouse-exploit"]}, {"cve": "CVE-2023-37770", "desc": "faust commit ee39a19 was discovered to contain a stack overflow via the component boxppShared::print() at /boxes/ppbox.cpp.", "poc": ["https://github.com/grame-cncm/faust/issues/922"]}, {"cve": "CVE-2023-36619", "desc": "Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.", "poc": ["https://packetstormsecurity.com/files/174704/Atos-Unify-OpenScape-Code-Execution-Missing-Authentication.html", "https://sec-consult.com/vulnerability-lab/advisory/authenticated-remote-code-execution-missing-authentication-atos-unify-openscape/"]}, {"cve": "CVE-2023-27943", "desc": "This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Files downloaded from the internet may not have the quarantine flag applied.", "poc": ["https://github.com/houjingyi233/macOS-iOS-system-security"]}, {"cve": "CVE-2023-36266", "desc": "** DISPUTED ** An issue was discovered in Keeper Password Manager for Desktop version 16.10.2, and the KeeperFill Browser Extensions version 16.5.4, allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information).", "poc": ["http://packetstormsecurity.com/files/173809/Keeper-Security-Desktop-16.10.2-Browser-Extension-16.5.4-Password-Dumper.html", "https://github.com/H4rk3nz0/Peeper", "https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2023-38960", "desc": "Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via crafted executable running from the installation directory.", "poc": ["https://rodelllemit.medium.com/insecure-permissions-vulnerability-in-raidenftpd-v2-4-build-4005-2016-04-01-ea7389be3d33", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31445", "desc": "Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnerability that allows read-only users have the ability to enumerate all other users and discover e-mail addresses, phone numbers, and privileges of all other users.", "poc": ["https://blog.kscsc.online/cves/202331445/md.html", "https://github.com/Dodge-MPTC/CVE-2023-31445-Unprivileged-Information-Disclosure", "https://www.swiruhack.online/cves/202331445/md.html", "https://github.com/Dodge-MPTC/CVE-2023-31445-Unprivileged-Information-Disclosure", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26106", "desc": "All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-DOTLENS-3227646"]}, {"cve": "CVE-2023-22060", "desc": "Vulnerability in the Oracle Hyperion Workspace product of Oracle Hyperion (component: UI and Visualization). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Workspace. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Workspace accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Workspace accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Workspace. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-25083", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the firewall_handler_set function with the ip and mac variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-29089", "desc": "An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding SIP multipart messages.", "poc": ["http://packetstormsecurity.com/files/172292/Shannon-Baseband-Negative-Size-Memcpy-Out-Of-Bounds-Read.html"]}, {"cve": "CVE-2023-24349", "desc": "D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetRoute.", "poc": ["https://github.com/1160300418/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/04"]}, {"cve": "CVE-2023-0434", "desc": "Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.", "poc": ["https://huntr.dev/bounties/7d9332d8-6997-483b-9fb9-bcf2ae01dad4"]}, {"cve": "CVE-2023-21971", "desc": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors as well as unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html", "https://www.oracle.com/security-alerts/cpujul2023.html", "https://github.com/Avento/CVE-2023-21971_Analysis", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-29483", "desc": "eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a \"TuDoor\" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.", "poc": ["https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0106", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.", "poc": ["https://huntr.dev/bounties/5c0809cb-f4ff-4447-bed6-b5625fb374bb"]}, {"cve": "CVE-2023-45008", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <=\u00a01.0.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36010", "desc": "Microsoft Defender Denial of Service Vulnerability", "poc": ["https://github.com/myseq/ms_patch_tuesday"]}, {"cve": "CVE-2023-4230", "desc": "A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulnerability may enable attackers to gather information for the purpose of assessing vulnerabilities and potential attack vectors.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3683", "desc": "A vulnerability has been found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /items/search. The manipulation of the argument search_term leads to cross site scripting. The attack can be launched remotely. The identifier VDB-234229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20046", "desc": "A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device.\nThis vulnerability is due to insufficient validation of user-supplied credentials. An attacker could exploit this vulnerability by sending a valid low-privileged SSH key to an affected device from a host that has an IP address that is configured as the source for a high-privileged user account. A successful exploit could allow the attacker to log in to the affected device through SSH as a high-privileged user.\nThere are workarounds that address this vulnerability.", "poc": ["https://github.com/orangecertcc/security-research/security/advisories/GHSA-j7p3-gjw6-pp4r", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-ssh-privesc-BmWeJC3h"]}, {"cve": "CVE-2023-52536", "desc": "In faceid service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51098", "desc": "Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .", "poc": ["https://github.com/GD008/TENDA/blob/main/W9/W9_setDiagnoseInfo/W9_setDiagnoseInfo.md"]}, {"cve": "CVE-2023-39264", "desc": "By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users.\u00a0This vulnerability exists in Apache Superset versions up to and including 2.1.0.", "poc": ["https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-32490", "desc": "Dell PowerScale OneFS 8.2x -9.5x contains an improper privilege management vulnerability. A high privilege local attacker could potentially exploit this vulnerability, leading to system takeover.", "poc": ["https://www.dell.com/support/kbdoc/en-us/000216717/dsa-2023-269-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"]}, {"cve": "CVE-2023-0496", "desc": "The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/451b47d5-7bd2-4a82-9c8e-fe6601bcd2ab"]}, {"cve": "CVE-2023-34371", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <=\u00a02.22 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-45862", "desc": "An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.5"]}, {"cve": "CVE-2023-21896", "desc": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-48963", "desc": "Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/wifiSSIDget.", "poc": ["https://github.com/daodaoshao/vul_tenda_i6_1"]}, {"cve": "CVE-2023-0299", "desc": "Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.", "poc": ["https://huntr.dev/bounties/0049774b-1857-46dc-a834-f1fb15138c53"]}, {"cve": "CVE-2023-4415", "desc": "A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/sys/login. The manipulation leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-237518 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/20142995/sectool", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/thedarknessdied/CVE-2023-4169_CVE-2023-3306_CVE-2023-4415", "https://github.com/thedarknessdied/Ruijie_RG-EW1200G_login_bypass-CVE-2023-4415"]}, {"cve": "CVE-2023-4141", "desc": "The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39511", "desc": "Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `reports_admin.php` displays reporting information about graphs, devices, data sources etc. _CENSUS_ found that an adversary that is able to configure a malicious device name, related to a graph attached to a report, can deploy a stored XSS attack against any super user who has privileges of viewing the `reports_admin.php` page, such as administrative accounts. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http:///cacti/host.php`, while the rendered malicious payload is exhibited at `http:///cacti/reports_admin.php` when the a graph with the maliciously altered device name is linked to the report. This issue has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should manually filter HTML output.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-5hpr-4hhc-8q42"]}, {"cve": "CVE-2023-33725", "desc": "Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.6.1-GA.", "poc": ["https://github.com/Contrast-Security-OSS/Burptrast", "https://github.com/demomm/burptrast"]}, {"cve": "CVE-2023-35357", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/174116/Microsoft-Windows-Kernel-Unsafe-Reference.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31292", "desc": "An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive information and bypass authentication via \"Back Button Refresh\" attack.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0051/"]}, {"cve": "CVE-2023-5535", "desc": "Use After Free in GitHub repository vim/vim prior to v9.0.2010.", "poc": ["https://github.com/vim/vim/commit/41e6f7d6ba67b61d911f9b1d76325cd79224753d", "https://huntr.dev/bounties/2c2d85a7-1171-4014-bf7f-a2451745861f"]}, {"cve": "CVE-2023-0361", "desc": "A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/GitHubForSnap/ssmtp-gael", "https://github.com/alexcowperthwaite/PasskeyScanner"]}, {"cve": "CVE-2023-49983", "desc": "A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49983", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-41963", "desc": "Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34037", "desc": "VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/grampae/VMSA-2023-0017"]}, {"cve": "CVE-2023-27390", "desc": "A heap-based buffer overflow vulnerability exists in the Sequence::DrawText functionality of Diagon v1.0.139. A specially crafted markdown file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1744", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1744"]}, {"cve": "CVE-2023-5142", "desc": "A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.240238", "https://github.com/kuangxiaotu/CVE-H3C-Report", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yinsel/CVE-H3C-Report"]}, {"cve": "CVE-2023-26115", "desc": "All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.", "poc": ["https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657", "https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973", "https://github.com/git-kick/ioBroker.e3dc-rscp", "https://github.com/martinjackson/simple-widgets", "https://github.com/seal-community/patches", "https://github.com/sebhildebrandt/word-wrap-next"]}, {"cve": "CVE-2023-34666", "desc": "Cross-site scripting (XSS) vulnerability in Phpgurukul Cyber Cafe Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the admin username parameter.", "poc": ["https://www.exploit-db.com/exploits/49204"]}, {"cve": "CVE-2023-20775", "desc": "In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07978760; Issue ID: ALPS07363410.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23301", "desc": "The `news` MonkeyC operation code in CIQ API version 1.0.0 through 4.1.7 fails to check that string resources are not extending past the end of the expected sections. A malicious CIQ application could craft a string that starts near the end of a section, and whose length extends past its end. Upon loading the string, the GarminOS TVM component may read out-of-bounds memory.", "poc": ["https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23301.md"]}, {"cve": "CVE-2023-0702", "desc": "Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-30184", "desc": "A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter at /index.php/archives/1/comment.", "poc": ["https://github.com/typecho/typecho/issues/1546"]}, {"cve": "CVE-2023-40160", "desc": "Directory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a remote attacker may obtain arbitrary files on the server.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33991", "desc": "SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerability. After successful exploitation, an attacker with user level access can cause high impact on confidentiality, modify some information and can cause unavailability of the application at user level.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-1092", "desc": "The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7", "https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09c", "https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31b", "https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fb"]}, {"cve": "CVE-2023-34548", "desc": "Simple Customer Relationship Management 1.0 is vulnerable to SQL Injection via the email parameter.", "poc": ["https://github.com/nu11secur1ty/CVE-nu11secur1ty"]}, {"cve": "CVE-2023-33359", "desc": "Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the \"add tags\" function.", "poc": ["https://github.com/Piwigo/Piwigo/issues/1908"]}, {"cve": "CVE-2023-28617", "desc": "org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44262", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Renzo Johnson Blocks plugin <=\u00a01.6.41 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6675", "desc": "Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows Upload a Web Shell to a Web Server.This issue affects CyberMath: from v.1.4 before v.1.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3922", "desc": "An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29374", "desc": "In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.", "poc": ["https://github.com/hwchase17/langchain/issues/1026", "https://github.com/cckuailong/awesome-gpt-security", "https://github.com/corca-ai/awesome-llm-security", "https://github.com/zgimszhd61/llm-security-quickstart"]}, {"cve": "CVE-2023-23454", "desc": "cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).", "poc": ["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12", "https://github.com/ARPSyndicate/cvemon", "https://github.com/alopresto/epss_api_demo", "https://github.com/alopresto6m/epss_api_demo"]}, {"cve": "CVE-2023-47727", "desc": "IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.20.0 could allow an authenticated user to modify dashboard parameters due to improper input validation. IBM X-Force ID: 272089.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21817", "desc": "Windows Kerberos Elevation of Privilege Vulnerability", "poc": ["https://github.com/0xsyr0/OSCP", "https://github.com/ARPSyndicate/cvemon", "https://github.com/SirElmard/ethical_hacking", "https://github.com/kgwanjala/oscp-cheatsheet", "https://github.com/oscpname/OSCP_cheat", "https://github.com/revanmalang/OSCP", "https://github.com/txuswashere/OSCP", "https://github.com/xhref/OSCP"]}, {"cve": "CVE-2023-48013", "desc": "GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core/filter.c.", "poc": ["https://github.com/gpac/gpac/issues/2612"]}, {"cve": "CVE-2023-37827", "desc": "A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the executionBlockName parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4409", "desc": "A vulnerability, which was classified as critical, has been found in NBS&HappySoftWeChat 1.1.6. Affected by this issue is some unknown functionality. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237512.", "poc": ["https://vuldb.com/?id.237512", "https://github.com/ApricityXX/cve"]}, {"cve": "CVE-2023-1554", "desc": "The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/0d247a3d-154e-4da7-a147-c1c7e1b5e87e", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-43196", "desc": "D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn_jb parameter in the arp_sys.asp function.", "poc": ["https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7200GV2/bug4.md"]}, {"cve": "CVE-2023-5653", "desc": "The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins", "poc": ["https://wpscan.com/vulnerability/76316621-1987-44ea-83e5-6ca884bdd1c0"]}, {"cve": "CVE-2023-2406", "desc": "The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments \u2013 Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita"]}, {"cve": "CVE-2023-1988", "desc": "A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/?page=maintenance/brand. The manipulation of the argument Brand Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225536.", "poc": ["https://vuldb.com/?id.225536"]}, {"cve": "CVE-2023-3143", "desc": "A vulnerability classified as problematic has been found in SourceCodester Online Discussion Forum Site 1.0. Affected is an unknown function of the file admin\\posts\\manage_post.php. The manipulation of the argument content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231012.", "poc": ["https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#11xss-vulnerability-in-adminpostsmanage_postphpcontent"]}, {"cve": "CVE-2023-26921", "desc": "OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.", "poc": ["https://github.com/closethe/AG550QCN_CommandInjection_ql_atfwd/blob/main/README.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/closethe/AG550QCN_CommandInjection_ql_atfwd"]}, {"cve": "CVE-2023-47321", "desc": "Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the \"Porlet Deployer\" which allows administrators to deploy .WAR portlets.", "poc": ["https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47321", "https://github.com/RhinoSecurityLabs/CVEs"]}, {"cve": "CVE-2023-31910", "desc": "Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component parser_parse_function_statement at /jerry-core/parser/js/js-parser-statm.c.", "poc": ["https://github.com/jerryscript-project/jerryscript/issues/5076", "https://github.com/EJueon/EJueon"]}, {"cve": "CVE-2023-22578", "desc": "Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-45139", "desc": "fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.", "poc": ["https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5"]}, {"cve": "CVE-2023-45279", "desc": "Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display.", "poc": ["https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"]}, {"cve": "CVE-2023-50307", "desc": "IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 273338.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23331", "desc": "Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.", "poc": ["https://0xhunter20.medium.com/how-i-found-my-first-blind-sql-injection-cve-2023-23331-aef103a7f73c", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-2160", "desc": "Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.", "poc": ["https://huntr.dev/bounties/54fb6d6a-6b39-45b6-b62a-930260ba484b", "https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-41775", "desc": "Improper access control vulnerability in 'direct' Desktop App for macOS ver 2.6.0 and earlier allows a local attacker to bypass access restriction and to use camrea, microphone, etc. of the device where the product is installed without the user's consent.", "poc": ["https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-29455", "desc": "Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35937", "desc": "Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can be updated as space administrators. Version 2.10.2 LTS has a patch for this issue.", "poc": ["https://github.com/metersphere/metersphere/security/advisories/GHSA-7xj3-qrx5-524r"]}, {"cve": "CVE-2023-40889", "desc": "A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.", "poc": ["https://hackmd.io/@cspl/B1ZkFZv23", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5412", "desc": "The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "poc": ["https://github.com/RandomRobbieBF/CVE-2023-5412", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0122", "desc": "A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4.", "poc": ["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=da0342a3aa0357795224e6283df86444e1117168"]}, {"cve": "CVE-2023-4870", "desc": "A vulnerability classified as problematic has been found in SourceCodester Contact Manager App 1.0. This affects an unknown part of the file index.php of the component Contact Information Handler. The manipulation of the argument contactID with the input \"> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239355.", "poc": ["https://skypoc.wordpress.com/2023/09/05/vuln1/"]}, {"cve": "CVE-2023-42568", "desc": "Improper access control vulnerability in SmartManagerCN prior to SMR Dec-2023 Release 1 allows local attackers to access arbitrary files with system privilege.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52191", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Torbjon Infogram \u2013 Add charts, maps and infographics allows Stored XSS.This issue affects Infogram \u2013 Add charts, maps and infographics: from n/a through 1.6.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23852", "desc": "SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-23916", "desc": "An allocation of resources without limits or throttling vulnerability exists in curl setTitle` on line #245 in the `week.php` file, as happens in version 1.22.12.5783.", "poc": ["https://github.com/indevi0us/indevi0us"]}, {"cve": "CVE-2023-5287", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in BEECMS 4.0. This affects an unknown part of the file /admin/admin_content_tag.php?action=save_content. The manipulation of the argument tag leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240915. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://vuldb.com/?id.240915", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24411", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kerry Kline BNE Testimonials plugin <= 2.0.7 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-1780", "desc": "The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/8176308f-f210-4109-9c88-9372415dbed3"]}, {"cve": "CVE-2023-6063", "desc": "The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.", "poc": ["https://wpscan.com/vulnerability/30a74105-8ade-4198-abe2-1c6f2967443e", "https://github.com/hackersroot/CVE-2023-6063-PoC", "https://github.com/motikan2010/CVE-2023-6063-PoC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/securi3ytalent/wordpress-exploit", "https://github.com/thesafdari/CVE-2023-6063"]}, {"cve": "CVE-2023-3397", "desc": "A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7021", "desc": "A vulnerability was found in Tongda OA 2017 up to 11.9. It has been classified as critical. Affected is an unknown function of the file general/vehicle/checkup/delete_search.php. The manipulation of the argument VU_ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248568. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/qq956801985/cve/blob/main/sql.md"]}, {"cve": "CVE-2023-42509", "desc": "JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49913", "desc": "A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `action` parameter at offset `0x422448` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40954", "desc": "A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.", "poc": ["https://github.com/luvsn/OdZoo/tree/main/exploits/web_progress"]}, {"cve": "CVE-2023-29581", "desc": "** DISPUTED ** yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could become unavailable if this were exploited, the vendor's position is that there is no security relevance because there is either supposed to be input validation before data reaches libyasm, or a sandbox in which the application runs.", "poc": ["https://github.com/yasm/yasm/issues/216", "https://github.com/z1r00/fuzz_vuln/blob/main/yasm/segv/delete_Token/readme.md", "https://github.com/NaInSec/CVE-LIST", "https://github.com/z1r00/fuzz_vuln"]}, {"cve": "CVE-2023-22609", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none", "poc": ["https://github.com/13579and2468/Wei-fuzz"]}, {"cve": "CVE-2023-4429", "desc": "Use after free in Loader in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4755", "desc": "Use After Free in GitHub repository gpac/gpac prior to 2.3-DEV.", "poc": ["https://huntr.dev/bounties/463474b7-a4e8-42b6-8b30-e648a77ee6b3"]}, {"cve": "CVE-2023-37864", "desc": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges\u00a0may use an a special SNMP request to gain full access to the device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2902", "desc": "A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /SystemManage/Organize/GetTreeGridJson?_search=false&nd=1681813520783&rows=10000&page=1&sidx=&sord=asc. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229976. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/The%20NFine%20rapid%20development%20platform%20Organize-GetTreeGridJson%20has%20unauthorized%20access%20vulnerability.md", "https://vuldb.com/?id.229976"]}, {"cve": "CVE-2023-40661", "desc": "Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB device or smart card to manipulate responses to APDUs. This manipulation can potentially allow \ncompromise key generation, certificate loading, and other card management operations during enrollment.", "poc": ["https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651"]}, {"cve": "CVE-2023-43999", "desc": "An issue in COLORFUL_laundry mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5712", "desc": "The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4459", "desc": "A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48025", "desc": "Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned get_length(lisp_cell_t * x) at eval.c", "poc": ["https://github.com/Halcy0nic/Trophies", "https://github.com/skinnyrad/Trophies"]}, {"cve": "CVE-2023-3229", "desc": "Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.", "poc": ["https://huntr.dev/bounties/31f48ca1-e5e8-436f-b779-cad597759170"]}, {"cve": "CVE-2023-26077", "desc": "Atera Agent through 1.8.3.6 on Windows Creates a Temporary File in a Directory with Insecure Permissions.", "poc": ["https://github.com/vulerols/msiner"]}, {"cve": "CVE-2023-4494", "desc": "Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file asking for the name via a GET request resulting in arbitrary code execution on the remote machine.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46857", "desc": "Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for exploitation.", "poc": ["https://census-labs.com/news/2023/11/08/weak-svg-asset-filtering-mechanism-in-squidex-cms/"]}, {"cve": "CVE-2023-38353", "desc": "MiniTool Power Data Recovery version 11.6 and before contains an insecure in-app payment system that allows attackers to steal highly sensitive information through a man in the middle attack.", "poc": ["https://0dr3f.github.io/cve/"]}, {"cve": "CVE-2023-45675", "desc": "stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\\0';`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to `setup_malloc`. The `setup_malloc` behaves differently when `f->alloc.alloc_buffer` is pre-allocated. Instead of returning `NULL` as in `malloc` case it shifts the pre-allocated buffer by zero and returns the currently available memory block. This issue may lead to code execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4521", "desc": "The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue (https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42) and not deleting the created files when releasing the new version.", "poc": ["https://wpscan.com/vulnerability/de2cdb38-3a9f-448e-b564-a798d1e93481"]}, {"cve": "CVE-2023-5249", "desc": "Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper memory processing operations to exploit a software race condition. If the system\u2019s memory is carefully prepared by the user, then this in turn cause a use-after-free.This issue affects Bifrost GPU Kernel Driver: from r35p0 through r40p0; Valhall GPU Kernel Driver: from r35p0 through r40p0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37265", "desc": "CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.", "poc": ["https://github.com/komodoooo/Some-things"]}, {"cve": "CVE-2023-0572", "desc": "Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-4739", "desc": "A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238628. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Meizhi-hua/cve/blob/main/upload_file.md"]}, {"cve": "CVE-2023-49743", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Dashboard Widgets Suite allows Stored XSS.This issue affects Dashboard Widgets Suite: from n/a through 3.4.1.", "poc": ["https://github.com/rach1tarora/rach1tarora"]}, {"cve": "CVE-2023-29400", "desc": "Templates containing actions in unquoted HTML attributes (e.g. \"attr={{.}}\") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.", "poc": ["https://github.com/nao1215/golling"]}, {"cve": "CVE-2023-31594", "desc": "IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network.", "poc": ["https://github.com/Yozarseef95/CVE-2023-31594", "https://github.com/Yozarseef95/CVE-2023-31594", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30737", "desc": "Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via implicit intent.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49132", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38888", "desc": "Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.", "poc": ["https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38888_Dolibarr_XSS.pdf"]}, {"cve": "CVE-2023-34102", "desc": "Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.", "poc": ["https://github.com/avo-hq/avo/security/advisories/GHSA-86h2-2g4g-29qx"]}, {"cve": "CVE-2023-25367", "desc": "Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution (RCE) with SCPI interface or web server.", "poc": ["https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25367.md", "https://github.com/BretMcDanel/CVE"]}, {"cve": "CVE-2023-0788", "desc": "Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-27078", "desc": "A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted request to the tftp endpoint.", "poc": ["https://github.com/B2eFly/Router/blob/main/TPLINK/MR3020/1.md"]}, {"cve": "CVE-2023-39325", "desc": "A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.", "poc": ["https://go.dev/issue/63417", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/knabben/dos-poc", "https://github.com/latchset/tang-operator"]}, {"cve": "CVE-2023-39909", "desc": "Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application.", "poc": ["https://www.gruppotim.it/it/footer/red-team.html"]}, {"cve": "CVE-2023-4712", "desc": "A vulnerability, which was classified as critical, was found in Xintian Smart Table Integrated Management System 5.6.9. This affects an unknown part of the file /SysManage/AddUpdateRole.aspx. The manipulation of the argument txtRoleName leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238575. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/wpay65249519/cve/blob/main/SQL_injection.md"]}, {"cve": "CVE-2023-3551", "desc": "Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.", "poc": ["https://huntr.dev/bounties/cf8878ff-6cd9-49be-b313-7ac2a94fc7f7", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2137", "desc": "Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-33782", "desc": "D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.", "poc": ["https://github.com/s0tr/CVE-2023-33782", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/s0tr/CVE-2023-33782"]}, {"cve": "CVE-2023-25281", "desc": "A stack overflow vulnerability exists in pingV4Msg component in D-Link DIR820LA1_FW105B03, allows attackers to cause a denial of service via the nextPage parameter to ping.ccp.", "poc": ["https://github.com/migraine-sudo/D_Link_Vuln/tree/main/stackoverflow%20cancelPing"]}, {"cve": "CVE-2023-47627", "desc": "aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.", "poc": ["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg"]}, {"cve": "CVE-2023-4853", "desc": "A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.", "poc": ["https://github.com/RHEcosystemAppEng/ONguard", "https://github.com/oleg-nenashev/gradle-quarkus-plugin-demo"]}, {"cve": "CVE-2023-25793", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <=\u00a02.0.2 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/yaudahbanh/CVE-Archive"]}, {"cve": "CVE-2023-3716", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Online Collection Software allows SQL Injection.This issue affects Online Collection Software: before 1.0.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3692", "desc": "Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.", "poc": ["https://huntr.dev/bounties/be6616eb-384d-40d6-b1fd-0ec9e4973f12"]}, {"cve": "CVE-2023-2531", "desc": "Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.", "poc": ["https://huntr.dev/bounties/20463eb2-0f9d-4ea3-a2c8-93f80e7aca02"]}, {"cve": "CVE-2023-2102", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.", "poc": ["https://huntr.dev/bounties/dd7c04a7-a984-4387-9ac4-24596e7ece44"]}, {"cve": "CVE-2023-21538", "desc": ".NET Denial of Service Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-28131", "desc": "A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the \"Expo AuthSession Redirect Proxy\" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc).", "poc": ["https://www.darkreading.com/endpoint/oauth-flaw-in-expo-platform-affects-hundreds-of-third-party-sites-apps"]}, {"cve": "CVE-2023-34152", "desc": "A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.", "poc": ["https://github.com/ImageMagick/ImageMagick/issues/6339", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/overgrowncarrot1/ImageTragick_CVE-2023-34152"]}, {"cve": "CVE-2023-52337", "desc": "An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations.\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28596", "desc": "Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-31419", "desc": "A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.", "poc": ["https://www.elastic.co/community/security", "https://github.com/muneebaashiq/MBProjects", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419", "https://github.com/u238/Elasticsearch-CVE-2023-31419"]}, {"cve": "CVE-2023-7128", "desc": "A vulnerability, which was classified as critical, has been found in code-projects Voting System 1.0. This issue affects some unknown processing of the file /admin/ of the component Admin Login. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249131.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/Voting_System/Voting_System-SQL_Injection-1.md", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-47067", "desc": "Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0823", "desc": "The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/83f23a9f-9ace-47d2-a5f3-a4915129b16c"]}, {"cve": "CVE-2023-30951", "desc": "The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE).", "poc": ["https://palantir.safebase.us/?tcuUid=fe021f28-9e25-42c4-acd8-772cd8006ced"]}, {"cve": "CVE-2023-4522", "desc": "An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26433", "desc": "When adding an external mail account, processing of IMAP \"capabilities\" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted IMAP server response to reasonable length/size. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html"]}, {"cve": "CVE-2023-3128", "desc": "Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.", "poc": ["https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp", "https://github.com/Threekiii/CVE", "https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-43131", "desc": "General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow.", "poc": ["https://www.exploit-db.com/exploits/51641"]}, {"cve": "CVE-2023-2842", "desc": "The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/0357ecc7-56f5-4843-a928-bf2d3ce75596"]}, {"cve": "CVE-2023-3783", "desc": "A vulnerability was found in Webile 1.0.1. It has been classified as problematic. Affected is an unknown function of the component HTTP POST Request Handler. The manipulation of the argument new_file_name/c leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-235050 is the identifier assigned to this vulnerability.", "poc": ["https://seclists.org/fulldisclosure/2023/Jul/38", "https://www.vulnerability-lab.com/get_content.php?id=2321"]}, {"cve": "CVE-2023-43177", "desc": "CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.", "poc": ["https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/", "https://github.com/Mohammaddvd/CVE-2024-4040", "https://github.com/Ostorlab/KEV", "https://github.com/Y4tacker/JavaSec", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile", "https://github.com/the-emmons/CVE-2023-43177"]}, {"cve": "CVE-2023-5997", "desc": "Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51685", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LJ Apps WP Review Slider allows Stored XSS.This issue affects WP Review Slider: from n/a through 12.7.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40122", "desc": "In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51616", "desc": "D-Link DIR-X3260 prog.cgi SetSysEmailSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21593.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41948", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christoph Rado Cookie Notice & Consent plugin <=\u00a01.6.0 versions.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-34407", "desc": "OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\\ in a URL.", "poc": ["https://cybir.com/2023/cve/proof-of-concept-checkpoint-learning-harbinger-systems-offline-player-multiple-poc-for-cl-4-0-6-0-2-lfi-excessive-rights/"]}, {"cve": "CVE-2023-29345", "desc": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26035", "desc": "ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.", "poc": ["http://packetstormsecurity.com/files/175675/ZoneMinder-Snapshots-Command-Injection.html", "https://github.com/Faelian/zoneminder_CVE-2023-26035", "https://github.com/LucaLeukert/HTB-Surveillance", "https://github.com/Yuma-Tsushima07/CVE-2023-26035", "https://github.com/heapbytes/CVE-2023-26035", "https://github.com/m3m0o/zoneminder-snapshots-rce-poc", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rvizx/CVE-2023-26035", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-5992", "desc": "A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41867", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AcyMailing Newsletter Team AcyMailing plugin <=\u00a08.6.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21976", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-4508", "desc": "A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS-274X file.", "poc": ["https://github.com/gerbv/gerbv/commit/5517e22250e935dc7f86f64ad414aeae3dbcb36a", "https://github.com/gerbv/gerbv/commit/dfb5aac533a3f9e8ccd93ca217a753258cba4fe5", "https://github.com/gerbv/gerbv/issues/191"]}, {"cve": "CVE-2023-5796", "desc": "A vulnerability was found in CodeAstro POS System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /setting of the component Logo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-243602 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.243602"]}, {"cve": "CVE-2023-5607", "desc": "An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Interface. The import logic has been updated to restrict file types and content.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10411"]}, {"cve": "CVE-2023-38575", "desc": "Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43944", "desc": "A Stored Cross Site Scripting (XSS) vulnerability was found in SourceCodester Task Management System 1.0. It allows attackers to execute arbitrary code via parameter field in index.php?page=project_list.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1130", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file processlogin. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222105 was assigned to this vulnerability.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Zero-Yi7/Zero-Yi7"]}, {"cve": "CVE-2023-6023", "desc": "An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter.", "poc": ["https://huntr.com/bounties/644ab868-db6d-4685-ab35-1a897632d2ca"]}, {"cve": "CVE-2023-32832", "desc": "In video, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08235273; Issue ID: ALPS08235273.", "poc": ["http://packetstormsecurity.com/files/175662/Android-mtk_jpeg-Driver-Race-Condition-Privilege-Escalation.html"]}, {"cve": "CVE-2023-26842", "desc": "A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php.", "poc": ["https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26842", "https://github.com/10splayaSec/CVE-Disclosures"]}, {"cve": "CVE-2023-52372", "desc": "Vulnerability of input parameter verification in the motor module.Successful exploitation of this vulnerability may affect availability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25099", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_qos function with the dest variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-34571", "desc": "Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter shareSpeed at /goform/WifiGuestSet.", "poc": ["https://hackmd.io/@0dayResearch/S1GcUxzSn"]}, {"cve": "CVE-2023-2215", "desc": "A vulnerability classified as critical has been found in Campcodes Coffee Shop POS System 1.0. Affected is an unknown function of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226980.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zwxxb/CVE-2023-2215"]}, {"cve": "CVE-2023-38698", "desc": "Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function. The vulnerability resides `@ensdomains/ens-contracts` prior to version 0.0.22.If successfully exploited, this vulnerability would enable attackers to force the expiration of any ENS record, ultimately allowing them to claim the affected domains for themselves. Currently, it would require a malicious DAO to exploit it. Nevertheless, any vulnerability present in the controllers could potentially render this issue exploitable in the future. An additional concern is the possibility of renewal discounts. Should ENS decide to implement a system that offers unlimited .eth domains for a fixed fee in the future, the vulnerability could become exploitable by any user due to the reduced attack cost.Version 0.0.22 contains a patch for this issue. As long as registration cost remains linear or superlinear based on registration duration, or limited to a reasonable maximum (eg, 1 million years), this vulnerability could only be exploited by a malicious DAO. The interim workaround is thus to take no action.", "poc": ["https://github.com/ensdomains/ens-contracts/security/advisories/GHSA-rrxv-q8m4-wch3"]}, {"cve": "CVE-2023-4978", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.", "poc": ["https://huntr.dev/bounties/cefd9295-2053-4e6e-a130-7e1f845728f4"]}, {"cve": "CVE-2023-52215", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UkrSolution Simple Inventory Management \u2013 just scan barcode to manage products and orders. For WooCommerce.This issue affects Simple Inventory Management \u2013 just scan barcode to manage products and orders. For WooCommerce: from n/a through 1.5.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30347", "desc": "Cross Site Scripting (XSS) vulnerability in Neox Contact Center 2.3.9, via the serach_sms_api_name parameter to the SMA API search.", "poc": ["https://github.com/huzefa2212/CVE-2023-30347/blob/main/poc.txt", "https://github.com/huzefa2212/CVE-2023-30347", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-33066", "desc": "Memory corruption in Audio while processing RT proxy port register driver.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30795", "desc": "A vulnerability has been identified in JT Open (All versions < V11.4), JT Utilities (All versions < V13.4), Parasolid V34.0 (All versions < V34.0.253), Parasolid V34.1 (All versions < V34.1.243), Parasolid V35.0 (All versions < V35.0.177), Parasolid V35.1 (All versions < V35.1.073). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29497", "desc": "A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to access calendar data saved to a temporary directory.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29211", "desc": "XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.", "poc": ["https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4"]}, {"cve": "CVE-2023-39949", "desc": "eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure. This can remotely crash any Fast-DDS process. Versions 2.9.1 and 2.6.5 contain a patch for this issue.", "poc": ["https://github.com/eProsima/Fast-DDS/issues/3236", "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-3jv9-j9x3-95cg", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0376", "desc": "The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/b1aa6f32-c1d5-4fc6-9a4e-d4c5fae78389/"]}, {"cve": "CVE-2023-0526", "desc": "The Post Shortcode WordPress plugin through 2.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/0ec58310-243d-40c8-9fa6-8753947bfa89"]}, {"cve": "CVE-2023-34934", "desc": "A stack overflow in the Edit_BasicSSID_5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", "poc": ["https://github.com/h4kuy4/vuln/blob/main/H3C_B1STW/CVE-2023-34934.md"]}, {"cve": "CVE-2023-0178", "desc": "The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/cc308e15-7937-4d41-809d-74f8c13bee23"]}, {"cve": "CVE-2023-22743", "desc": "Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.", "poc": ["https://github.com/9069332997/session-1-full-stack", "https://github.com/ARPSyndicate/cvemon", "https://github.com/KK-Designs/UpdateHub"]}, {"cve": "CVE-2023-27379", "desc": "A use-after-free vulnerability exists in the JavaScript engine of Foxit Software\u2019s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1756"]}, {"cve": "CVE-2023-37625", "desc": "A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Link templates.", "poc": ["https://github.com/benjaminpsinclair/Netbox-CVE-2023-37625", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-41013", "desc": "Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the \"p4\" field.", "poc": ["https://medium.com/@katikitala.sushmitha078/cve-2023-41013-789841dcad91"]}, {"cve": "CVE-2023-34432", "desc": "A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37269", "desc": "Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting (XSS) attack. To exploit the vulnerability, an attacker would already need to have developer or super user level permissions in Winter CMS. This means they would already have extensive access and control within the system. Additionally, to execute the XSS, the attacker would need to convince the victim to directly visit the URL of the maliciously uploaded SVG, and the application would have to be using local storage where uploaded files are served under the same domain as the application itself instead of a CDN. This is because all SVGs in Winter CMS are rendered through an `img` tag, which prevents any payloads from being executed directly. These two factors significantly limit the potential harm of this vulnerability. This issue has been patched in v1.2.3 through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files. As a workaround, one may apply the patches manually.", "poc": ["http://packetstormsecurity.com/files/173520/WinterCMS-1.2.2-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34036", "desc": "Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server.For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded\u2026\u00a0headers.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38499", "desc": "TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem.", "poc": ["https://github.com/miguelc49/CVE-2023-38499-1", "https://github.com/miguelc49/CVE-2023-38499-2", "https://github.com/miguelc49/CVE-2023-38499-3", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2795", "desc": "The CodeColorer WordPress plugin before 0.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/2d6ecd21-3dd4-423d-80e7-277c45080a9f"]}, {"cve": "CVE-2023-46348", "desc": "SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookActionDispatcher and StUrls::getInstanceId methods.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22618", "desc": "If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46596", "desc": "Improper input validation in Algosec FireFlow VisualFlow workflow editor via Name, Description and Configuration File field in version A32.20, A32.50, A32.60 permits an attacker to initiate an XSS attack by injecting malicious executable scripts into the application's code. Fixed in version A32.20 (b600 and above), A32.50 (b430 and above), A32.60 (b250 and above)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38700", "desc": "matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Version 1.0.1n fixes this issue. As a workaround, set the `matrixHandler.eventCacheSize` config value to `0`. This workaround may impact performance.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0443", "desc": "The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked.", "poc": ["https://wpscan.com/vulnerability/471f3226-8f90-43d1-b826-f11ef4bbd602"]}, {"cve": "CVE-2023-7052", "desc": "A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been classified as problematic. This affects an unknown part of the file /user/profile.php. The manipulation of the argument name leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248739.", "poc": ["https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/csrf_profile_notes.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4698", "desc": "Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.", "poc": ["https://huntr.dev/bounties/e1107d79-1d63-4238-90b7-5cc150512654", "https://github.com/mnqazi/CVE-2023-4698", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-45573", "desc": "Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the n parameter of the mrclfile_del.asp function.", "poc": ["https://github.com/raulvillalpando/BufferOverflow"]}, {"cve": "CVE-2023-3086", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.", "poc": ["https://huntr.dev/bounties/17be9e8a-abe8-41db-987f-1d5b0686ae20"]}, {"cve": "CVE-2023-6312", "desc": "A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function delete_user of the file deleteUser.php of the component Users Page. The manipulation of the argument user_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-246138 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20deleteuser.md"]}, {"cve": "CVE-2023-43490", "desc": "Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34215", "desc": "TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the certification-generation function, which could potentially allow malicious users to execute remote code on affected devices.", "poc": ["https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities", "https://github.com/3sjay/vulns"]}, {"cve": "CVE-2023-50270", "desc": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.Users are recommended to upgrade to version 3.2.1, which fixes this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38352", "desc": "MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in the middle attack.", "poc": ["https://0dr3f.github.io/cve/"]}, {"cve": "CVE-2023-0160", "desc": "A deadlock flaw was found in the Linux kernel\u2019s BPF subsystem. This flaw allows a local user to potentially crash the system.", "poc": ["https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/"]}, {"cve": "CVE-2023-32387", "desc": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. A remote attacker may be able to cause unexpected app termination or arbitrary code execution.", "poc": ["https://github.com/houjingyi233/macOS-iOS-system-security"]}, {"cve": "CVE-2023-38733", "desc": "IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from installation logs. IBM X-Force Id: 262293.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23919", "desc": "A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/chnzzh/OpenSSL-CVE-lib"]}, {"cve": "CVE-2023-32322", "desc": "Ombi is an open source application which allows users to request specific media from popular self-hosted streaming servers. Versions prior to 4.38.2 contain an arbitrary file read vulnerability where an Ombi administrative user may access files available to the Ombi server process on the host operating system. Ombi administrators may not always be local system administrators and so this may violate the security expectations of the system. The arbitrary file read vulnerability was present in `ReadLogFile` and `Download` endpoints in `SystemControllers.cs` as the parameter `logFileName` is not sanitized before being combined with the `Logs` directory. When using `Path.Combine(arg1, arg2, arg3)`, an attacker may be able to escape to folders/files outside of `Path.Combine(arg1, arg2)` by using \"..\" in `arg3`. In addition, by specifying an absolute path for `arg3`, `Path.Combine` will completely ignore the first two arguments and just return just `arg3`. This vulnerability can lead to information disclosure. The Ombi `documentation` suggests running Ombi as a Service with Administrator privileges. An attacker targeting such an application may be able to read the files of any Windows user on the host machine and certain system files. This issue has been addressed in commit `b8a8f029` and in release version 4.38.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GHSL-2023-088.", "poc": ["https://github.com/Ombi-app/Ombi/security/advisories/GHSA-28j3-84m7-gpjp"]}, {"cve": "CVE-2023-44852", "desc": "Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the c_set_traps_decode function in the acu_web file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43570", "desc": "A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute arbitrary code.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-0513", "desc": "A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-219334 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.219334"]}, {"cve": "CVE-2023-3021", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4.", "poc": ["https://huntr.dev/bounties/9d289d3a-2931-4e94-b61c-449581736eff"]}, {"cve": "CVE-2023-7151", "desc": "The Product Enquiry for WooCommerce WordPress plugin before 3.2 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/4992a4a9-f21a-46e2-babf-954acfc7c5b4/"]}, {"cve": "CVE-2023-27427", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NTZApps CRM Memberships plugin <=\u00a01.6 versions.", "poc": ["https://github.com/vulsio/go-cve-dictionary"]}, {"cve": "CVE-2023-40205", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pixelgrade PixTypes plugin <=\u00a01.4.15 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2796", "desc": "The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.", "poc": ["http://packetstormsecurity.com/files/173984/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html", "https://wpscan.com/vulnerability/e9ef793c-e5a3-4c55-beee-56b0909f7a0d", "https://github.com/nullfuzz-pentest/shodan-dorks"]}, {"cve": "CVE-2023-33034", "desc": "Memory corruption while parsing the ADSP response command.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-2570", "desc": "A CWE-129: Improper Validation of Array Index vulnerability exists that could cause localdenial-of-service, and potentially kernel execution when a malicious actor with local user accesscrafts a script/program using an unpredictable index to an IOCTL call in the Foxboro.sys driver.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47222", "desc": "An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to compromise the security of the system via a network.We have already fixed the vulnerability in the following version:Media Streaming add-on 500.1.1.5 ( 2024/01/22 ) and later", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38593", "desc": "A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to cause a denial-of-service.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-0802", "desc": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/500", "https://github.com/ARPSyndicate/cvemon", "https://github.com/peng-hui/CarpetFuzz", "https://github.com/waugustus/CarpetFuzz", "https://github.com/waugustus/waugustus"]}, {"cve": "CVE-2023-27232", "desc": "TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg.", "poc": ["https://github.com/Am1ngl/ttt/tree/main/32"]}, {"cve": "CVE-2023-52616", "desc": "In the Linux kernel, the following vulnerability has been resolved:crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_initWhen the mpi_ec_ctx structure is initialized, some fields are notcleared, causing a crash when referencing the field when thestructure was released. Initially, this issue was ignored becausememory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.For example, this error will be triggered when calculating theZa value for SM2 separately.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-0744", "desc": "Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.", "poc": ["http://packetstormsecurity.com/files/171733/Answerdev-1.0.3-Account-Takeover.html", "https://huntr.dev/bounties/35a0e12f-1d54-4fc0-8779-6a4949b7c434"]}, {"cve": "CVE-2023-27566", "desc": "Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info Table in an MOC3 file.", "poc": ["https://github.com/openl2d/moc3ingbird", "https://github.com/ARPSyndicate/cvemon", "https://github.com/CVEDB/PoC-List", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/OpenL2D/moc3ingbird", "https://github.com/hktalent/TOP", "https://github.com/hugefiver/mystars", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/silentEAG/awesome-stars", "https://github.com/vtubing/caff-archive", "https://github.com/vtubing/moc3", "https://github.com/vtubing/orphism"]}, {"cve": "CVE-2023-49038", "desc": "Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto the NAS as root.", "poc": ["https://github.com/christopher-pace/CVE-2023-49038", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-32122", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spiffy Plugins Spiffy Calendar plugin <=\u00a04.9.3 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-37298", "desc": "Joplin before 2.11.5 allows XSS via a USE element in an SVG document.", "poc": ["https://github.com/laurent22/joplin/commit/caf66068bfc474bbfd505013076ed173cd90ca83", "https://github.com/laurent22/joplin/releases/tag/v2.11.5"]}, {"cve": "CVE-2023-21898", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: Applies to VirtualBox VMs running Windows 7 and later. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21554", "desc": "Microsoft Message Queuing Remote Code Execution Vulnerability", "poc": ["https://github.com/3tternp/CVE-2023-21554", "https://github.com/3tternp/MSMQ-RCE-", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Hashi0x/PoC-CVE-2023-21554", "https://github.com/MrAgrippa/nes-01", "https://github.com/T-RN-R/PatchDiffWednesday", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/g1x-r/CVE-2023-21554-PoC", "https://github.com/karimhabush/cyberowl", "https://github.com/m4nbat/KustQueryLanguage_kql", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zoemurmure/CVE-2023-21554-PoC"]}, {"cve": "CVE-2023-41448", "desc": "Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the ID parameter in the index.php component.", "poc": ["https://gist.github.com/RNPG/458e17f24ebf7d8af3c5c4d7073347a0", "https://github.com/RNPG/CVEs", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37173", "desc": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.", "poc": ["https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_4", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52150", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Elementor: from n/a before 2.12.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1124", "desc": "The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.", "poc": ["https://wpscan.com/vulnerability/229b93cd-544b-4877-8d9f-e6debda9511c"]}, {"cve": "CVE-2023-22984", "desc": "** UNSUPPORTED WHEN ASSIGNED ** A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker to execute arbitrary JavaScript via URL.", "poc": ["https://d0ub1e-d.github.io/2022/12/30/exploit-db-1/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40109", "desc": "In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/uthrasri/CVE-2023-40109"]}, {"cve": "CVE-2023-47097", "desc": "A Stored Cross-Site Scripting (XSS) vulnerability in the Server Template under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Template name field while creating server templates.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26031", "desc": "Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges.Hadoop 3.3.0 updated the \" YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html \" to add a feature for executing user-submitted applications in isolated linux containers.The native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs.The patch \" YARN-10495 https://issues.apache.org/jira/browse/YARN-10495 . make the rpath of container-executor configurable\" modified the library loading path for loading .so files from \"$ORIGIN/\" to \"\"$ORIGIN/:../lib/native/\". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root.If the YARN cluster is accepting work from remote (authenticated) users, and these users' submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges.The fix for the vulnerability is to revert the change, which is done in YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , \"Revert YARN-10495\". This patch is in hadoop-3.3.5.To determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path \"./lib/native/\" then it is at risk$ readelf -d container-executor|grep 'RUNPATH\\|RPATH' 0x000000000000001d (RUNPATH) \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Library runpath: [$ORIGIN/:../lib/native/]If it does not, then it is safe:$ readelf -d container-executor|grep 'RUNPATH\\|RPATH' 0x000000000000001d (RUNPATH) \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Library runpath: [$ORIGIN/]For an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set$ ls -laF /opt/hadoop/bin/container-executor---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executorA safe installation lacks the suid bit; ideally is also not owned by root.$ ls -laF /opt/hadoop/bin/container-executor-rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executorThis configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4399", "desc": "Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn\u2019t call specific hosts.However, the restriction can be bypassed used punycode encoding of the characters in the request address.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5749", "desc": "The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/3931daac-3899-4169-8625-4c95fd2adafc"]}, {"cve": "CVE-2023-35941", "desc": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios in which HMAC payload can be always valid in OAuth2 filter's check. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, avoid wildcards/prefix domain wildcards in the host's domain configuration.", "poc": ["https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55"]}, {"cve": "CVE-2023-46308", "desc": "In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28389", "desc": "Incorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25097", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_qos function with the attach_class variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-47262", "desc": "The startup process and device configurations of the Abbott ID NOW device, before v7.1, can be interrupted and/or modified via physical access to an internal serial port. Direct physical access is required to exploit.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31873", "desc": "Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').", "poc": ["http://packetstormsecurity.com/files/172530/Gin-Markdown-Editor-0.7.4-Arbitrary-Code-Execution.html"]}, {"cve": "CVE-2023-41741", "desc": "Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to obtain sensitive information via unspecified vectors.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21766", "desc": "Windows Overlay Filter Information Disclosure Vulnerability", "poc": ["https://github.com/Y3A/cve-2023-21766", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-21286", "desc": "In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Trinadh465/platform_frameworks_base_CVE-2023-21286", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-47454", "desc": "An Untrusted search path vulnerability in NetEase CloudMusic 2.10.4 for Windows allows local users to gain escalated privileges through the urlmon.dll file in the current working directory.", "poc": ["https://github.com/xieqiang11/poc-3/tree/main"]}, {"cve": "CVE-2023-5880", "desc": "When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers \u201cGarage Door Control Module Setup\u201d page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious\u00a0code with client side Java Script and/or HTML into the users' web browser.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33768", "desc": "Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WSP080 v1.2 allows attackers to cause a Denial of Service (DoS) via a crafted firmware file.", "poc": ["https://github.com/Fr0stM0urne/CVE-2023-33768", "https://github.com/jiayy/android_vuln_poc-exp", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/purseclab/CVE-2023-33768"]}, {"cve": "CVE-2023-40530", "desc": "Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51514", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeboxr Team CBX Bookmark & Favorite allows Stored XSS.This issue affects CBX Bookmark & Favorite: from n/a through 1.7.13.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50860", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Booking for Appointments and Events Calendar \u2013 Amelia allows Stored XSS.This issue affects Booking for Appointments and Events Calendar \u2013 Amelia: from n/a through 1.0.85.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2694", "desc": "A vulnerability was found in SourceCodester Online Exam System 1.0. It has been classified as critical. This affects an unknown part of the file /dosen/data of the component POST Parameter Handler. The manipulation of the argument columns[1][data] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228975.", "poc": ["https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-46234", "desc": "browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46848", "desc": "Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.", "poc": ["https://github.com/MegaManSec/Squid-Security-Audit", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46089", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Lee Le @ Userback Userback plugin <=\u00a01.0.13 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-45303", "desc": "ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).", "poc": ["https://herolab.usd.de/security-advisories/usd-2023-0010/", "https://github.com/20142995/sectool", "https://github.com/password123456/cve-collector"]}, {"cve": "CVE-2023-52556", "desc": "In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38184", "desc": "Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4355", "desc": "Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/174950/Chrome-Dangling-FixedArray-Pointers-Memory-Corruption.html"]}, {"cve": "CVE-2023-7024", "desc": "Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/Ostorlab/KEV"]}, {"cve": "CVE-2023-31489", "desc": "An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function.", "poc": ["https://github.com/FRRouting/frr/issues/13098"]}, {"cve": "CVE-2023-6394", "desc": "A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40544", "desc": "An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21993", "desc": "Vulnerability in the Oracle Clinical Remote Data Capture product of Oracle Health Sciences Applications (component: Forms). The supported version that is affected is 5.4.0.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Clinical Remote Data Capture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Clinical Remote Data Capture accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-27012", "desc": "Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the setSchedWifi function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC10/5/5.md"]}, {"cve": "CVE-2023-26959", "desc": "Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter.", "poc": ["https://medium.com/@shiva.infocop/authentication-bypass-park-ticketing-management-system-phpgurukul-427045159c05"]}, {"cve": "CVE-2023-6845", "desc": "The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks", "poc": ["https://wpscan.com/vulnerability/cbdaf158-f277-4be4-b022-68d18dae4c55", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34354", "desc": "A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to execution of arbitrary javascript in another user's browser. An attacker can make an authenticated HTTP request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1781"]}, {"cve": "CVE-2023-34551", "desc": "In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware versions before V5.3.2 build 230221 and CS-C6N-A0-1C2WFR-MUL Firmware versions before V5.3.2 build 230218 and CS-CV310-A0-3C2WFRL-1080p Firmware versions before V5.2.7 build 230302 and CS-CV310-A0-1C2WFR Wifi IP66 2.8mm 1080p Firmware versions before V5.3.2 build 230214 and CS-CV248-A0-32WMFR Firmware versions before V5.2.3 build 230217 and EZVIZ LC1C Firmware versions before V5.3.4 build 230214. The impact is: execute arbitrary code (remote).", "poc": ["https://github.com/infobyte/ezviz_lan_rce"]}, {"cve": "CVE-2023-50965", "desc": "In MicroHttpServer (aka Micro HTTP Server) through 4398570, _ReadStaticFiles in lib/middleware.c allows a stack-based buffer overflow and potentially remote code execution via a long URI.", "poc": ["https://github.com/starnight/MicroHttpServer/issues/5", "https://github.com/Halcy0nic/Trophies", "https://github.com/skinnyrad/Trophies"]}, {"cve": "CVE-2023-41815", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).\u00a0Malicious code could be executed in the File Manager section.\u00a0This issue affects Pandora FMS: from 700 through 774.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45184", "desc": "IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. IBM X-Force ID: 268270.", "poc": ["https://github.com/DojoSecurity/DojoSecurity", "https://github.com/afine-com/CVE-2023-45184", "https://github.com/afine-com/CVE-2023-45185", "https://github.com/afine-com/research", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31210", "desc": "Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34611", "desc": "An issue was discovered mjson thru 1.4.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.", "poc": ["https://github.com/bolerio/mjson/issues/40"]}, {"cve": "CVE-2023-45540", "desc": "An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.", "poc": ["https://github.com/soundarkutty/HTML-Injection/blob/main/POC.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/soundarkutty/CVE-2023-45540"]}, {"cve": "CVE-2023-38041", "desc": "A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploit this condition to gain unauthorized elevated privileges on the affected system.", "poc": ["https://github.com/ewilded/CVE-2023-38041-POC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-37810", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/TraiLeR2/Unquoted-Service-Path-in-the-Wondershare-Dr.Fone-13.1.5"]}, {"cve": "CVE-2023-46019", "desc": "Cross Site Scripting (XSS) vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'error' parameter.", "poc": ["https://github.com/ersinerenler/CVE-2023-46019-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability", "https://github.com/ersinerenler/CVE-2023-46019-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability", "https://github.com/ersinerenler/Code-Projects-Blood-Bank-1.0", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30765", "desc": "\u200bDelta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management configurations, resulting in privilege escalation.", "poc": ["https://github.com/0xfml/CVE-2023-30765", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30472", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MyThemeShop URL Shortener by MyThemeShop plugin <=\u00a01.0.17 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-31610", "desc": "An issue in the _IO_default_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1118", "https://github.com/Sedar2024/Sedar"]}, {"cve": "CVE-2023-41889", "desc": "SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happens when a logical validation or a security check is performed before a Unicode normalization. The Unicode character equivalent of a character would resurface after the normalization. The fix is initially performing the Unicode normalization and then strip for all whitespaces and then checking for a blank string. This issue has been fixed in version 1.18.0.", "poc": ["https://github.com/shirasagi/shirasagi/security/advisories/GHSA-xr45-c2jv-2v9r", "https://github.com/Sim4n6/Sim4n6"]}, {"cve": "CVE-2023-35110", "desc": "An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.", "poc": ["https://github.com/grobmeier/jjson/issues/2"]}, {"cve": "CVE-2023-24472", "desc": "A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide malicious input to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1709"]}, {"cve": "CVE-2023-23294", "desc": "Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute commands as root.", "poc": ["https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/"]}, {"cve": "CVE-2023-5798", "desc": "The Assistant WordPress plugin before 1.4.4 does not validate a parameter before making a request to it via wp_remote_get(), which could allow users with a role as low as Editor to perform SSRF attacks", "poc": ["https://wpscan.com/vulnerability/bbb4c98c-4dd7-421e-9666-98f15acde761"]}, {"cve": "CVE-2023-21881", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-22045", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-34561", "desc": "A buffer overflow in the level parsing code of RobTop Games AB Geometry Dash v2.113 allows attackers to execute arbitrary code via entering a Geometry Dash level.", "poc": ["https://www.youtube.com/watch?v=DMxucOWfLPc", "https://www.youtube.com/watch?v=ev0VXbiduuQ", "https://www.youtube.com/watch?v=kAeJvY6BBps"]}, {"cve": "CVE-2023-20772", "desc": "In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441796; Issue ID: ALPS07441796.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32031", "desc": "Microsoft Exchange Server Remote Code Execution Vulnerability", "poc": ["https://github.com/Avento/CVE-2023-32031", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-40630", "desc": "Unauthenticated LFI/SSRF in JCDashboards component for Joomla.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46813", "desc": "An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.", "poc": ["https://bugzilla.suse.com/show_bug.cgi?id=1212649", "https://github.com/Freax13/cve-2023-46813-poc", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/shakyaraj9569/Documentation"]}, {"cve": "CVE-2023-0060", "desc": "The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/be2fc859-3158-4f06-861d-382381a7551b"]}, {"cve": "CVE-2023-0876", "desc": "The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability.", "poc": ["https://wpscan.com/vulnerability/1a8c97f9-98fa-4e29-b7f7-bb9abe0c42ea"]}, {"cve": "CVE-2023-1294", "desc": "A vulnerability was found in SourceCodester File Tracker Manager System 1.0. It has been classified as critical. Affected is an unknown function of the file /file_manager/login.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222648.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-47070", "desc": "Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5264", "desc": "A vulnerability classified as critical was found in huakecms 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/cms_content.php. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240877 was assigned to this vulnerability.", "poc": ["https://github.com/yhy217/huakecms-vul/issues/1"]}, {"cve": "CVE-2023-3153", "desc": "A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45232", "desc": "EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.", "poc": ["http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/quarkslab/pixiefail"]}, {"cve": "CVE-2023-45897", "desc": "exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.", "poc": ["https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/"]}, {"cve": "CVE-2023-4225", "desc": "Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.", "poc": ["https://starlabs.sg/advisories/23/23-4225"]}, {"cve": "CVE-2023-49797", "desc": "PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51607", "desc": "Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PNG files.The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21829.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2390", "desc": "A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ntp.server1 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227668. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/10"]}, {"cve": "CVE-2023-6591", "desc": "The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed", "poc": ["https://wpscan.com/vulnerability/f296de1c-b70b-4829-aba7-4afa24f64c51/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1777", "desc": "Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-26442", "desc": "In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6381", "desc": "Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vulnerability by sending a malicious configuration file (file with SMB extension) to a user via a link or email attachment and persuade the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to crash the application when attempting to load the malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35932", "desc": "jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. The impact of a configuration injection may vary. Under some conditions, it may lead to command injection if there is for instance shell code execution from the configuration file values. This vulnerability does not currently have a fix.", "poc": ["https://github.com/tanghaibao/jcvi/security/advisories/GHSA-x49m-3cw7-gq5q", "https://github.com/Sim4n6/Sim4n6"]}, {"cve": "CVE-2023-34383", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This issue affects WP Project Manager: from n/a through 2.6.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26615", "desc": "D-Link DIR-823G firmware version 1.02B05 has a password reset vulnerability, which originates from the SetMultipleActions API, allowing unauthorized attackers to reset the WEB page management password.", "poc": ["https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1", "https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1/SetMultipleActions"]}, {"cve": "CVE-2023-1775", "desc": "When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-3073", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.", "poc": ["https://huntr.dev/bounties/a4d6a082-2ea8-49a5-8e48-6d39b5cc62e1"]}, {"cve": "CVE-2023-2769", "desc": "A vulnerability classified as critical has been found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file /classes/Master.php?f=delete_service. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229275.", "poc": ["https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Serviced-Providerd-Managementd-Systemd--d-SQLd-injections.md"]}, {"cve": "CVE-2023-34620", "desc": "An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.", "poc": ["https://github.com/hjson/hjson-java/issues/24"]}, {"cve": "CVE-2023-6659", "desc": "A vulnerability, which was classified as critical, has been found in Campcodes Web-Based Student Clearance System 1.0. This issue affects some unknown processing of the file /libsystem/login.php. The manipulation of the argument student leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247367.", "poc": ["https://github.com/Kidjing/cve/blob/main/sql1.md"]}, {"cve": "CVE-2023-26123", "desc": "Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function.\n**Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected.", "poc": ["https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188"]}, {"cve": "CVE-2023-28756", "desc": "A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/lifeparticle/Ruby-Cheatsheet"]}, {"cve": "CVE-2023-6850", "desc": "A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been declared as critical. This vulnerability affects unknown code of the file /index.php?pluginApp/to/yzOffice/getFile of the component API Endpoint Handler. The manipulation of the argument path/file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The patch is identified as 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. VDB-248218 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6516", "desc": "To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured `max-cache-size` limit to be significantly exceeded.This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/fokypoky/places-list", "https://github.com/marklogic/marklogic-docker"]}, {"cve": "CVE-2023-20863", "desc": "In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/DrC0okie/HEIG_SLH_Labo1", "https://github.com/Dzmitry-Basiachenka/dist-foreign-aliakh", "https://github.com/NikolaSavic1709/IB_tim12", "https://github.com/fernandoreb/dependency-check-springboot", "https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9", "https://github.com/scordero1234/java_sec_demo-main"]}, {"cve": "CVE-2023-2097", "desc": "A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226105 was assigned to this vulnerability.", "poc": ["https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%206.pdf", "https://github.com/1-tong/vehicle_cves", "https://github.com/Acaard/HTB-PC", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-32871", "desc": "In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08355514; Issue ID: ALPS08355514.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49558", "desc": "An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp.c component.", "poc": ["https://github.com/yasm/yasm/issues/252"]}, {"cve": "CVE-2023-26492", "desc": "Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to `/files/import`). An attacker can bypass the security controls by performing a DNS rebinding attack and view sensitive data from internal servers or perform a local port scan. An attacker can exploit this vulnerability to access highly sensitive internal server(s) and steal sensitive information. This issue was fixed in version 9.23.0.", "poc": ["https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h"]}, {"cve": "CVE-2023-49690", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20269", "desc": "A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.\nThis vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following:\n\nIdentify valid credentials that could then be used to establish an unauthorized remote access VPN session.\nEstablish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier).\n\nNotes:\n\nEstablishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured.\nThis vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured.\n\nCisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.", "poc": ["https://github.com/Kelvin0428/Ransomware-Group-TI", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-52609", "desc": "In the Linux kernel, the following vulnerability has been resolved:binder: fix race between mmput() and do_exit()Task A calls binder_update_page_range() to allocate and insert pages ona remote address space from Task B. For this, Task A pins the remote mmvia mmget_not_zero() first. This can race with Task B do_exit() and thefinal mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() |In this case, the work of ____fput() from Task B is queued up in Task Aas TWA_RESUME. So in theory, Task A returns to userspace and the cleanupwork gets executed. However, Task A instead sleep, waiting for a replyfrom Task B that never comes (it's dead).This means the binder_deferred_release() is blocked until an unrelatedbinder event forces Task A to go back to userspace. All the associateddeath notifications will also be delayed until then.In order to fix this use mmput_async() that will schedule the work inthe corresponding mm->async_put_work WQ instead of Task A.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-38473", "desc": "A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.", "poc": ["https://github.com/adegoodyer/kubernetes-admin-toolkit"]}, {"cve": "CVE-2023-39652", "desc": "theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run().", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38831", "desc": "RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.", "poc": ["http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html", "https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/", "https://github.com/80r1ng/CVE-2023-38831-EXP", "https://github.com/Ahmed1Al/CVE-2023-38831-winrar-exploit", "https://github.com/AskarKasimov/1337Rpwn4", "https://github.com/Awrrays/Pentest-Tips", "https://github.com/BeniB3astt/CVE-2023-38831_ReverseShell_Winrar", "https://github.com/BeniBeastt/CVE-2023-38831_ReverseShell_Winrar", "https://github.com/BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections", "https://github.com/Fa1c0n35/CVE-2023-38831-winrar-exploit", "https://github.com/FlyingPeg/Redteam_Havoc_C2_Framework_Report", "https://github.com/GOTonyGO/CVE-2023-38831-winrar", "https://github.com/Garck3h/cve-2023-38831", "https://github.com/GhostTroops/TOP", "https://github.com/Ghostasky/ALLStarRepo", "https://github.com/HACK-THE-WORLD/DailyMorningReading", "https://github.com/HDCE-inc/CVE-2023-38831", "https://github.com/IMHarman/CVE-2023-38831", "https://github.com/IR-HuntGuardians/CVE-2023-38831-HUNT", "https://github.com/K3rnel-Dev/WinrarExploit", "https://github.com/Kreedman05/nto_4fun_2024", "https://github.com/Maalfer/CVE-2023-38831_ReverseShell_Winrar-RCE", "https://github.com/Malwareman007/CVE-2023-38831", "https://github.com/Marco-zcl/POC", "https://github.com/Mich-ele/CVE-2023-38831-winrar", "https://github.com/MorDavid/CVE-2023-38831-Winrar-Exploit-Generator-POC", "https://github.com/MortySecurity/CVE-2023-38831-Exploit-and-Detection", "https://github.com/MyStuffYT/CVE-2023-38831-POC", "https://github.com/Nielk74/CVE-2023-38831", "https://github.com/NinVoido/nto2024-p7d-writeups", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/PascalAsch/CVE-2023-38831-KQL", "https://github.com/PudgyDragon/IOCs", "https://github.com/RomainBayle08/CVE-2023-38831", "https://github.com/SpamixOfficial/CVE-2023-38831", "https://github.com/Sploitus/CVE-2024-29988-exploit", "https://github.com/SugiB3o/Keylog_CVE2023-38831", "https://github.com/T0ngMystic/Vulnerability_List", "https://github.com/Threekiii/CVE", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/ahmed-fa7im/CVE-2023-38831-winrar-expoit-simple-Poc", "https://github.com/akhomlyuk/cve-2023-38831", "https://github.com/ameerpornillos/CVE-2023-38831-WinRAR-Exploit", "https://github.com/an040702/CVE-2023-38831", "https://github.com/aneasystone/github-trending", "https://github.com/asepsaepdin/CVE-2023-38831", "https://github.com/b1tg/CVE-2023-38831-winrar-exploit", "https://github.com/b1tg/b1tg", "https://github.com/c0mrade12211/Pentests", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/deepinstinct/UAC-0099-Targeting_UA", "https://github.com/delivr-to/detections", "https://github.com/elefantesagradodeluzinfinita/cve-2023-38831", "https://github.com/elefantesagradodeluzinfinita/elefantesagradodeluzinfinita", "https://github.com/h3xecute/SideCopy-Exploits-CVE-2023-38831", "https://github.com/hktalent/TOP", "https://github.com/ignis-sec/CVE-2023-38831-RaRCE", "https://github.com/johe123qwe/github-trending", "https://github.com/kehrijksen/CVE-2023-38831", "https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831", "https://github.com/kun-g/Scraping-Github-trending", "https://github.com/macarell228/nto2024", "https://github.com/malvika-thakur/CVE-2023-38831", "https://github.com/mkonate19/POC-WINRAR", "https://github.com/my-elliot/CVE-2023-38831-winrar-expoit-simple-Poc", "https://github.com/nhman-python/CVE-2023-38831", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/r1yaz/r1yaz", "https://github.com/r1yaz/winDED", "https://github.com/ruycr4ft/CVE-2023-38831", "https://github.com/s4m98/winrar-cve-2023-38831-poc-gen", "https://github.com/sadnansakin/Winrar_0-day_RCE_Exploitation", "https://github.com/solomon12354/VolleyballSquid-----CVE-2023-38831-and-Bypass-UAC", "https://github.com/takinrom/nto2024-user4-report", "https://github.com/tanjiti/sec_profile", "https://github.com/tanwar29/CVE", "https://github.com/thegr1ffyn/CVE-2023-38831", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xaitax/WinRAR-CVE-2023-38831", "https://github.com/xingchennb/POC-", "https://github.com/xk-mt/WinRAR-Vulnerability-recurrence-tutorial", "https://github.com/yj94/Yj_learning", "https://github.com/youmulijiang/evil-winrar", "https://github.com/z3r0sw0rd/CVE-2023-38831-PoC"]}, {"cve": "CVE-2023-49984", "desc": "A cross-site scripting (XSS) vulnerability in the component /management/settings of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49984", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5988", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies LioXERP allows Reflected XSS.This issue affects LioXERP: before v.146.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46823", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum ImageLinks Interactive Image Builder for WordPress allows SQL Injection.This issue affects ImageLinks Interactive Image Builder for WordPress: from n/a through 1.5.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4913", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository cecilapp/cecil prior to 7.47.1.", "poc": ["https://huntr.dev/bounties/d2a9ec4d-1b4b-470b-87da-ec069f5925ae"]}, {"cve": "CVE-2023-4227", "desc": "A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of sensitive information. The vulnerability is attributed to the presence of an unauthorized service, which could potentially enable unauthorized access to the. device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25615", "desc": "Due to insufficient input sanitization, SAP ABAP - versions 751, 753, 753, 754, 756, 757, 791, allows an authenticated high privileged user to alter the current session of the user by injecting the malicious database queries over the network and gain access to the unintended data. This may lead to a high impact on the confidentiality and no impact on the availability and integrity of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-49133", "desc": "A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.This vulnerability impacts `uclited` on the EAP225(V3) 5.1.0 Build 20220926 of the AC1350 Wireless MU-MIMO Gigabit Access Point.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1196", "desc": "The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.", "poc": ["https://wpscan.com/vulnerability/8e5ec88e-0e66-44e4-bbf2-74155d849ede", "https://wpscan.com/vulnerability/cf376ca2-92f6-44ff-929a-ace809460a33"]}, {"cve": "CVE-2023-28128", "desc": "An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution.", "poc": ["http://packetstormsecurity.com/files/172398/Ivanti-Avalanche-FileStoreConfig-Shell-Upload.html"]}, {"cve": "CVE-2023-33794", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create Tenants (/tenancy/tenants/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.", "poc": ["https://github.com/anhdq201/netbox/issues/5"]}, {"cve": "CVE-2023-1476", "desc": "A use-after-free flaw was found in the Linux kernel\u2019s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2670", "desc": "A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/?page=user/manage_user. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-228886 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/CVE-2023-2670.md", "https://vuldb.com/?id.228886", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-31475", "desc": "An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer.", "poc": ["https://github.com/gl-inet/CVE-issues/blob/main/3.215/Buffer_Overflow.md", "https://justinapplegate.me/2023/glinet-CVE-2023-31475/"]}, {"cve": "CVE-2023-31606", "desc": "A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.", "poc": ["https://github.com/e23e/CVE-2023-31606", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-32633", "desc": "Improper input validation in the Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0592", "desc": "A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outside of the extraction directory.This issue affects jefferson: before 0.4.1.", "poc": ["https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/"]}, {"cve": "CVE-2023-32377", "desc": "A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37607", "desc": "Directory Traversal in Automatic-Systems SOC FL9600 FastLine lego_T04E00 allows a remote attacker to obtain sensitive information.", "poc": ["https://github.com/CQURE/CVEs/blob/main/CVE-2023-37607/README.md"]}, {"cve": "CVE-2023-33386", "desc": "MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background.", "poc": ["https://github.com/b1ackc4t/MarsCTF/issues/10"]}, {"cve": "CVE-2023-0650", "desc": "A vulnerability was found in YAFNET up to 3.1.11 and classified as problematic. This issue affects some unknown processing of the component Signature Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.12 is able to address this issue. The identifier of the patch is a1442a2bacc3335461b44c250e81f8d99c60735f. It is recommended to upgrade the affected component. The identifier VDB-220037 was assigned to this vulnerability.", "poc": ["https://github.com/YAFNET/YAFNET/security/advisories/GHSA-mg6p-jjff-7g5m"]}, {"cve": "CVE-2023-29908", "desc": "H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/Ski-S20J2"]}, {"cve": "CVE-2023-4777", "desc": "An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins and to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins.", "poc": ["https://www.qualys.com/security-advisories/"]}, {"cve": "CVE-2023-20886", "desc": "VMware Workspace ONE UEM console contains an open redirect vulnerability.A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0282", "desc": "The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/93693d45-5217-4571-bae5-aab8878cfe62"]}, {"cve": "CVE-2023-26448", "desc": "Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content for those locations to avoid redirects to malicious content. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49298", "desc": "OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.", "poc": ["https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs/", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-48616", "desc": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44357", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21854", "desc": "Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Sales Offline. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Sales Offline accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-22057", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-39358", "desc": "Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.php` file. In `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without any validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-gj95-7xr8-9p7g"]}, {"cve": "CVE-2023-31717", "desc": "A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.", "poc": ["https://github.com/MateusTesser/CVE-2023-31717", "https://github.com/MateusTesser/Vulns-CVE", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3099", "desc": "A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the library dbus.SystemBus of the component Arbitrary File Handler. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.2-0kylin6k70-23 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230689 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/i900008/vulndb/blob/main/kylinos_vul4.md"]}, {"cve": "CVE-2023-5479", "desc": "Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0037", "desc": "The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection", "poc": ["https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56"]}, {"cve": "CVE-2023-35719", "desc": "ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability.The specific flaw exists within the Password Reset Portal used by the GINA client. The issue results from the lack of proper authentication of data received via HTTP. An attacker can leverage this vulnerability to bypass authentication and execute code in the context of SYSTEM. Was ZDI-CAN-17009.", "poc": ["https://www.manageengine.com/products/self-service-password/kb/our-response-to-CVE-2023-35719.html"]}, {"cve": "CVE-2023-24391", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline plugin <=\u00a02.5 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29156", "desc": "DroneScout ds230 Remote ID receiver from BlueMark Innovations\u00a0is affected by an information loss vulnerability through\u00a0traffic injection.An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information.\u00a0Consequently, the\u00a0MQTT broker, typically operated by a system integrator,\u00a0will have no access to the drones\u2019 real RID information.This issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21492", "desc": "Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-43208", "desc": "NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.", "poc": ["http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html", "https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/", "https://github.com/K3ysTr0K3R/CVE-2023-43208-EXPLOIT", "https://github.com/K3ysTr0K3R/K3ysTr0K3R", "https://github.com/gotr00t0day/NextGen-Mirth-Connect-Exploit", "https://github.com/jakabakos/CVE-2023-43208-mirth-connect-rce-poc", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/nvn1729/advisories", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-20702", "desc": "In 5G NRLC, there is a possible invalid memory access due to lack of error handling. This could lead to remote denial of service, if UE received invalid 1-byte rlc sdu, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00921261; Issue ID: MOLY01128895.", "poc": ["https://github.com/AEPP294/5ghoul-5g-nr-attacks", "https://github.com/Shangzewen/U-Fuzz", "https://github.com/asset-group/5ghoul-5g-nr-attacks", "https://github.com/asset-group/U-Fuzz"]}, {"cve": "CVE-2023-40040", "desc": "An issue was discovered in the MyCrops HiGrade \"THC Testing & Cannabi\" application 1.0.337 for Android. A remote attacker can start the camera feed via the com.cordovaplugincamerapreview.CameraActivity component in some situations. NOTE: this is only exploitable on Android versions that lack runtime permission checks, and of those only Android SDK 5.1.1 API 22 is consistent with the manifest. Thus, this applies only to Android Lollipop, affecting less than five percent of Android devices as of 2023.", "poc": ["https://github.com/actuator/cve"]}, {"cve": "CVE-2023-3200", "desc": "The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This makes it possible for unauthenticated attackers to update new order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-5871", "desc": "A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1616", "desc": "A vulnerability was found in XiaoBingBy TeaCMS up to 2.0.2. It has been classified as problematic. Affected is an unknown function of the component Article Title Handler. The manipulation with the input leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223800.", "poc": ["https://vuldb.com/?id.223800"]}, {"cve": "CVE-2023-35839", "desc": "A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload.", "poc": ["https://github.com/noear/solon/issues/145"]}, {"cve": "CVE-2023-43878", "desc": "Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a crafted payload into the Main Menu Items in the Administration Menu.", "poc": ["https://github.com/sromanhu/RiteCMS-Stored-XSS---MainMenu/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43878-RiteCMS-Stored-XSS---MainMenu"]}, {"cve": "CVE-2023-2307", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.", "poc": ["https://huntr.dev/bounties/204ea12e-9e5c-4166-bf0e-fd49c8836917"]}, {"cve": "CVE-2023-2037", "desc": "A vulnerability was found in Campcodes Video Sharing Website 1.0. It has been classified as critical. This affects an unknown part of the file watch.php. The manipulation of the argument code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225915.", "poc": ["https://vuldb.com/?id.225915"]}, {"cve": "CVE-2023-47446", "desc": "Pre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php page via fullname parameter.", "poc": ["https://github.com/termanix/PHPGrukul-Pre-School-Enrollment-System-v1.0/blob/main/CVE-2023-47446%20PHPGurukul-Pre-School-Enrollment-System-v1.0%20Stored%20XSS%20Vulnerability.md", "https://github.com/termanix/PHPGrukul-Pre-School-Enrollment-System-v1.0"]}, {"cve": "CVE-2023-1754", "desc": "Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/529f2361-eb2e-476f-b7ef-4e561a712e28"]}, {"cve": "CVE-2023-3983", "desc": "An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection.", "poc": ["https://www.tenable.com/security/research/tra-2023-24"]}, {"cve": "CVE-2023-4950", "desc": "The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/73db1ee8-06a2-41b6-b287-44e25f5f2e58"]}, {"cve": "CVE-2023-31275", "desc": "An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1748"]}, {"cve": "CVE-2023-21503", "desc": "Potential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.", "poc": ["https://github.com/N3vv/N3vv"]}, {"cve": "CVE-2023-4735", "desc": "Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.", "poc": ["https://huntr.dev/bounties/fc83bde3-f621-42bd-aecb-8c1ae44cba51"]}, {"cve": "CVE-2023-35086", "desc": "It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tin-z/CVE-2023-35086-POC", "https://github.com/tin-z/tin-z"]}, {"cve": "CVE-2023-32492", "desc": "Dell PowerScale OneFS 9.5.0.x contains an incorrect default permissions vulnerability. A low-privileged local attacker could potentially exploit this vulnerability, leading to information disclosure or allowing to modify files.", "poc": ["https://www.dell.com/support/kbdoc/en-us/000216717/dsa-2023-269-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"]}, {"cve": "CVE-2023-28119", "desc": "The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-34755", "desc": "bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.", "poc": ["https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability"]}, {"cve": "CVE-2023-4139", "desc": "The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and view exported files.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31625", "desc": "An issue in the psiginfo component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1132"]}, {"cve": "CVE-2023-0597", "desc": "A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory.", "poc": ["http://www.openwall.com/lists/oss-security/2023/07/28/1", "https://github.com/lrh2000/StackRot", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-23296", "desc": "Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.", "poc": ["https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/"]}, {"cve": "CVE-2023-5922", "desc": "The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protected posts/pages content", "poc": ["https://wpscan.com/vulnerability/debd8498-5770-4270-9ee1-1503e675ef34/"]}, {"cve": "CVE-2023-31429", "desc": "Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability when using various commands such as \u201cchassisdistribute\u201d, \u201creboot\u201d, \u201crasman\u201d, errmoduleshow, errfilterset, hassiscfgperrthreshold, supportshowcfgdisable and supportshowcfgenable commands that can cause the content of shell interpreted variables to be printed in the terminal.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6991", "desc": "The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.", "poc": ["https://wpscan.com/vulnerability/0b92becb-8a47-48fd-82e8-f7641cf5c9bc"]}, {"cve": "CVE-2023-22002", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-23719", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Premmerce plugin <=\u00a01.3.17 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3667", "desc": "The Bit Assist WordPress plugin before 1.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/9f2f3f85-6812-46b5-9175-c56f6852afd7"]}, {"cve": "CVE-2023-4624", "desc": "Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.", "poc": ["https://huntr.dev/bounties/9ce5cef6-e546-44e7-addf-a2726fa4e60c", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48268", "desc": "Mattermost fails to\u00a0limit the amount of data extracted from compressed archives during board import in Mattermost Boards\u00a0allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by\u00a0importing a board using a specially crafted zip (zip bomb).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37192", "desc": "Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing.", "poc": ["https://satoshihunter1.blogspot.com/2023/06/the-bitcoin-app-is-vulnerable-to-hackers.html", "https://www.youtube.com/watch?v=oEl4M1oZim0", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34610", "desc": "An issue was discovered json-io thru 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.", "poc": ["https://github.com/jdereg/json-io/issues/169"]}, {"cve": "CVE-2023-0332", "desc": "A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file admin/manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218472.", "poc": ["https://vuldb.com/?id.218472"]}, {"cve": "CVE-2023-5194", "desc": "Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a\u00a0system/user manager to demote / deactivate another manager", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51627", "desc": "D-Link DCS-8300LHV2 ONVIF Duration Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the parsing of Duration XML elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21321.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39006", "desc": "The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization.", "poc": ["https://logicaltrust.net/blog/2023/08/opnsense.html"]}, {"cve": "CVE-2023-49424", "desc": "Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.", "poc": ["https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetVirtualServerCfg.md"]}, {"cve": "CVE-2023-1244", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.", "poc": ["https://huntr.dev/bounties/bcab9555-8a35-42b2-a7de-0a79fd710b52"]}, {"cve": "CVE-2023-36764", "desc": "Microsoft SharePoint Server Elevation of Privilege Vulnerability", "poc": ["https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-51775", "desc": "The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.", "poc": ["https://bitbucket.org/b_c/jose4j/issues/212"]}, {"cve": "CVE-2023-49375", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.", "poc": ["https://github.com/cui2shark/cms/blob/main/There%20is%20CSRF%20in%20the%20modification%20of%20the%20friendship%20link.md"]}, {"cve": "CVE-2023-20156", "desc": "Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sg-web-multi-S9g4Nkgv"]}, {"cve": "CVE-2023-6343", "desc": "Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx 'FN' and 'PN' parameters. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable Aquaforest TIFF Server feature was removed on or around 2023-11-01. Insecure configuration issues in Aquaforest TIFF Server are identified separately as CVE-2023-6352. CVE-2023-6343 is similar to CVE-2020-9323. CVE-2023-6343 is related to or partially caused by CVE-2023-6352.", "poc": ["https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/", "https://github.com/qwell/disorder-in-the-court"]}, {"cve": "CVE-2023-26978", "desc": "TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg.", "poc": ["https://github.com/Am1ngl/ttt/tree/main/28"]}, {"cve": "CVE-2023-43235", "desc": "D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDownSettings.", "poc": ["https://github.com/peris-navince/founded-0-days/blob/main/Dlink/823G/SetWifiDownSettings/1.md"]}, {"cve": "CVE-2023-5082", "desc": "The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it.", "poc": ["https://wpscan.com/vulnerability/13a196ba-49c7-4575-9a49-3ef9eb2348f3"]}, {"cve": "CVE-2023-39223", "desc": "Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45671", "desc": "Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-190_Frigate/"]}, {"cve": "CVE-2023-1410", "desc": "Grafana is an open-source platform for monitoring and observability.\u00a0Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description.\u00a0 Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.", "poc": ["https://github.com/grafana/bugbounty/security/advisories/GHSA-qrrg-gw7w-vp76", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-6360", "desc": "The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.", "poc": ["https://www.tenable.com/security/research/tra-2023-40", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-46092", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.Com Webmaster Tools allows Stored XSS.This issue affects Webmaster Tools: from n/a through 2.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-1635", "desc": "A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability.", "poc": ["https://github.com/BigTiger2020/2023/blob/main/XSS.md"]}, {"cve": "CVE-2023-36220", "desc": "Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function.", "poc": ["https://packetstormsecurity.com/files/172967/Textpattern-CMS-4.8.8-Command-Injection.html", "https://github.com/capture0x/My-CVE"]}, {"cve": "CVE-2023-30955", "desc": "A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users with insufficient privilege the ability to view and interact with Developer Mode settings in a limited capacity. A fix was deployed with workspace-server 7.7.0.", "poc": ["https://palantir.safebase.us/?tcuUid=0c3f6c33-4eb0-48b5-ab87-fe48c46a4170"]}, {"cve": "CVE-2023-1187", "desc": "A vulnerability was found in FabulaTech Webcam for Remote Desktop 2.8.42 and classified as problematic. This issue affects some unknown processing in the library ftwebcam.sys of the component Global Variable Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222359.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1187", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-1307", "desc": "Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.", "poc": ["https://huntr.dev/bounties/5fe85af4-a667-41a9-a00d-f99e07c5e2f1"]}, {"cve": "CVE-2023-47142", "desc": "IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization's local network to escalate their privileges due to unauthorized API access. IBM X-Force ID: 270267.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5072", "desc": "Denial of Service in JSON-Java versions up to and including 20230618. \u00a0A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.", "poc": ["https://github.com/stleary/JSON-java/issues/758", "https://github.com/chainguard-dev/pombump", "https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9", "https://github.com/vaikas/pombump"]}, {"cve": "CVE-2023-50928", "desc": "\"Sandbox Accounts for Events\" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1125", "desc": "The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.", "poc": ["https://wpscan.com/vulnerability/e8a4b6ab-47f8-495d-a22c-dcf914dfb58c"]}, {"cve": "CVE-2023-50886", "desc": "Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40619", "desc": "phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4203", "desc": "Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the ping tool of the web-interface.", "poc": ["http://packetstormsecurity.com/files/174153/Advantech-EKI-1524-CE-EKI-1522-EKI-1521-Cross-Site-Scripting.html", "http://seclists.org/fulldisclosure/2023/Aug/13", "https://cyberdanube.com/en/en-st-polten-uas-multiple-vulnerabilities-in-advantech-eki-15xx-series/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0286", "desc": "There is a type confusion vulnerability relating to X.400 address processinginside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING butthe public structure definition for GENERAL_NAME incorrectly specified the typeof the x400Address field as ASN1_TYPE. This field is subsequently interpreted bythe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than anASN1_STRING.When CRL checking is enabled (i.e. the application sets theX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to passarbitrary pointers to a memcmp call, enabling them to read memory contents orenact a denial of service. In most cases, the attack requires the attacker toprovide both the certificate chain and CRL, neither of which need to have avalid signature. If the attacker only controls one of these inputs, the otherinput must already contain an X.400 address as a CRL distribution point, whichis uncommon. As such, this vulnerability is most likely to only affectapplications which have implemented their own functionality for retrieving CRLsover a network.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/EGI-Federation/SVG-advisories", "https://github.com/FairwindsOps/bif", "https://github.com/PajakAlexandre/wik-dps-tp02", "https://github.com/Tuttu7/Yum-command", "https://github.com/a23au/awe-base-images", "https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/dejanb/guac-rs", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/karimhabush/cyberowl", "https://github.com/neo9/fluentd", "https://github.com/nidhi7598/OPENSSL_1.1.11g_G3_CVE-2023-0286", "https://github.com/nidhi7598/OPENSSL_1.1.1g_G3_CVE-2023-0286", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/stkcat/awe-base-images", "https://github.com/trustification/guac-rs", "https://github.com/xkcd-2347/trust-api"]}, {"cve": "CVE-2023-4502", "desc": "The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.", "poc": ["https://wpscan.com/vulnerability/e4804850-2ac2-4cec-bc27-07ed191d96da"]}, {"cve": "CVE-2023-39807", "desc": "N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-register.php.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25583", "desc": "Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch that manages a new vlan configuration.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1723"]}, {"cve": "CVE-2023-6866", "desc": "TypedArrays can be fallible and lacked proper exception handling. This could lead to abuse in other APIs which expect TypedArrays to always succeed. This vulnerability affects Firefox < 121.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1849037", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5948", "desc": "Improper Authorization in GitHub repository teamamaze/amazefileutilities prior to 1.91.", "poc": ["https://huntr.com/bounties/ac1363b5-207b-40d9-aac5-e66d6213f692"]}, {"cve": "CVE-2023-39551", "desc": "PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php.", "poc": ["https://www.chtsecurity.com/news/0dbe8e1d-0a6c-4604-9cf1-778ddc86a8c1"]}, {"cve": "CVE-2023-44831", "desc": "D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Type parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.", "poc": ["https://github.com/password123456/cve-collector"]}, {"cve": "CVE-2023-48836", "desc": "Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.", "poc": ["http://packetstormsecurity.com/files/176046"]}, {"cve": "CVE-2023-43523", "desc": "Transient DOS while processing 11AZ RTT management action frame received through OTA.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2453", "desc": "There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a \u2018require_once\u2019 statement. This allows arbitrary files with the \u2018.php\u2019 extension for which the absolute path is known to be included and executed. There are no known means in PHPFusion through which an attacker can upload and target a \u2018.php\u2019 file payload.", "poc": ["https://github.com/gg0h/gg0h"]}, {"cve": "CVE-2023-49686", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7017", "desc": "Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A challenge request can be sent to the lock with a command to prepare for an update, rather than an unlock request, allowing an attacker to compromise the device.", "poc": ["https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38692", "desc": "CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installation function in module management. The vulnerability has been fixed in v1.3.1. There are no known workarounds aside from upgrading.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26075", "desc": "An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. An intra-object overflow in the 5G MM message codec can occur due to insufficient parameter validation when decoding the Service Area List.", "poc": ["http://packetstormsecurity.com/files/171387/Shannon-Baseband-NrmmMsgCodec-Intra-Object-Overflow.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-4413", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Permission to access the file is limited to administrative users only by default.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43344", "desc": "Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the SEO - Meta description parameter in the Pages Menu component.", "poc": ["https://github.com/sromanhu/CVE-2023-43344-Quick-CMS-Stored-XSS---SEO-Meta-description", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43344-Quick-CMS-Stored-XSS---SEO-Meta-description"]}, {"cve": "CVE-2023-2236", "desc": "A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.Both\u00a0io_install_fixed_file\u00a0and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability.We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4.", "poc": ["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d94c04c0db024922e886c9fd429659f22f48ea4"]}, {"cve": "CVE-2023-6011", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DECE Software Geodi allows Stored XSS.This issue affects Geodi: before 8.0.0.27396.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29010", "desc": "Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulnerable to Server-Side Request Forgery. This can lead to an attacker gaining access to a Budibase AWS secret key. Users of Budibase cloud need to take no action. Self-host users who run Budibase on the public internet and are using a cloud provider that allows HTTP access to metadata information should ensure that when they deploy Budibase live, their internal metadata endpoint is not exposed.", "poc": ["https://github.com/Budibase/budibase/security/advisories/GHSA-9xg2-9mcv-985p"]}, {"cve": "CVE-2023-6528", "desc": "The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.", "poc": ["https://wpscan.com/vulnerability/36ced447-84ea-4162-80d2-6df226cb53cb", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36553", "desc": "A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to execute unauthorized code or commands via crafted API requests.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2024", "desc": "Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/team890/CVE-2023-2024"]}, {"cve": "CVE-2023-48901", "desc": "A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter \"id\" within the getPhotosByCarId function call in details.php.", "poc": ["https://packetstormsecurity.com/files/177660/Tramyardg-Autoexpress-1.3.0-SQL-Injection.html", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-46068", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XQueue GmbH Maileon for WordPress plugin <=\u00a02.16.0 versions.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-35861", "desc": "A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.", "poc": ["https://blog.freax13.de/cve/cve-2023-35861"]}, {"cve": "CVE-2023-6461", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.", "poc": ["https://huntr.com/bounties/9a97d163-1738-4a09-b284-a04716e69dd0"]}, {"cve": "CVE-2023-52189", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jhayghost Ideal Interactive Map allows Stored XSS.This issue affects Ideal Interactive Map: from n/a through 1.2.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40178", "desc": "Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale. This issue was patched in version 4.0.5.", "poc": ["https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw"]}, {"cve": "CVE-2023-40868", "desc": "Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions.", "poc": ["https://github.com/MinoTauro2020/CVE-2023-40868", "https://github.com/MinoTauro2020/CVE-2023-40868", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-37285", "desc": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-48369", "desc": "Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2446", "desc": "The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account.", "poc": ["http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html", "https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-32522", "desc": "A path traversal exists in a specific dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an authenticated remote attacker to delete arbitrary files.\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.", "poc": ["https://www.tenable.com/security/research/tra-2023-17"]}, {"cve": "CVE-2023-46668", "desc": "If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API keys can be viewed in Elasticsearch in plaintext. These API keys could be used to write arbitrary data and read Elastic Endpoint user artifacts.", "poc": ["https://www.elastic.co/community/security"]}, {"cve": "CVE-2023-39239", "desc": "It is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.", "poc": ["https://github.com/ShielderSec/poc"]}, {"cve": "CVE-2023-30628", "desc": "Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior,the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz\";echo${IFS}\"hello\";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.", "poc": ["https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-cw6r-6ccx-5hwx", "https://securitylab.github.com/research/github-actions-untrusted-input/"]}, {"cve": "CVE-2023-49250", "desc": "Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.This issue affects Apache DolphinScheduler: before 3.2.0.Users are recommended to upgrade to version 3.2.1, which fixes the issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35774", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <=\u00a02.4.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6535", "desc": "A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48223", "desc": "fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work if the victim application utilizes a public key containing the `BEGIN RSA PUBLIC KEY` header. Applications using the RS256 algorithm, a public key with a `BEGIN RSA PUBLIC KEY` header, and calling the verify function without explicitly providing an algorithm, are vulnerable to this algorithm confusion attack which allows attackers to sign arbitrary payloads which will be accepted by the verifier. Version 3.3.2 contains a patch for this issue. As a workaround, change line 29 of `blob/master/src/crypto.js` to include a regular expression.", "poc": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-c2ff-88x2-x9pg"]}, {"cve": "CVE-2023-24686", "desc": "An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file.", "poc": ["https://github.com/blakduk/Advisories/blob/main/ChurchCRM/README.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/blakduk/Advisories"]}, {"cve": "CVE-2023-2393", "desc": "A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument ConfigPort.LogicalIfName leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/13", "https://vuldb.com/?id.227671"]}, {"cve": "CVE-2023-33117", "desc": "Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2930", "desc": "Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/em1ga3l/cve-publicationdate-extractor"]}, {"cve": "CVE-2023-6863", "desc": "The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6021", "desc": "LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023", "poc": ["https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2032", "desc": "The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.", "poc": ["https://wpscan.com/vulnerability/17acde5d-44ea-4e77-8670-260d22e28ffe"]}, {"cve": "CVE-2023-28512", "desc": "IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input validation. IBM X-Force ID: 250396.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4716", "desc": "The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including, 3.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30775", "desc": "A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/464"]}, {"cve": "CVE-2023-27193", "desc": "An issue found in DUALSPACE v.1.1.3 allows a local attacker to gain privileges via the key_ad_new_user_avoid_time field.", "poc": ["https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27193/CVE%20detail.md"]}, {"cve": "CVE-2023-46052", "desc": "** DISPUTED ** Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.", "poc": ["https://gitlab.com/sane-project/backends/-/issues/709"]}, {"cve": "CVE-2023-38620", "desc": "Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `lsb` array.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25036", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <=\u00a01.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7014", "desc": "The Author Box, Guest Author and Co-Authors for Your Posts \u2013 Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.4 via the 'ma_debu' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including post author emails and names if applicable.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29086", "desc": "An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP Min-SE header.", "poc": ["http://packetstormsecurity.com/files/172293/Shannon-Baseband-SIP-Min-SE-Header-Stack-Buffer-Overflow.html"]}, {"cve": "CVE-2023-25098", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_qos function with the source variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-5530", "desc": "The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue", "poc": ["https://wpscan.com/vulnerability/a642f313-cc3e-4d75-b207-1dceb6a7fbae"]}, {"cve": "CVE-2023-33213", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Display Custom Fields \u2013 wpView plugin <=\u00a01.3.0 versions.", "poc": ["https://github.com/Otwooo/Otwooo", "https://github.com/bshyuunn/Otwooo", "https://github.com/bshyuunn/bshyuunn"]}, {"cve": "CVE-2023-3964", "desc": "An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/419857", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51094", "desc": "Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet.", "poc": ["https://github.com/GD008/TENDA/blob/main/M3/telnet/M3_telnet.md"]}, {"cve": "CVE-2023-45386", "desc": "In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::searchcategory()`, `extratabspro::searchproduct()` and `extratabspro::searchmanufacturer().'", "poc": ["https://security.friendsofpresta.org/modules/2023/10/12/extratabspro.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20774", "desc": "In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07292228; Issue ID: ALPS07292228.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20798", "desc": "In pda, there is a possible out of bounds read due to an incorrect calculation of buffer size. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07147572; Issue ID: ALPS07421076.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2271", "desc": "The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/31512f33-c310-4b36-b665-19293097cc8b"]}, {"cve": "CVE-2023-21400", "desc": "In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.", "poc": ["http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html"]}, {"cve": "CVE-2023-40761", "desc": "User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45863", "desc": "An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.3"]}, {"cve": "CVE-2023-44358", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3385", "desc": "An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/416161"]}, {"cve": "CVE-2023-47705", "desc": "IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID: 271228.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49376", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.", "poc": ["https://github.com/cui2shark/cms/blob/main/Delete%20existing%20CSRF%20in%20label%20management.md"]}, {"cve": "CVE-2023-41436", "desc": "Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Pages Content Menu component.", "poc": ["https://github.com/sromanhu/CSZ-CMS-Stored-XSS---Pages-Content/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-41436-CSZ-CMS-Stored-XSS---Pages-Content"]}, {"cve": "CVE-2023-0548", "desc": "The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/b6c1ed7a-5b2d-4985-847d-56586b1aae9b"]}, {"cve": "CVE-2023-39510", "desc": "Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The`reports_admin.php` script displays reporting information about graphs, devices, data sources etc.CENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http:///cacti/host.php`, while the rendered malicious payload is exhibited at `http:///cacti/reports_admin.php` when the a graph with the maliciously altered device name is linked to the report. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-24w4-4hp2-3j8h"]}, {"cve": "CVE-2023-33044", "desc": "Transient DOS in Data modem while handling TLB control messages from the Network.", "poc": ["https://github.com/AEPP294/5ghoul-5g-nr-attacks", "https://github.com/asset-group/5ghoul-5g-nr-attacks"]}, {"cve": "CVE-2023-32797", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution video carousel slider with lightbox plugin <=\u00a01.0.22 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33116", "desc": "Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38200", "desc": "A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43319", "desc": "Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.", "poc": ["https://medium.com/@muthumohanprasath.r/reflected-cross-site-scripting-on-icewarp-webclient-product-cve-2023-43319-c2ad758ac2bc"]}, {"cve": "CVE-2023-31914", "desc": "Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc.", "poc": ["https://github.com/EJueon/EJueon"]}, {"cve": "CVE-2023-0535", "desc": "The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/8c50321a-dba8-4379-9b9c-4c349e44b2ed"]}, {"cve": "CVE-2023-36404", "desc": "Windows Kernel Information Disclosure Vulnerability", "poc": ["http://packetstormsecurity.com/files/176110/Windows-Kernel-Information-Disclosure.html"]}, {"cve": "CVE-2023-6552", "desc": "Lack of \"current\" GET parameter validation during the action of changing a language leads to an open redirect vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30053", "desc": "TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.", "poc": ["https://github.com/Am1ngl/ttt/tree/main/160"]}, {"cve": "CVE-2023-3499", "desc": "The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/ea29413b-494e-410e-ae42-42f96284899c", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0875", "desc": "The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users.", "poc": ["https://wpscan.com/vulnerability/d44e9a45-cbdf-46b1-8b48-7d934b617534"]}, {"cve": "CVE-2023-30570", "desc": "pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.", "poc": ["https://github.com/PhilipM-eu/ikepoke"]}, {"cve": "CVE-2023-40111", "desc": "In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-22947", "desc": "** DISPUTED ** Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\\opt (rather than C:\\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that \"We consider the ACLs a best effort thing\" and \"it was a documentation mistake.\"", "poc": ["https://shibboleth.atlassian.net/browse/SSPCPP-961", "https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335545/Install+on+Windows#Restricting-ACLs", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40305", "desc": "GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.", "poc": ["https://savannah.gnu.org/bugs/index.php?64503"]}, {"cve": "CVE-2023-37239", "desc": "Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43320", "desc": "An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via bypassing the two-factor authentication component.", "poc": ["http://packetstormsecurity.com/files/176967/Proxmox-VE-7.4-1-TOTP-Brute-Force.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4120", "desc": "A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the file importhtml.php. The manipulation of the argument sql leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235967. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/RCEraser/cve/blob/main/rce.md", "https://github.com/izj007/wechat", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-2296", "desc": "The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/8126ff73-c0e5-4c1b-ba10-2e51f690521e"]}, {"cve": "CVE-2023-1295", "desc": "A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5641", "desc": "The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/c0a6c253-71f2-415d-a6ec-022f2eafc13b"]}, {"cve": "CVE-2023-2649", "desc": "A vulnerability was found in Tenda AC23 16.03.07.45_cn. It has been declared as critical. This vulnerability affects unknown code of the file /bin/ate of the component Service Port 7329. The manipulation of the argument v2 leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-228778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/xinzhihen06/ac23tenda/blob/main/tendaAC23.md"]}, {"cve": "CVE-2023-4047", "desc": "A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1839073", "https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC"]}, {"cve": "CVE-2023-23306", "desc": "The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bounds write operation. A malicious application could create a specially crafted `Toybox.Ant.BurstPayload` object, call its `add` method, override arbitrary memory and hijack the execution of the device's firmware.", "poc": ["https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23306.md"]}, {"cve": "CVE-2023-39316", "desc": "Multiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `string_pointers` array.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1298", "desc": "ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25100", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_qos function with the default_class variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-4076", "desc": "Use after free in WebRTC in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC session. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33103", "desc": "Transient DOS while processing CAG info IE received from NW.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43892", "desc": "Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is exploited via a crafted payload.", "poc": ["https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20hostname%20parameter%20in%20wan%20settings.md", "https://github.com/Luwak-IoT-Security/CVEs", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39526", "desc": "PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.", "poc": ["https://github.com/dnkhack/fixcve2023_39526_2023_39527", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31802", "desc": "Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters.", "poc": ["https://github.com/msegoviag/discovered-vulnerabilities", "https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-51801", "desc": "SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the id parameter in the student_form.php and the class_form.php pages.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-51801", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-21943", "desc": "Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-37977", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress \u2013 WPFunnels plugin <=\u00a02.7.16 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-24720", "desc": "An arbitrary file upload vulnerability in readium-js v0.32.0 allows attackers to execute arbitrary code via uploading a crafted EPUB file.", "poc": ["https://infosec.zeyu2001.com/2023/readiumjs-cloud-reader-everybody-gets-an-xss"]}, {"cve": "CVE-2023-20211", "desc": "A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. \nThis vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by authenticating to the application as a user with read-only or higher privileges and sending crafted HTTP requests to an affected system. A successful exploit could allow the attacker to read or modify data in the underlying database or elevate their privileges.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-injection-g6MbwH2"]}, {"cve": "CVE-2023-39138", "desc": "An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.", "poc": ["https://blog.ostorlab.co/zip-packages-exploitation.html"]}, {"cve": "CVE-2023-24276", "desc": "TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.", "poc": ["https://github.com/Am1ngl/ttt/tree/main/18"]}, {"cve": "CVE-2023-2695", "desc": "A vulnerability was found in SourceCodester Online Exam System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /kelas/data of the component POST Parameter Handler. The manipulation of the argument columns[1][data] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228976.", "poc": ["https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-3946", "desc": "A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10402"]}, {"cve": "CVE-2023-42787", "desc": "A client-side enforcement of server-side security [CWE-602] vulnerability\u00a0in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution.", "poc": ["https://github.com/orangecertcc/security-research/security/advisories/GHSA-q5pq-8666-j8fr", "https://github.com/Orange-Cyberdefense/CVE-repository"]}, {"cve": "CVE-2023-29385", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <=\u00a02.6.2 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-4902", "desc": "Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/btklab/posh-mocks"]}, {"cve": "CVE-2023-4039", "desc": "**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables.The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.", "poc": ["https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf", "https://github.com/GrigGM/05-virt-04-docker-hw", "https://github.com/bollwarm/SecToolSet", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-29214", "desc": "XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the IncludedDocuments panel. The problem has been patched on XWiki 14.4.7, and 14.10.", "poc": ["https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qx9h-c5v6-ghqh"]}, {"cve": "CVE-2023-38669", "desc": "Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. This resulted in a potentially exploitable condition.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-001.md"]}, {"cve": "CVE-2023-43513", "desc": "Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39281", "desc": "A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21334", "desc": "In App Ops Service, there is a possible disclosure of information about installed packages due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3658", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester AC Repair and Services System 1.0. Affected is an unknown function of the file Master.php?f=delete_book of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234012.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0002", "desc": "A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.", "poc": ["https://github.com/jeremymonk21/Vulnerability-Management-and-SIEM-Implementation-Project"]}, {"cve": "CVE-2023-41892", "desc": "Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.", "poc": ["http://packetstormsecurity.com/files/176303/Craft-CMS-4.4.14-Remote-Code-Execution.html", "https://github.com/Faelian/CraftCMS_CVE-2023-41892", "https://github.com/LucaLeukert/HTB-Surveillance", "https://github.com/Marco-zcl/POC", "https://github.com/XRSec/AWVS-Update", "https://github.com/acesoyeo/CVE-2023-41892", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/diegaccio/Craft-CMS-Exploit", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-", "https://github.com/zaenhaxor/CVE-2023-41892"]}, {"cve": "CVE-2023-42137", "desc": "PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks.The attacker must have shell access to the device in order to exploit this vulnerability.", "poc": ["https://blog.stmcyber.com/pax-pos-cves-2023/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4207", "desc": "A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.", "poc": ["https://github.com/hshivhare67/Kernel_4.1.15_CVE-2023-4206_CVE-2023-4207_CVE-2023-4208", "https://github.com/nidhi7598/linux-4.19.72_net_CVE-2023-4207", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5918", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-244308.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5002", "desc": "A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.", "poc": ["https://github.com/Threekiii/Awesome-POC"]}, {"cve": "CVE-2023-20857", "desc": "VMware Workspace ONE Content contains a passcode bypass vulnerability. A malicious actor, with access to a users rooted device, may be able to bypass the VMware Workspace ONE Content passcode.", "poc": ["http://packetstormsecurity.com/files/171158/VMware-Security-Advisory-2023-0006.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-32486", "desc": "Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. A low privilege local attacker could potentially exploit this vulnerability, leading to escalation of privileges.", "poc": ["https://www.dell.com/support/kbdoc/en-us/000216717/dsa-2023-269-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"]}, {"cve": "CVE-2023-36161", "desc": "An issue was discovered in Qubo Smart Plug 10A version HSP02_01_01_14_SYSTEM-10A, allows attackers to cause a denial of service (DoS) via Wi-Fi deauthentication.", "poc": ["https://github.com/Yashodhanvivek/Qubo_smart_switch_security_assessment"]}, {"cve": "CVE-2023-3782", "desc": "DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response", "poc": ["https://research.jfrog.com/vulnerabilities/okhttp-client-brotli-dos/"]}, {"cve": "CVE-2023-33239", "desc": "TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from insufficient input validation in the key-generation function, which could potentially allow malicious users to execute remote code on affected devices.", "poc": ["https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities", "https://github.com/3sjay/vulns"]}, {"cve": "CVE-2023-1708", "desc": "An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/387185"]}, {"cve": "CVE-2023-31294", "desc": "CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the Delivery Name field.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0052/"]}, {"cve": "CVE-2023-44047", "desc": "Sourcecodester Toll Tax Management System v1 is vulnerable to SQL Injection.", "poc": ["https://github.com/xcodeOn1/SQLI-TollTax/blob/main/README.md", "https://github.com/xcodeOn1/xcode0x-CVEs/blob/main/CVE/CVE-2023-44047.md", "https://github.com/xcodeOn1/xcode0x-CVEs"]}, {"cve": "CVE-2023-4473", "desc": "A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.", "poc": ["https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/", "https://github.com/Tig3rHu/Awesome_IOT_Vul_lib"]}, {"cve": "CVE-2023-2401", "desc": "The QuBot WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/0746ea56-dd88-4fc3-86a3-54408eef1f94"]}, {"cve": "CVE-2023-49240", "desc": "Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5907", "desc": "The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.", "poc": ["https://wpscan.com/vulnerability/f250226f-4a05-4d75-93c4-5444a4ce919e"]}, {"cve": "CVE-2023-5323", "desc": "Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.", "poc": ["https://huntr.dev/bounties/7a048bb7-bfdd-4299-931e-9bc283e92bc8", "https://github.com/blakduk/Advisories"]}, {"cve": "CVE-2023-32598", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in A. R. Jones Featured Image Pro Post Grid plugin <=\u00a05.14 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29734", "desc": "An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the database.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29734/CVE%20detail.md"]}, {"cve": "CVE-2023-47742", "desc": "IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances. IBM X-Force ID: 272533.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49794", "desc": "KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed, which causes any malicious apk named `me.weishu.kernelsu` get root permission. If a KernelSU module installed device try to install any not checked apk which package name equal to the official KernelSU Manager, it can take over root privileges on the device. As of time of publication, a patched version is not available.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33272", "desc": "An issue was discovered in DTS Monitoring 3.57.0. The parameter ip within the Ping check function is vulnerable to OS command injection (blind).", "poc": ["https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33272.md", "https://github.com/dtssec/CVE-Disclosures", "https://github.com/l4rRyxz/CVE-Disclosures"]}, {"cve": "CVE-2023-34096", "desc": "Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.", "poc": ["http://packetstormsecurity.com/files/172822/Thruk-Monitoring-Web-Interface-3.06-Path-Traversal.html", "https://galogetlatorre.blogspot.com/2023/06/cve-2023-34096-path-traversal-thruk.html", "https://github.com/galoget/Thruk-CVE-2023-34096", "https://github.com/sni/Thruk/security/advisories/GHSA-vhqc-649h-994h", "https://www.exploit-db.com/exploits/51509", "https://github.com/galoget/Thruk-CVE-2023-34096", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30257", "desc": "A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.", "poc": ["https://github.com/stigward/PoCs-and-Exploits/tree/main/fiio_LPE_0day", "https://stigward.github.io/posts/fiio-m6-exploit/"]}, {"cve": "CVE-2023-43149", "desc": "SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status.", "poc": ["https://github.com/MinoTauro2020/CVE-2023-43149", "https://github.com/MinoTauro2020/CVE-2023-43149", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27098", "desc": "TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.", "poc": ["https://github.com/c0d3x27/CVEs/tree/main/CVE-2023-27098"]}, {"cve": "CVE-2023-2799", "desc": "A vulnerability, which was classified as problematic, has been found in cnoa OA up to 5.1.1.5. Affected by this issue is some unknown functionality of the file /index.php?app=main&func=passport&action=login. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229376. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-1437", "desc": "All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51681", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Duplicator Duplicator \u2013 WordPress Migration & Backup Plugin.This issue affects Duplicator \u2013 WordPress Migration & Backup Plugin: from n/a through 1.5.7.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41825", "desc": "A path traversal vulnerability was reported in the Motorola Ready For application that could allow a local attacker to access local files.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25078", "desc": "Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38403", "desc": "iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.", "poc": ["https://github.com/esnet/iperf/issues/1542"]}, {"cve": "CVE-2023-3187", "desc": "A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Profile Picture Handler. The manipulation of the argument newpic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231176.", "poc": ["http://packetstormsecurity.com/files/172909/Teachers-Record-Management-System-1.0-Validation-Bypass.html", "https://github.com/ctflearner/Vulnerability/blob/main/Teacher_Record_Management_System/trms.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/ctflearner/ctflearner"]}, {"cve": "CVE-2023-42442", "desc": "JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).", "poc": ["https://github.com/0x727/BypassPro", "https://github.com/20142995/pocsuite3", "https://github.com/20142995/sectool", "https://github.com/C1ph3rX13/CVE-2023-42442", "https://github.com/HolyGu/CVE-2023-42442", "https://github.com/Marco-zcl/POC", "https://github.com/T0ngMystic/Vulnerability_List", "https://github.com/Threekiii/CVE", "https://github.com/enomothem/PenTestNote", "https://github.com/izj007/wechat", "https://github.com/luck-ying/Library-POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile", "https://github.com/tarihub/blackjump", "https://github.com/tarimoe/blackjump", "https://github.com/whoami13apt/files2", "https://github.com/wjlin0/poc-doc", "https://github.com/wwsuixin/jumpserver", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-"]}, {"cve": "CVE-2023-24808", "desc": "PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28kb in size and was discovered via fuzzing. Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf. Please see the linked GHSA for an example pdf. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/michaelrsweet/pdfio/security/advisories/GHSA-cjc4-x96x-fvgf"]}, {"cve": "CVE-2023-49563", "desc": "Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v.1.1 allows an attacker to execute arbitrary code via a crafted script within a request to the webserver.", "poc": ["https://gist.github.com/ph4nt0mbyt3/b237bfb06b2bff405ab47e4ea52c0bd2", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25164", "desc": "Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/cli@1.0.9. Users are advised to upgrade. There are no known workarounds for this issue.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Vinalti/cve-badge.li"]}, {"cve": "CVE-2023-2221", "desc": "The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.", "poc": ["https://wpscan.com/vulnerability/6666688e-7239-4d40-a348-307cf8f3b657"]}, {"cve": "CVE-2023-46233", "desc": "crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.", "poc": ["https://github.com/anthonykirby/lora-packet"]}, {"cve": "CVE-2023-40181", "desc": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.", "poc": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxp4-rx7x-h2g8"]}, {"cve": "CVE-2023-7177", "desc": "A vulnerability classified as critical was found in Campcodes Online College Library System 1.0. This vulnerability affects unknown code of the file /admin/book_add.php of the component HTTP POST Request Handler. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249364.", "poc": ["https://medium.com/@heishou/libsystem-foreground-sql-injection-vulnerability-4-cadc2983eb5e"]}, {"cve": "CVE-2023-27013", "desc": "Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC10/2/2.md"]}, {"cve": "CVE-2023-34597", "desc": "A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.", "poc": ["https://github.com/iot-sec23/HubFuzzer"]}, {"cve": "CVE-2023-30787", "desc": "MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/introductions` endpoint and first_met_additional_info parameter.", "poc": ["https://fluidattacks.com/advisories/napoli"]}, {"cve": "CVE-2023-1162", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown function of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the argument password leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222258 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/xxy1126/Vuln/blob/main/Draytek/2.md"]}, {"cve": "CVE-2023-48621", "desc": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35156", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability.", "poc": ["https://jira.xwiki.org/browse/XWIKI-20341"]}, {"cve": "CVE-2023-1637", "desc": "A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks.", "poc": ["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e2a1256b17b16f9b9adf1b6fea56819e7b68e463"]}, {"cve": "CVE-2023-38482", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QualityUnit Post Affiliate Pro plugin <=\u00a01.25.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2193", "desc": "Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-31472", "desc": "An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied.", "poc": ["https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Creation.md"]}, {"cve": "CVE-2023-0018", "desc": "Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports containing a malicious payload. Once these reports are viewable, anyone who opens those reports would be susceptible to stored XSS attacks. As a result of the attack, information maintained in the victim's web browser can be read, modified, and sent to the attacker.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-39946", "desc": "eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PID_PROPERTY_LIST parameter that contains a CDR string with length larger than the size of actual content. In `eprosima::fastdds::dds::ParameterPropertyList_t::push_back_helper`, `memcpy` is called to first copy the octet'ized length and then to copy the data into `properties_.data`. At the second memcpy, both `data` and `size` can be controlled by anyone that sends the CDR string to the discovery multicast port. This can remotely crash any Fast-DDS process. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 contain a patch for this issue.", "poc": ["https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-j297-rg6j-m7hx", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24204", "desc": "SQL injection vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitrary code via the name parameter in get-quote.php.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-7194", "desc": "The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/e20292af-939a-4cb1-91e4-5ff6aa0c7fbe"]}, {"cve": "CVE-2023-1877", "desc": "Command Injection in GitHub repository microweber/microweber prior to 1.3.3.", "poc": ["https://huntr.dev/bounties/71fe4b3b-20ac-448c-8191-7b99d7ffaf55"]}, {"cve": "CVE-2023-6203", "desc": "The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request", "poc": ["https://wpscan.com/vulnerability/229273e6-e849-447f-a95a-0730969ecdae"]}, {"cve": "CVE-2023-28130", "desc": "Local user may lead to privilege escalation using Gaia Portal hostnames page.", "poc": ["http://packetstormsecurity.com/files/173918/Checkpoint-Gaia-Portal-R81.10-Remote-Command-Execution.html", "http://seclists.org/fulldisclosure/2023/Aug/4", "http://seclists.org/fulldisclosure/2023/Jul/43"]}, {"cve": "CVE-2023-35945", "desc": "Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy\u2019s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.", "poc": ["https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/zhaohuabing/cve-agent"]}, {"cve": "CVE-2023-26438", "desc": "External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could exploit this weakness to discover the existence of restricted network infrastructure and service availability. Improvements were made to include deny-lists not only during the check of the provided connection data, but also during use. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41179", "desc": "A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation.\nNote that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.", "poc": ["https://github.com/MiracleAnameke/Cybersecurity-Vulnerability-and-Exposure-Report", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/oxMdee/Cybersecurity-Vulnerability-and-Exposure-Report"]}, {"cve": "CVE-2023-5427", "desc": "Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a\u00a0local non-privileged user to make improper GPU processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r44p0 through r45p0; Valhall GPU Kernel Driver: from r44p0 through r45p0; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r45p0.", "poc": ["http://packetstormsecurity.com/files/176029/ARM-Mali-r44p0-Use-After-Free.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1163", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5 and classified as critical. Affected by this vulnerability is the function getSyslogFile of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222259. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/xxy1126/Vuln/blob/main/Draytek/3.md", "https://vuldb.com/?id.222259"]}, {"cve": "CVE-2023-5334", "desc": "The WP Responsive header image slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sp_responsiveslider' shortcode in versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2617", "desc": "A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-228547.", "poc": ["https://github.com/opencv/opencv_contrib/pull/3480"]}, {"cve": "CVE-2023-39983", "desc": "A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to v1.0.1. This vulnerability might allow an unauthenticated remote attacker to register or add devices via the nsm-web application.", "poc": ["https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1121", "desc": "The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/7ead9fb9-d81f-47c6-a1b4-21f29183cc15"]}, {"cve": "CVE-2023-1211", "desc": "SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.", "poc": ["https://huntr.dev/bounties/ed569124-2aeb-4b0d-a312-435460892afd"]}, {"cve": "CVE-2023-0076", "desc": "The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/a0a44f8a-877c-40df-a3ba-b9b806ffb772/"]}, {"cve": "CVE-2023-32436", "desc": "The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system termination or write kernel memory.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35885", "desc": "CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.", "poc": ["https://github.com/datackmy/FallingSkies-CVE-2023-35885", "https://www.datack.my/fallingskies-cloudpanel-0-day/", "https://github.com/Chocapikk/CVE-2023-35885", "https://github.com/Marco-zcl/POC", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Tropinene/Yscanner", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/datackmy/FallingSkies-CVE-2023-35885", "https://github.com/getdrive/PoC", "https://github.com/iluaster/getdrive_PoC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-"]}, {"cve": "CVE-2023-43345", "desc": "Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content - Name parameter in the Pages Menu component.", "poc": ["https://github.com/sromanhu/CVE-2023-43345-Quick-CMS-Stored-XSS---Pages-Content", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43345-Quick-CMS-Stored-XSS---Pages-Content"]}, {"cve": "CVE-2023-0285", "desc": "The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/adf09e29-baf5-4426-a281-6763c107d348"]}, {"cve": "CVE-2023-51018", "desc": "TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the \u2018opmode\u2019 parameter of the setWiFiApConfig interface of the cstecgi .cgi.", "poc": ["https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setWiFiApConfig-opmode/"]}, {"cve": "CVE-2023-29212", "desc": "XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the included documents edit panel. The problem has been patched on XWiki 14.4.7, and 14.10.", "poc": ["https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5f4-p5wv-2475"]}, {"cve": "CVE-2023-5654", "desc": "The React Developer Tools extension registers a message listener with window.addEventListener('message', ) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL\u2019s via the victim's browser.", "poc": ["https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231"]}, {"cve": "CVE-2023-31916", "desc": "Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem_heap_finalize at jerry-core/jmem/jmem-heap.c.", "poc": ["https://github.com/jerryscript-project/jerryscript/issues/5062", "https://github.com/EJueon/EJueon"]}, {"cve": "CVE-2023-3978", "desc": "Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.", "poc": ["https://github.com/knabben/dos-poc"]}, {"cve": "CVE-2023-27823", "desc": "An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.", "poc": ["https://packetstormsecurity.com/files/172276/Optoma-1080PSTX-Firmware-C02-Authentication-Bypass.html"]}, {"cve": "CVE-2023-30123", "desc": "wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.", "poc": ["https://github.com/wuzhicms/wuzhicms/issues/205#issue-1635153937"]}, {"cve": "CVE-2023-0795", "desc": "LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/493", "https://github.com/ARPSyndicate/cvemon", "https://github.com/peng-hui/CarpetFuzz", "https://github.com/waugustus/CarpetFuzz", "https://github.com/waugustus/waugustus"]}, {"cve": "CVE-2023-50026", "desc": "SQL injection vulnerability in Presta Monster \"Multi Accessories Pro\" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and before, allows remote attackers to escalate privileges and obtain sensitive information via the method HsAccessoriesGroupProductAbstract::getAccessoriesByIdProducts().", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50125", "desc": "A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed state.", "poc": ["https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices"]}, {"cve": "CVE-2023-48039", "desc": "GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75.", "poc": ["https://github.com/gpac/gpac/issues/2679"]}, {"cve": "CVE-2023-7115", "desc": "The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/6ddd1a9e-3f96-4020-9b2b-f818a4d5ba58/"]}, {"cve": "CVE-2023-24131", "desc": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey1_5g parameter at /goform/WifiBasicSet.", "poc": ["https://oxnan.com/posts/WifiBasic_wepkey1_5g_DoS"]}, {"cve": "CVE-2023-0588", "desc": "The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/84be272e-0891-461c-91ad-496b64f92f8f"]}, {"cve": "CVE-2023-21991", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html", "https://github.com/AtonceInventions/Hypervisor"]}, {"cve": "CVE-2023-26269", "desc": "Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user.Administrators are advised to disable JMX, or set up a JMX password.Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.", "poc": ["https://github.com/mbadanoiu/CVE-2023-26269", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5167", "desc": "The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/78ea6fe0-5fac-4923-949c-023c85fe2437"]}, {"cve": "CVE-2023-37528", "desc": "A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/kaje11/CVEs"]}, {"cve": "CVE-2023-42448", "desc": "Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close transaction), but no such check appears to be performed in the `checkClose` function of the head validator. This would allow a malicious participant to modify the contestation deadline of the head to either allow them to fanout the head without giving another participant the chance to contest, or prevent any participant from ever redistributing the funds locked in the head via a fan-out. Version 0.13.0 contains a patch for this issue.", "poc": ["https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0130---2023-10-03", "https://github.com/input-output-hk/hydra/security/advisories/GHSA-mgcx-6p7h-5996", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23300", "desc": "The `Toybox.Cryptography.Cipher.initialize` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overflows when copying data. A malicious application could call the API method with specially crafted parameters and hijack the execution of the device's firmware.", "poc": ["https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23300.md", "https://github.com/anvilsecure/garmin-ciq-app-research"]}, {"cve": "CVE-2023-44272", "desc": "A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the script may be executed on the web browser of the victim user.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6779", "desc": "An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. This issue affects glibc 2.37 and newer.", "poc": ["http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html", "http://seclists.org/fulldisclosure/2024/Feb/3", "https://www.openwall.com/lists/oss-security/2024/01/30/6", "https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2301", "desc": "The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.9.1. This is due to missing nonce validation on the ls_parse_vcita_callback function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita"]}, {"cve": "CVE-2023-24229", "desc": "** UNSUPPORTED WHEN ASSIGNED ** DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/sadwwcxz/Vul", "https://web.archive.org/web/20230315181013/https://github.com/sadwwcxz/Vul", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37939", "desc": "An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in\u00a0FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions and Mac 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions, 6.2 all versions, may allow a local authenticated attacker with no Administrative privileges to retrieve the list of\u00a0files or folders excluded from malware scanning.", "poc": ["https://github.com/sT0wn-nl/CVEs"]}, {"cve": "CVE-2023-48958", "desc": "gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url media_tools/mpd.c:4589.", "poc": ["https://github.com/gpac/gpac/issues/2689"]}, {"cve": "CVE-2023-43572", "desc": "A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-29824", "desc": "** DISPUTED ** A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor and discoverer indicate that this is not a security issue.", "poc": ["https://github.com/scipy/scipy/issues/14713", "https://github.com/scipy/scipy/issues/14713#issuecomment-1629468565", "https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2023-25233", "desc": "Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface.", "poc": ["https://github.com/Funcy33/Vluninfo_Repo/tree/main/CNVDs/113"]}, {"cve": "CVE-2023-20823", "desc": "In cmdq, there is a possible out of bounds read due to an incorrect status check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08021592; Issue ID: ALPS08021592.", "poc": ["https://github.com/Resery/Resery"]}, {"cve": "CVE-2023-33745", "desc": "TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection, simply entering the su command provides root access (without requiring a password).", "poc": ["http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html"]}, {"cve": "CVE-2023-50071", "desc": "Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/geraldoalcantara/CVE-2023-50071", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-28486", "desc": "Sudo before 1.9.13 does not escape control characters in log messages.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26436", "desc": "Attackers with access to the \"documentconverterws\" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processing the request. A check has been introduced to restrict processing of legal and expected classes for this API. We now log a warning in case there are attempts to inject illegal classes. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html"]}, {"cve": "CVE-2023-6787", "desc": "A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter \"prompt=login,\" prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting \"Restart login,\" an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34754", "desc": "bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins&action=edit.", "poc": ["https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability"]}, {"cve": "CVE-2023-37723", "desc": "Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromqossetting.", "poc": ["https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/fromqossetting/report.md"]}, {"cve": "CVE-2023-24320", "desc": "An access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via unspecified vectors.", "poc": ["https://yuyudhn.github.io/CVE-2023-24320/"]}, {"cve": "CVE-2023-6596", "desc": "An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41330", "desc": "knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page.## IssueOn March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. Version 1.4.2 added a check `if (\\strpos($filename, 'phar://') === 0)` in the `prepareOutput` function to resolve this CVE, however if the user is able to control the second parameter of the `generateFromHtml()` function of Snappy, it will then be passed as the `$filename` parameter in the `prepareOutput()` function. In the original vulnerability, a file name with a `phar://` wrapper could be sent to the `fileExists()` function, equivalent to the `file_exists()` PHP function. This allowed users to trigger a deserialization on arbitrary PHAR files. To fix this issue, the string is now passed to the `strpos()` function and if it starts with `phar://`, an exception is raised. However, PHP wrappers being case insensitive, this patch can be bypassed using `PHAR://` instead of `phar://`. A successful exploitation of this vulnerability allows executing arbitrary code and accessing the underlying filesystem. The attacker must be able to upload a file and the server must be running a PHP version prior to 8. This issue has been addressed in commit `d3b742d61a` which has been included in version 1.4.3. Users are advised to upgrade. Users unable to upgrade should ensure that only trusted users may submit data to the `AbstractGenerator->generate(...)` function.", "poc": ["https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj", "https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc"]}, {"cve": "CVE-2023-43323", "desc": "mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, data[wall_photo], data[userShareVideo] and data[userShareLink].", "poc": ["https://github.com/ahrixia/CVE-2023-43323", "https://github.com/ahrixia/CVE-2023-43323", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3831", "desc": "A vulnerability was found in Bug Finder Finounce 1.0 and classified as problematic. This issue affects some unknown processing of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2826", "desc": "A vulnerability has been found in SourceCodester Class Scheduling System 1.0 and classified as problematic. This vulnerability affects unknown code of the file search_teacher_result.php of the component POST Parameter Handler. The manipulation of the argument teacher leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229612.", "poc": ["https://vuldb.com/?id.229612"]}, {"cve": "CVE-2023-6942", "desc": "Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 and later, FR Configurator2 all versions, GT Designer3 Version1(GOT1000) all versions, GT Designer3 Version1(GOT2000) all versions, GX Works2 versions 1.11M and later, GX Works3 all versions, MELSOFT Navigator versions 1.04E and later, MT Works2 all versions, MX Component versions 4.00A and later and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to bypass authentication by sending specially crafted packets and connect to the products illegally.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45647", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in MailMunch Constant Contact Forms by MailMunch plugin <=\u00a02.0.10 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49411", "desc": "Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode.", "poc": ["https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_deleteMesh/w30e_deleteMesh.md"]}, {"cve": "CVE-2023-43641", "desc": "libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.", "poc": ["http://packetstormsecurity.com/files/176128/libcue-2.2.1-Out-Of-Bounds-Access.html", "https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/", "https://github.com/lipnitsk/libcue/security/advisories/GHSA-5982-x7hv-r9cj", "https://github.com/0xKilty/RE-learning-resources", "https://github.com/0xlino/0xlino", "https://github.com/CraigTeelFugro/CraigTeelFugro", "https://github.com/goupadhy/UK-Digital-AppInnovation-NewsLetter", "https://github.com/kherrick/hacker-news", "https://github.com/kherrick/lobsters", "https://github.com/mshick/mshick"]}, {"cve": "CVE-2023-1960", "desc": "A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225347.", "poc": ["https://vuldb.com/?id.225347"]}, {"cve": "CVE-2023-1350", "desc": "A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.", "poc": ["https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59"]}, {"cve": "CVE-2023-46927", "desc": "GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in gpac/MP4Box.", "poc": ["https://github.com/gpac/gpac/issues/2657", "https://github.com/raulvillalpando/BufferOverflow"]}, {"cve": "CVE-2023-28637", "desc": "DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to remote code execution. This vulnerability has been fixed in v1.18.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/dataease/dataease/security/advisories/GHSA-8wg2-9gwc-5fx2"]}, {"cve": "CVE-2023-21961", "desc": "Vulnerability in the Oracle Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Administration and EAS Console). The supported version that is affected is 21.4.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Essbase Administration Services executes to compromise Oracle Hyperion Essbase Administration Services. While the vulnerability is in Oracle Hyperion Essbase Administration Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Essbase Administration Services accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-40197", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Devaldi Ltd flowpaper plugin <=\u00a01.9.9 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36053", "desc": "In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.", "poc": ["https://github.com/ch4n3-yoon/ch4n3-yoon", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-40902", "desc": "Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52131", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Zinc Page Generator.This issue affects Page Generator: from n/a through 1.7.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21266", "desc": "In killBackgroundProcesses of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-40215", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Demonisblack demon image annotation allows SQL Injection.This issue affects demon image annotation: from n/a through 5.1.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-47322", "desc": "The \"userModify\" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application.", "poc": ["https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47322", "https://github.com/RhinoSecurityLabs/CVEs"]}, {"cve": "CVE-2023-40766", "desc": "User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46776", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Serena Villa Auto Excerpt everywhere plugin <=\u00a01.5 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30788", "desc": "MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people/add` endpoint and nickName, description, lastName, middleName and firstName parameter.", "poc": ["https://fluidattacks.com/advisories/napoli"]}, {"cve": "CVE-2023-29963", "desc": "S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.", "poc": ["https://github.com/superjock1988/debug/blob/main/s-cms_rce.md"]}, {"cve": "CVE-2023-31242", "desc": "An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a sequence of requests to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1769"]}, {"cve": "CVE-2023-6921", "desc": "Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attack is possible via command insertion in one of the cookies.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21887", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zwxxb/CVE-2023-21887"]}, {"cve": "CVE-2023-38312", "desc": "A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the underlying server via the motdfile console variable.", "poc": ["https://github.com/MikeIsAStar/Counter-Strike-Arbitrary-File-Read"]}, {"cve": "CVE-2023-45779", "desc": "In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. More details on this can be found in the referenced links.", "poc": ["https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-wmcc-g67r-9962", "https://rtx.meta.security/exploitation/2024/01/30/Android-vendors-APEX-test-keys.html", "https://github.com/metaredteam/rtx-cve-2023-45779", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26443", "desc": "Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single quotes for SQL FULLTEXT queries. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0280", "desc": "The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/cb7ed9e6-0fa0-4ebb-9109-8f33defc8b32"]}, {"cve": "CVE-2023-21861", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). Supported versions that are affected are 5.9.0.0.0 and 6.4.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-32845", "desc": "In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01128524; Issue ID: MOLY01139296 (MSV-860).", "poc": ["https://github.com/AEPP294/5ghoul-5g-nr-attacks", "https://github.com/Shangzewen/U-Fuzz", "https://github.com/asset-group/5ghoul-5g-nr-attacks", "https://github.com/asset-group/U-Fuzz"]}, {"cve": "CVE-2023-40815", "desc": "OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.", "poc": ["https://www.esecforte.com/cve-2023-40815-html-injection-category/"]}, {"cve": "CVE-2023-28222", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["https://github.com/Wh04m1001/CVE-2023-29343"]}, {"cve": "CVE-2023-24709", "desc": "An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters.", "poc": ["http://packetstormsecurity.com/files/171783/Paradox-Security-Systems-IPR512-Denial-Of-Service.html", "https://github.com/SlashXzerozero/Injection-vulnerability-in-Paradox-Security-Systems-IPR512", "https://github.com/sunktitanic/Injection-vulnerability-in-Paradox-Security-Systems-IPR512", "https://github.com/ARPSyndicate/cvemon", "https://github.com/DRAGOWN/Injection-vulnerability-in-Paradox-Security-Systems-IPR512-CVE-2023-24709-PoC", "https://github.com/SlashXzerozero/Injection-vulnerability-in-Paradox-Security-Systems-IPR512", "https://github.com/SlashXzerozero/Injection-vulnerability-in-Paradox-Security-Systems-IPR512-CVE-2023-24709-PoC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-47545", "desc": "Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Forms for Mailchimp by Optin Cat \u2013 Grow Your MailChimp List plugin <=\u00a02.5.4 versions.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-3491", "desc": "Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3.", "poc": ["https://huntr.dev/bounties/043bd900-ac78-44d2-a340-84ddd0bc4a1d"]}, {"cve": "CVE-2023-49288", "desc": "Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with \"collapsed_forwarding on\" are vulnerable. Configurations with \"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.", "poc": ["https://github.com/MegaManSec/Squid-Security-Audit"]}, {"cve": "CVE-2023-41819", "desc": "A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local attacker to access unauthorized content providers.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1595", "desc": "A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/log/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223663.", "poc": ["https://github.com/1610349395/novel-plus-v3.6.2----Background-SQL-Injection-Vulnerability-/blob/main/novel-plus%20v3.6.2%20--%20Background%20SQL%20Injection%20Vulnerability.md", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-6676", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in National Keep Cyber Security Services CyberMath allows Cross Site Request Forgery.This issue affects CyberMath: from v1.4 before v1.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6209", "desc": "Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal \"/../\" part in the path could be used to override the specified host. This could contribute to security problems in web sites. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.", "poc": ["https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-43515", "desc": "Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25192", "desc": "AMI MegaRAC SPX devices allow User Enumeration through Redfish. The fixed versions are SPx12-update-7.00 and SPx13-update-5.00.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/chnzzh/Redfish-CVE-lib"]}, {"cve": "CVE-2023-44339", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30112", "desc": "Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection.", "poc": ["https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-mts_0.zip"]}, {"cve": "CVE-2023-46862", "desc": "An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49934", "desc": "An issue was discovered in SchedMD Slurm 23.11.x. There is SQL Injection against the SlurmDBD database. The fixed version is 23.11.1.", "poc": ["https://github.com/EGI-Federation/SVG-advisories"]}, {"cve": "CVE-2023-33790", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.", "poc": ["https://github.com/anhdq201/netbox/issues/9"]}, {"cve": "CVE-2023-27271", "desc": "In\u00a0SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-0848", "desc": "A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Management Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221147.", "poc": ["https://vuldb.com/?id.221147"]}, {"cve": "CVE-2023-46663", "desc": "Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"]}, {"cve": "CVE-2023-25480", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor plugin <=\u00a01.24.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6179", "desc": "Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potentially exploit this vulnerability, leading to a standard user to have\u00a0arbitrary system code execution. Honeywell recommends updating to the most recent version of this product, service or offering (Pro-watch 6.0.2, 6.0, 5.5.2,5.0.5).", "poc": ["https://www.honeywell.com/us/en/product-security"]}, {"cve": "CVE-2023-51463", "desc": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32653", "desc": "An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1802"]}, {"cve": "CVE-2023-5302", "desc": "A vulnerability, which was classified as problematic, has been found in SourceCodester Best Courier Management System 1.0. This issue affects some unknown processing of the component Manage Account Page. The manipulation of the argument First Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240941 was assigned to this vulnerability.", "poc": ["https://github.com/rohit0x5/poc/blob/main/cve_2", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/r0x5r/poc", "https://github.com/r0x5r/r0x5r", "https://github.com/rohit0x5/poc", "https://github.com/rohit0x5/rohit0x5"]}, {"cve": "CVE-2023-30362", "desc": "Buffer Overflow vulnerability in coap_send function in libcoap library 4.3.1-103-g52cfd56 fixed in 4.3.1-120-ge242200 allows attackers to obtain sensitive information via malformed pdu.", "poc": ["https://github.com/obgm/libcoap/issues/1063"]}, {"cve": "CVE-2023-7152", "desc": "A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30705", "desc": "Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access privileged content providers as Galaxy Store permission.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34216", "desc": "TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability derives from insufficient input validation in the key-delete function, which could potentially allow malicious users to delete arbitrary files.", "poc": ["https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities", "https://github.com/3sjay/vulns"]}, {"cve": "CVE-2023-21396", "desc": "In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47014", "desc": "A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 allows a local attacker to obtain sensitive information via a crafted payload to add-note.php.", "poc": ["https://github.com/emirhanerdogu/CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS/blob/main/README.md", "https://github.com/emirhanerdogu/CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-24334", "desc": "A stack overflow vulnerability in Tenda AC23 with firmware version US_AC23V1.0re_V16.03.07.45_cn_TDC01 allows attackers to run arbitrary commands via schedStartTime parameter.", "poc": ["https://github.com/caoyebo/CVE/tree/main/TENDA%20AC23%20-%20CVE-2023-24334"]}, {"cve": "CVE-2023-36535", "desc": "Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1900", "desc": "A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow. This could corrupt the data on the heap and lead to a denial-of-service situation. Issue was fixed with Endpointprotection.exe version 1.0.2303.633", "poc": ["https://support.norton.com/sp/static/external/tools/security-advisories.html"]}, {"cve": "CVE-2023-49777", "desc": "Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44090", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817. This vulnerability allowed SQL changes to be made to several files in the Grafana module. This issue affects Pandora FMS: from 700 through <776.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-38695", "desc": "cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in version 8.0.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6456", "desc": "The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/30f31412-8f94-4d5e-a080-3f6f669703cd/"]}, {"cve": "CVE-2023-45696", "desc": "Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20189", "desc": "Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sg-web-multi-S9g4Nkgv"]}, {"cve": "CVE-2023-4103", "desc": "QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30696", "desc": "An improper input validation in IpcTxGetVerifyAkey in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds write.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6127", "desc": "Unrestricted Upload of File with Dangerous Type in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.", "poc": ["https://huntr.com/bounties/bf10c72b-5d2e-4c9a-9bd6-d77bdf31027d"]}, {"cve": "CVE-2023-43297", "desc": "An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29491", "desc": "ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.", "poc": ["http://www.openwall.com/lists/oss-security/2023/04/19/11", "https://github.com/ARPSyndicate/cvemon", "https://github.com/seal-community/patches", "https://github.com/yo-yo-yo-jbo/yo-yo-yo-jbo.github.io"]}, {"cve": "CVE-2023-42467", "desc": "QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2711", "desc": "The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/71c5b5b5-8694-4738-8e4b-8670a8d21c86"]}, {"cve": "CVE-2023-29950", "desc": "swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules/swftools.c", "poc": ["https://github.com/matthiaskramm/swftools/issues/198"]}, {"cve": "CVE-2023-22017", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.46 and Prior to 7.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: This vulnerability applies to Windows VMs only. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-26145", "desc": "This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.\n**Note:**\nThe pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:\n1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)\n2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)\nThe pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.", "poc": ["https://gist.github.com/CalumHutton/45d33e9ea55bf4953b3b31c84703dfca", "https://security.snyk.io/vuln/SNYK-PYTHON-PYDASH-5916518"]}, {"cve": "CVE-2023-1538", "desc": "Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.", "poc": ["https://huntr.dev/bounties/ac0271eb-660f-4966-8b57-4bc660a9a1a0"]}, {"cve": "CVE-2023-6017", "desc": "H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.", "poc": ["https://huntr.com/bounties/6a69952f-a1ba-4dee-9d8c-e87f52508b58"]}, {"cve": "CVE-2023-34213", "desc": "TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the key-generation function, which could potentially allow malicious users to execute remote code on affected devices.", "poc": ["https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities", "https://github.com/3sjay/vulns"]}, {"cve": "CVE-2023-0272", "desc": "The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/047b50c0-0eb3-4371-9e5d-3778fdafc66b"]}, {"cve": "CVE-2023-32119", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPO365 | Mail Integration for Office 365 / Outlook plugin <=\u00a01.9.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48380", "desc": "Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44018", "desc": "Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the domain parameter in the add_white_node function.", "poc": ["https://github.com/aixiao0621/Tenda/blob/main/AC10U/10/0.md", "https://github.com/aixiao0621/Tenda"]}, {"cve": "CVE-2023-46688", "desc": "Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0107", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.", "poc": ["https://huntr.dev/bounties/0b28fa57-acb0-47c8-ac48-962ff3898156"]}, {"cve": "CVE-2023-0792", "desc": "Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-4720", "desc": "Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.", "poc": ["https://huntr.dev/bounties/1dc2954c-8497-49fa-b2af-113e1e9381ad"]}, {"cve": "CVE-2023-40970", "desc": "Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php.", "poc": ["https://github.com/slims/slims9_bulian/issues/205"]}, {"cve": "CVE-2023-3069", "desc": "Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.", "poc": ["https://huntr.dev/bounties/00544982-365a-476b-b5fe-42f02f11d367"]}, {"cve": "CVE-2023-47265", "desc": "Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG.\u00a0This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user looking at the DAG details sees in the browser - which opens up all kinds of possibilities of misleading other users.Users of Apache Airflow are recommended to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20097", "desc": "A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-27448", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in MakeStories Team MakeStories (for Google Web Stories) plugin <=\u00a02.8.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22424", "desc": "Use-after-free vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier. With the abnormal value given as the maximum number of columns for the PLC program, the process accesses the freed memory. As a result, opening a specially crafted project file may lead to information disclosure and/or arbitrary code execution.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-4749", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238638 is the identifier assigned to this vulnerability.", "poc": ["https://skypoc.wordpress.com/2023/09/03/%e3%80%90code-audit%e3%80%91open-source-ample-inventory-management-system-v1-0-by-mayuri_k-has-a-file-inclusion-vulnerability/"]}, {"cve": "CVE-2023-26439", "desc": "The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached data. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39356", "desc": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code to validate if the value `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5v5-qhj5-mh6m"]}, {"cve": "CVE-2023-46977", "desc": "TOTOLINK LR1200GB V9.1.0u.6619_B20230130 was discovered to contain a stack overflow via the password parameter in the function loginAuth.", "poc": ["https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20LR1200GB/1/README.md"]}, {"cve": "CVE-2023-4504", "desc": "Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023.", "poc": ["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h", "https://github.com/OpenPrinting/libppd/security/advisories/GHSA-4f65-6ph5-qwh6", "https://takeonme.org/cves/CVE-2023-4504.html", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-3802", "desc": "A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Controller/Ajaxfileupload.ashx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235070 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.235070"]}, {"cve": "CVE-2023-0049", "desc": "Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.", "poc": ["https://huntr.dev/bounties/5e6f325c-ba54-4bf0-b050-dca048fd3fd9", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-42358", "desc": "An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the E2Manager API component.", "poc": ["https://jira.o-ran-sc.org/browse/RIC-1009"]}, {"cve": "CVE-2023-48208", "desc": "A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin_sms_api_key, plugin_sms_country_code, uuid, title, or country name parameter to index.php.", "poc": ["http://packetstormsecurity.com/files/175805"]}, {"cve": "CVE-2023-0514", "desc": "The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/c6cc400a-9bfb-417d-9206-5582a49d0f05"]}, {"cve": "CVE-2023-3177", "desc": "A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin\\inquiries\\view_inquiry.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231151.", "poc": ["https://github.com/AnotherN/cvv/blob/main/imgs/Lost%20and%20Found%20Information%20System%20-%20multiple%20vulnerabilities.md#4sql-injection-vulnerability-in-admininquiriesview_inquiryphp", "https://vuldb.com/?id.231151"]}, {"cve": "CVE-2023-49236", "desc": "A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. This occurs because of lack of length validation during an sscanf of a user-entered scale field in the RTSP playback function of davinci.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45467", "desc": "Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings.", "poc": ["https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20ntpServIP%20parameter%20in%20Time%20Settings%20.md", "https://github.com/Luwak-IoT-Security/CVEs"]}, {"cve": "CVE-2023-5229", "desc": "The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed", "poc": ["https://wpscan.com/vulnerability/fb6ce636-9e0d-4c5c-bb95-dde1d2581245"]}, {"cve": "CVE-2023-38490", "desc": "Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.XML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).Kirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation. The `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`). Both the vulnerable method and the data handler are not used in the Kirby core. However they may be used in site or plugin code, e.g. to parse RSS feeds or other XML files. If those files are of an external origin (e.g. uploaded by a user or retrieved from an external URL), attackers may be able to include an external entity in the XML file that will then be processed in the parsing process. Kirby sites that don't use XML parsing in site or plugin code are *not* affected.The problem has been patched in Kirby 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. In all of the mentioned releases, the maintainers have removed the `LIBXML_NOENT` constant as processing of external entities is out of scope of the parsing logic. This protects all uses of the method against the described vulnerability.", "poc": ["https://github.com/Acceis/exploit-CVE-2023-38490", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-25718", "desc": "** DISPUTED ** In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations. NOTE: this may overlap CVE-2023-25719. NOTE: the vendor's position is that this purported vulnerability represents a \"fundamental lack of understanding of Authenticode code signing behavior.\"", "poc": ["https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/", "https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40628", "desc": "A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6856", "desc": "The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", "poc": ["https://github.com/dlehgus1023/dlehgus1023"]}, {"cve": "CVE-2023-52371", "desc": "Vulnerability of null references in the motor module.Successful exploitation of this vulnerability may affect availability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21954", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-26846", "desc": "A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at opencats/index.php?m=candidates.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/cassis-sec/CVE", "https://github.com/cassis-sec/cassis-sec"]}, {"cve": "CVE-2023-26982", "desc": "Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/bypazs/CVE-2023-26982", "https://github.com/bypazs/Duplicate-of-CVE-2023-26982", "https://github.com/bypazs/bypazs", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-43148", "desc": "SPA-Cart 1.9.0.3 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to delete all accounts.", "poc": ["https://github.com/MinoTauro2020/CVE-2023-43148", "https://github.com/MinoTauro2020/CVE-2023-43147", "https://github.com/MinoTauro2020/CVE-2023-43148", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-23536", "desc": "The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/Balistic123/Iphone11IOS16.1KFDFONT", "https://github.com/Phuc559959d/kfund", "https://github.com/Spoou/123", "https://github.com/ZZY3312/CVE-2023-32434", "https://github.com/evelyneee/kfd-on-crack", "https://github.com/felix-pb/kfd", "https://github.com/larrybml/test1", "https://github.com/vftable/kfund", "https://github.com/vntrcl/kfund"]}, {"cve": "CVE-2023-0915", "desc": "A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. Affected is an unknown function of the file /adms/admin/?page=user/manage_user. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221490 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Auto%20Dealer%20Management%20System%20-%20SQL%20Injection%20-%203.md", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-5317", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.", "poc": ["https://huntr.dev/bounties/5e146e7c-60c7-498b-9ffe-fd4cb4ca8c54"]}, {"cve": "CVE-2023-4658", "desc": "An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/423835", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38891", "desc": "SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php.", "poc": ["https://github.com/jselliott/CVE-2023-38891", "https://github.com/jselliott/CVE-2023-38891", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38426", "desc": "An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length.", "poc": ["https://github.com/chenghungpan/test_data"]}, {"cve": "CVE-2023-36692", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Kramer & Hendrik Thole WP-Cirrus plugin <=\u00a00.6.11 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-1945", "desc": "Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-34998", "desc": "An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary authentication. An attacker can sniff network traffic to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1770"]}, {"cve": "CVE-2023-25482", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Mike Martel WP Tiles plugin <=\u00a01.1.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5824", "desc": "Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling of Structural Elements bug.", "poc": ["https://github.com/MegaManSec/Squid-Security-Audit", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45853", "desc": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.", "poc": ["https://github.com/DmitryIll/shvirtd-example-python", "https://github.com/GrigGM/05-virt-04-docker-hw", "https://github.com/bariskanber/zlib-1.3-deb", "https://github.com/bartvoet/assignment-ehb-security-review-adamlenez", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/fokypoky/places-list", "https://github.com/jina-ai/reader", "https://github.com/marklogic/marklogic-kubernetes", "https://github.com/shakyaraj9569/Documentation"]}, {"cve": "CVE-2023-38419", "desc": "An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "poc": ["https://github.com/DojoSecurity/DojoSecurity", "https://github.com/afine-com/research"]}, {"cve": "CVE-2023-45511", "desc": "A memory leak in tsMuxer version git-2539d07 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.", "poc": ["https://github.com/justdan96/tsMuxer/issues/780"]}, {"cve": "CVE-2023-3154", "desc": "The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.", "poc": ["https://wpscan.com/vulnerability/ed099489-1db4-4b42-9f72-77de39c9e01e"]}, {"cve": "CVE-2023-0067", "desc": "The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/92f43da9-9903-4bcf-99e8-0e269072d389"]}, {"cve": "CVE-2023-25468", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Reservation.Studio Reservation.Studio widget plugin <=\u00a01.0.11 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6254", "desc": "A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response-This issue affects OTRS: from 8.0.X through 8.0.37.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27703", "desc": "The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface.", "poc": ["https://github.com/happy0717/CVE-2023-27703", "https://github.com/jiayy/android_vuln_poc-exp", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4435", "desc": "Improper Input Validation in GitHub repository hamza417/inure prior to build88.", "poc": ["https://huntr.dev/bounties/1875ee85-4b92-4aa4-861e-094137a29276", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41250", "desc": "In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25082", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the firewall_handler_set function with the old_ip and old_mac variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-21988", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-47211", "desc": "A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52135", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WS Form WS Form LITE \u2013 Drag & Drop Contact Form Builder for WordPress.This issue affects WS Form LITE \u2013 Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42496", "desc": "Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22903", "desc": "api/views/user.py in LibrePhotos before e19e539 has incorrect access control.", "poc": ["https://github.com/go-compile/security-advisories"]}, {"cve": "CVE-2023-0017", "desc": "An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current system. This could allow the attacker to have full read access to user data, make modifications to user data, and make services within the system unavailable.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-25984", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Rigorous & Factory Pattern Dovetail plugin <=\u00a01.2.13 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22835", "desc": "A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caused loss of frontend functionality to all issue participants.This defect was resolved with the release of Foundry Issues 2.510.0 and Foundry Frontend 6.228.0.", "poc": ["https://palantir.safebase.us/?tcuUid=0e2e79bd-cc03-42a8-92c2-c0e68a1ea53d"]}, {"cve": "CVE-2023-21912", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.41 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-7203", "desc": "The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.", "poc": ["https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/"]}, {"cve": "CVE-2023-31068", "desc": "An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILES(X86)%\\TSplus\\UserDesktop\\themes.", "poc": ["http://packetstormsecurity.com/files/174272/TSPlus-16.0.0.0-Insecure-Permissions.html", "https://www.exploit-db.com/exploits/51680"]}, {"cve": "CVE-2023-4513", "desc": "BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file", "poc": ["https://gitlab.com/wireshark/wireshark/-/issues/19259", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3766", "desc": "A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker\u00a0with knowledge of this vulnerability to craft and send specially designed encrypted queries to targeted ODOH servers running with odoh-rs. Upon successful exploitation, the server will crash abruptly, disrupting its normal operation and rendering the service temporarily unavailable.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33263", "desc": "In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WFTPD directory. NOTE: this is a product from 2006.", "poc": ["https://packetstormsecurity.com/files/172560/WFTPD-3.25-Credential-Disclosure.html"]}, {"cve": "CVE-2023-36003", "desc": "XAML Diagnostics Elevation of Privilege Vulnerability", "poc": ["https://github.com/aneasystone/github-trending", "https://github.com/baph0m3th/CVE-2023-36003", "https://github.com/johe123qwe/github-trending", "https://github.com/m417z/CVE-2023-36003-POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/s3mPr1linux/CVE_2023_360003_POC", "https://github.com/zengzzzzz/golang-trending-archive", "https://github.com/zhaoxiaoha/github-trending"]}, {"cve": "CVE-2023-45813", "desc": "Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument. An attacker can use a well-crafted URL argument to exploit the vulnerability in the regular expression and cause a Denial of Service on the system. The validators file has been removed in version 4.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/DedSecInside/TorBot/security/advisories/GHSA-72qw-p7hh-m3ff", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4354", "desc": "Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/174949/Chrome-SKIA-Integer-Overflow.html"]}, {"cve": "CVE-2023-40890", "desc": "A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.", "poc": ["https://hackmd.io/@cspl/H1PxPAUnn", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48849", "desc": "Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering.", "poc": ["https://github.com/delsploit/CVE-2023-48849", "https://github.com/delsploit/CVE-2023-48849", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-48813", "desc": "Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.", "poc": ["https://github.com/slims/slims9_bulian/issues/217"]}, {"cve": "CVE-2023-2338", "desc": "SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/bbf59fa7-cf5b-4945-81b0-328adc710462"]}, {"cve": "CVE-2023-49988", "desc": "Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49988", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0928", "desc": "Use after free in SwiftShader in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-45246", "desc": "Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 36343.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/password123456/cve-collector"]}, {"cve": "CVE-2023-45012", "desc": "Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.\u00a0The 'user_email' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23634", "desc": "SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0066/"]}, {"cve": "CVE-2023-20119", "desc": "A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\nThis vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25950", "desc": "HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.", "poc": ["https://github.com/dhmosfunk/HTTP3ONSTEROIDS", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38765", "desc": "SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-40335", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Jeremy O'Connell Cleverwise Daily Quotes allows Stored XSS.This issue affects Cleverwise Daily Quotes: from n/a through 3.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44084", "desc": "A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33137", "desc": "Microsoft Excel Remote Code Execution Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/JaqueMalman/CVE-2023-33137", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1175", "desc": "Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.", "poc": ["https://huntr.dev/bounties/7e93fc17-92eb-4ae7-b01a-93bb460b643e"]}, {"cve": "CVE-2023-0748", "desc": "Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.", "poc": ["https://huntr.dev/bounties/1a0403b6-9ec9-4587-b559-b1afba798c86", "https://github.com/ARPSyndicate/cvemon", "https://github.com/gonzxph/CVE-2023-0748", "https://github.com/k0mi-tg/CVE-POC", "https://github.com/manas3c/CVE-POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/whoforget/CVE-POC", "https://github.com/youwizard/CVE-POC"]}, {"cve": "CVE-2023-31801", "desc": "Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.", "poc": ["https://github.com/msegoviag/discovered-vulnerabilities", "https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-45811", "desc": "Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in `deobfuscator@2.4.4`. Users are advised to upgrade. Users unable to upgrade should launch node with the [--disable-proto=delete][disable-proto] or [--disable-proto=throw][disable-proto] flags", "poc": ["https://github.com/relative/synchrony/security/advisories/GHSA-jg82-xh3w-rhxx"]}, {"cve": "CVE-2023-6340", "desc": "SonicWall Capture Client version 3.7.10,\u00a0NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has been found to be vulnerable to Denial-of-Service (DoS) caused by Stack-based Buffer Overflow vulnerability.", "poc": ["https://github.com/ayhan-dev/CVE-LIST"]}, {"cve": "CVE-2023-43994", "desc": "An issue in Cleaning_makotoya mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33956", "desc": "Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any other user, regardless of their privileges or restrictions. By Changing the file_id any user can render all the files where MimeType is image uploaded under **/files** directory regard less of uploaded by any user. This vulnerability poses a significant impact and severity to the application's security. By manipulating the URL parameter, an attacker can access sensitive files that should only be available to authorized users. This includes confidential documents or any other type of file stored within the application. The ability to read these files can lead to various detrimental consequences, such as unauthorized disclosure of sensitive information, privacy breaches, intellectual property theft, or exposure of trade secrets. Additionally, it could result in legal and regulatory implications, reputation damage, financial losses, and potential compromise of user trust. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/kanboard/kanboard/security/advisories/GHSA-r36m-44gg-wxg2"]}, {"cve": "CVE-2023-39541", "desc": "A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv6 ICMPv6 packet.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24585", "desc": "An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1725"]}, {"cve": "CVE-2023-38293", "desc": "Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com.tracfone.tfstatus (versionCode='31', versionName='12') that allows local third-party apps to execute arbitrary AT commands in its context (radio user) via AT command injection due to inadequate access control and inadequate input filtering. No permissions or special privileges are necessary to exploit the vulnerability in the com.tracfone.tfstatus app. No user interaction is required beyond installing and running a third-party app. The software build fingerprints for each confirmed vulnerable device are as follows: Nokia C200 (Nokia/Drake_02US/DRK:12/SP1A.210812.016/02US_1_080:user/release-keys and Nokia/Drake_02US/DRK:12/SP1A.210812.016/02US_1_040:user/release-keys) and Nokia C100 (Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_270:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_190:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_130:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_110:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_080:user/release-keys, and Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_050:user/release-keys). This malicious app sends a broadcast Intent to the receiver component named com.tracfone.tfstatus/.TFStatus. This broadcast receiver extracts a string from the Intent and uses it as an extra when it starts the com.tracfone.tfstatus/.TFStatusActivity activity component which uses the externally controlled string as an input to execute an AT command. There are two different injection techniques to successfully inject arbitrary AT commands to execute.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3007", "desc": "A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument sid leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230354 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/student-management-system/password_reset.md"]}, {"cve": "CVE-2023-31036", "desc": "NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2340", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/964762b0-b4fe-441c-81e1-0ebdbbf80f3b"]}, {"cve": "CVE-2023-4503", "desc": "An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39368", "desc": "Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable denial of service via network access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45587", "desc": "An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 allows attacker to execute unauthorized code or commands via crafted HTTP requests", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1594", "desc": "A vulnerability, which was classified as critical, was found in novel-plus 3.6.2. Affected is the function MenuService of the file sys/menu/list. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223662 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/OYyunshen/Poc/blob/main/Novel-PlusV3.6.2Sqli.pdf", "https://vuldb.com/?id.223662", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-43876", "desc": "A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.", "poc": ["https://github.com/sromanhu/October-CMS-Reflected-XSS---Installation/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43876-October-CMS-Reflected-XSS---Installation"]}, {"cve": "CVE-2023-29510", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged contexts without any escaping which allows remote code execution for any user who has edit access on at least one document which could be the user's own profile where edit access is enabled by default. A mitigation for this vulnerability is part of XWiki 14.10.2 and XWiki 15.0 RC1: translations with user scope now require script right. This means that regular users cannot exploit this anymore as users don't have script right by default anymore starting with XWiki 14.10. There are no known workarounds apart from upgrading to a patched versions.", "poc": ["https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4v38-964c-xjmw"]}, {"cve": "CVE-2023-49548", "desc": "Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?action=save_user.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49548", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2472", "desc": "The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when the WPML plugin is also active and configured, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/b0e7665a-c8c3-4132-b8d7-8677a90118df"]}, {"cve": "CVE-2023-22745", "desc": "tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege.", "poc": ["https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-4j3v-fh23-vx67"]}, {"cve": "CVE-2023-24348", "desc": "D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetACLFilter.", "poc": ["https://github.com/1160300418/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/02"]}, {"cve": "CVE-2023-26769", "desc": "Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of service via the resolveSubtable function at compileTranslationTabel.c.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Marsman1996/pocs"]}, {"cve": "CVE-2023-52608", "desc": "In the Linux kernel, the following vulnerability has been resolved:firmware: arm_scmi: Check mailbox/SMT channel for consistencyOn reception of a completion interrupt the shared memory area is accessedto retrieve the message header at first and then, if the message sequencenumber identifies a transaction which is still pending, the relatedpayload is fetched too.When an SCMI command times out the channel ownership remains with theplatform until eventually a late reply is received and, as a consequence,any further transmission attempt remains pending, waiting for the channelto be relinquished by the platform.Once that late reply is received the channel ownership is given backto the agent and any pending request is then allowed to proceed andoverwrite the SMT area of the just delivered late reply; then the waitfor the reply to the new request starts.It has been observed that the spurious IRQ related to the late reply canbe wrongly associated with the freshly enqueued request: when that happensthe SCMI stack in-flight lookup procedure is fooled by the fact that themessage header now present in the SMT area is related to the new pendingtransaction, even though the real reply has still to arrive.This race-condition on the A2P channel can be detected by looking at thechannel status bits: a genuine reply from the platform will have set thechannel free bit before triggering the completion IRQ.Add a consistency check to validate such condition in the A2P ISR.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43278", "desc": "A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.", "poc": ["https://blog.csdn.net/sugaryzheng/article/details/133283101?spm=1001.2014.3001.5501"]}, {"cve": "CVE-2023-0406", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.", "poc": ["https://huntr.dev/bounties/d7007f76-3dbc-48a7-a2fb-377040fe100c", "https://github.com/ARPSyndicate/cvemon", "https://github.com/bAuh0lz/Vulnerabilities"]}, {"cve": "CVE-2023-4652", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.", "poc": ["https://huntr.dev/bounties/7869e4af-fad9-48c3-9e4f-c949e54cbb41"]}, {"cve": "CVE-2023-3292", "desc": "The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/d993c385-c3ad-49a6-b079-3a1b090864c8"]}, {"cve": "CVE-2023-5809", "desc": "The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/f1eb05e8-1b7c-45b1-912d-f668bd68e265"]}, {"cve": "CVE-2023-21929", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-36462", "desc": "Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38562", "desc": "A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network packets can lead to memory corruption, potentially resulting in code execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5601", "desc": "The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.", "poc": ["https://wpscan.com/vulnerability/0035ec5e-d405-4eb7-8fe4-29dd0c71e4bc", "https://github.com/codeb0ss/CVE-2023-5601-PoC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-28744", "desc": "A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289. A specially crafted PDF document can trigger the reuse of previously freed memory by manipulating form fields of a specific type. This can lead to memory corruption and arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1739"]}, {"cve": "CVE-2023-30967", "desc": "Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system.", "poc": ["https://palantir.safebase.us/?tcuUid=8fd5809f-26f8-406e-b36f-4a6596a19d79"]}, {"cve": "CVE-2023-32699", "desc": "MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. \u200bThe `checkUserPassword` method is used to check whether the password provided by the user matches the password saved in the database, and the `CodingUtil.md5` method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length.", "poc": ["https://github.com/metersphere/metersphere/security/advisories/GHSA-qffq-8gf8-mhq7"]}, {"cve": "CVE-2023-0165", "desc": "The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/f00b82f7-d8ad-4f6b-b791-81cc16b6336b"]}, {"cve": "CVE-2023-37998", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23989", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.1.9.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46998", "desc": "Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), confirm(), prompt() functions.", "poc": ["https://github.com/soy-oreocato/CVE-2023-46998/", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/soy-oreocato/CVE-2023-46998"]}, {"cve": "CVE-2023-25219", "desc": "Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromDhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC5/11/11.md"]}, {"cve": "CVE-2023-27857", "desc": "In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field in Rockwell Automation's ThinManager ThinServer.\u00a0\u00a0An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-2668", "desc": "A vulnerability was found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this issue is the function manager_category of the file admin/?page=categories/manage_category of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228884.", "poc": ["https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/CVE-2023-2668.md", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-35390", "desc": ".NET and Visual Studio Remote Code Execution Vulnerability", "poc": ["https://github.com/r3volved/CVEAggregate"]}, {"cve": "CVE-2023-20797", "desc": "In camera middleware, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629582; Issue ID: ALPS07629582.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5448", "desc": "The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the update_password_validate function. This makes it possible for unauthenticated attackers to reset a user's password via a forged request granted they can trick the user into performing an action such as clicking on a link.", "poc": ["https://www.wordfence.com/threat-intel/vulnerabilities/id/ca564941-4780-4da2-b937-c9bd45966d81?source=cve"]}, {"cve": "CVE-2023-24169", "desc": "Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_0007343c.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC18/6/6.md"]}, {"cve": "CVE-2023-33243", "desc": "RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become best practice to protect users' passwords in case of a database compromise, this is rendered ineffective when allowing to authenticate using the password hash.", "poc": ["https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses", "https://www.redteam-pentesting.de/en/advisories/rt-sa-2022-004/-starface-authentication-with-password-hash-possible", "https://github.com/RedTeamPentesting/CVE-2023-33243", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26961", "desc": "Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files (e.g., JavaScript content for stored XSS) via the type field in a JSON document within a PUT /gallery/api/media request.", "poc": ["https://gist.github.com/DylanGrl/4269ae834c5d0ec77c9b928ad35d3be3"]}, {"cve": "CVE-2023-23422", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/171866/Microsoft-Windows-Kernel-Transactional-Registry-Key-Rename-Issues.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-52824", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1020", "desc": "The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.", "poc": ["https://wpscan.com/vulnerability/4e5aa9a3-65a0-47d6-bc26-a2fb6cb073ff"]}, {"cve": "CVE-2023-52617", "desc": "In the Linux kernel, the following vulnerability has been resolved:PCI: switchtec: Fix stdev_release() crash after surprise hot removeA PCI device hot removal may occur while stdev->cdev is held open. The callto stdev_release() then happens during close or exit, at a point way pastswitchtec_pci_remove(). Otherwise the last ref would vanish with thetrailing put_device(), just before return.At that later point in time, the devm cleanup has already removed thestdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a countedone. Therefore, in DMA mode, the iowrite32() in stdev_release() will causea fatal page fault, and the subsequent dma_free_coherent(), if reached,would pass a stale &stdev->pdev->dev pointer.Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), afterstdev_kill(). Counting the stdev->pdev ref is now optional, but may preventfuture accidents.Reproducible via the script athttps://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-52614", "desc": "In the Linux kernel, the following vulnerability has been resolved:PM / devfreq: Fix buffer overflow in trans_stat_showFix buffer overflow in trans_stat_show().Convert simple snprintf to the more secure scnprintf with size ofPAGE_SIZE.Add condition checking if we are exceeding PAGE_SIZE and exit early fromloop. Also add at the end a warning that we exceeded PAGE_SIZE and thatstats is disabled.Return -EFBIG in the case where we don't have enough space to write thefull transition table.Also document in the ABI that this function can return -EFBIG error.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-24159", "desc": "TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in the setPasswordCfg function.", "poc": ["https://github.com/iceyjchen/VulnerabilityProjectRecords/blob/main/setPasswordCfg_admpass/setPasswordCfg_admpass.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/iceyjchen/VulnerabilityProjectRecords"]}, {"cve": "CVE-2023-44366", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4532", "desc": "An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/423357"]}, {"cve": "CVE-2023-48107", "desc": "Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_has_slash function in the mz_os.c file.", "poc": ["https://github.com/zlib-ng/minizip-ng/issues/739"]}, {"cve": "CVE-2023-4294", "desc": "The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.", "poc": ["https://wpscan.com/vulnerability/1fc71fc7-861a-46cc-a147-1c7ece9a7776", "https://github.com/b0marek/CVE-2023-4294", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-24524", "desc": "SAP S/4 HANA Map Treasury Correspondence Format Data\u00a0does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-52206", "desc": "Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder.This issue affects Page Builder: Live Composer: from n/a through 1.5.25.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30415", "desc": "Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /inquiries/view_inquiry.php.", "poc": ["http://packetstormsecurity.com/files/174758/Packers-And-Movers-Management-System-1.0-SQL-Injection.html", "https://robsware.github.io/2023/09/01/firstcve"]}, {"cve": "CVE-2023-0587", "desc": "A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e., \\PCCSRV\\TEMP\\SampleSubmission) on the server. The attacker can upload a large number of large files to fill up the file system on which the Apex One server is installed.", "poc": ["https://www.tenable.com/security/research/tra-2023-5"]}, {"cve": "CVE-2023-32784", "desc": "In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.", "poc": ["https://github.com/keepassxreboot/keepassxc/discussions/9433", "https://github.com/vdohney/keepass-password-dumper", "https://sourceforge.net/p/keepass/discussion/329220/thread/f3438e6283/", "https://github.com/0xFFD700/Neuland-CTF-2023", "https://github.com/1ocho3/NCL_V", "https://github.com/3mpir3Albert/HTB_Keeper", "https://github.com/4m4Sec/CVE-2023-32784", "https://github.com/7h4nd5RG0d/Forensics", "https://github.com/Aledangelo/HTB_Keeper_Writeup", "https://github.com/CTM1/CVE-2023-32784-keepass-linux", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/GhostTroops/TOP", "https://github.com/JorianWoltjer/keepass-dump-extractor", "https://github.com/LeDocteurDesBits/cve-2023-32784", "https://github.com/MashrurRahmanRawnok/Keeper-HTB-Write--Up", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/Orange-Cyberdefense/KeePwn", "https://github.com/Rajuaravinds/My-Book", "https://github.com/RawnokRahman/Keeper-HTB-Write--Up", "https://github.com/RiccardoRobb/Pentesting", "https://github.com/ValentinPundikov/poc-CVE-2023-32784", "https://github.com/ZarKyo/awesome-volatility", "https://github.com/chris-devel0per/HTB--keeper", "https://github.com/chris-devel0per/htb-keeper", "https://github.com/dawnl3ss/CVE-2023-32784", "https://github.com/didyfridg/Writeup-THCON-2024---Keepas-si-safe", "https://github.com/forensicxlab/volatility3_plugins", "https://github.com/hau-zy/KeePass-dump-py", "https://github.com/hktalent/TOP", "https://github.com/josephalan42/CTFs-Infosec-Witeups", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/mister-turtle/cve-2023-32784", "https://github.com/nahberry/DuckPass", "https://github.com/nateahess/DuckPass", "https://github.com/nenandjabhata/CTFs-Journey", "https://github.com/neuland-ingolstadt/Neuland-CTF-2023-Winter", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rvsvishnuv/rvsvishnuv.github.io", "https://github.com/s3mPr1linux/KEEPASS_PASS_DUMP", "https://github.com/und3sc0n0c1d0/BruteForce-to-KeePass", "https://github.com/vdohney/keepass-password-dumper", "https://github.com/ynuwenhof/keedump", "https://github.com/z-jxy/keepass_dump"]}, {"cve": "CVE-2023-50855", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sam Perrow Pre* Party Resource Hints.This issue affects Pre* Party Resource Hints: from n/a through 1.8.18.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45966", "desc": "umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability.", "poc": ["https://github.com/jet-pentest/CVE-2023-45966", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6575", "desc": "A vulnerability was found in Byzoro S210 up to 20231121. It has been classified as critical. This affects an unknown part of the file /Tool/repair.php of the component HTTP POST Request Handler. The manipulation of the argument txt leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247155. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/houhuidong/cve/blob/main/rce.md"]}, {"cve": "CVE-2023-37979", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <=\u00a03.6.25 versions.", "poc": ["http://packetstormsecurity.com/files/173983/WordPress-Ninja-Forms-3.6.25-Cross-Site-Scripting.html", "https://github.com/Fire-Null/CVE-2023-37979", "https://github.com/Fire-Null/Write-Ups", "https://github.com/Mehran-Seifalinia/CVE-2023-37979", "https://github.com/codeb0ss/CVE-2023-37979", "https://github.com/d0rb/CVE-2023-37979", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38326", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45005", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Castos Seriously Simple Stats plugin <=\u00a01.5.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0955", "desc": "The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.", "poc": ["https://wpscan.com/vulnerability/18b7e93f-b038-4f28-918b-4015d62f0eb8"]}, {"cve": "CVE-2023-1762", "desc": "Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/3c2374cc-7082-44b7-a6a6-ccff7a650a3a", "https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-22792", "desc": "A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-6099", "desc": "A vulnerability classified as critical has been found in Shenzhen Youkate Industrial Facial Love Cloud Payment System up to 1.0.55.0.0.1. This affects an unknown part of the file /SystemMng.ashx of the component Account Handler. The manipulation of the argument operatorRole with the input 00 leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-245061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/gatsby2003/Shenzhen-Youkate-Industrial-Co.-Ltd/blob/main/Shenzhen%20Youkate%20Industrial%20Co.%2C%20Ltd.md", "https://vuldb.com/?id.245061", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-50027", "desc": "SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method.", "poc": ["https://security.friendsofpresta.org/modules/2023/12/19/baproductzoommagnifier.html"]}, {"cve": "CVE-2023-39150", "desc": "ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22956", "desc": "An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is able to decrypt encrypted configuration files and retrieve sensitive information.", "poc": ["http://packetstormsecurity.com/files/174216/AudioCodes-VoIP-Phones-Hardcoded-Key.html", "http://seclists.org/fulldisclosure/2023/Aug/16", "https://syss.de", "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-054.txt"]}, {"cve": "CVE-2023-6188", "desc": "A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edit.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-245735.", "poc": ["https://vuldb.com/?id.245735"]}, {"cve": "CVE-2023-5784", "desc": "A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /protocol/firewall/uploadfirewall.php. The manipulation of the argument messagecontent leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-243590 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/gb111d/ns-asg_poc/", "https://vuldb.com/?id.243590"]}, {"cve": "CVE-2023-50423", "desc": "SAP\u00a0BTP\u00a0Security Services Integration Library ([Python]\u00a0sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.", "poc": ["https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7224", "desc": "OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable", "poc": ["https://github.com/LOURC0D3/LOURC0D3", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24781", "desc": "Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \\member\\MemberLevel.php.", "poc": ["https://github.com/funadmin/funadmin/issues/8"]}, {"cve": "CVE-2023-1452", "desc": "A vulnerability was found in GPAC 2.3-DEV-rev35-gbbca86917-master. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file filters/load_text.c. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-223297 was assigned to this vulnerability.", "poc": ["https://github.com/gpac/gpac/issues/2386"]}, {"cve": "CVE-2023-40188", "desc": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.", "poc": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9w28-wwj5-p4xq"]}, {"cve": "CVE-2023-49395", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.", "poc": ["https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20in%20the%20column%20management%20modification%20section.md"]}, {"cve": "CVE-2023-29492", "desc": "Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-32306", "desc": "Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.", "poc": ["https://github.com/indevi0us/indevi0us"]}, {"cve": "CVE-2023-37245", "desc": "Buffer overflow vulnerability in the modem pinctrl module. Successful exploitation of this vulnerability may affect the integrity and availability of the modem.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2814", "desc": "A vulnerability classified as problematic has been found in SourceCodester Class Scheduling System 1.0. Affected is an unknown function of the file /admin/save_teacher.php of the component POST Parameter Handler. The manipulation of the argument Academic_Rank leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229428.", "poc": ["https://vuldb.com/?id.229428"]}, {"cve": "CVE-2023-41828", "desc": "An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exported content provider.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28807", "desc": "In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security controls by hiding their communications within legitimate traffic.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1876", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://huntr.dev/bounties/15b06488-5849-47ce-aaf4-81d4c3c202e2"]}, {"cve": "CVE-2023-34188", "desc": "The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.", "poc": ["https://github.com/cesanta/mongoose/pull/2197", "https://github.com/narfindustries/http-garden"]}, {"cve": "CVE-2023-27719", "desc": "D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_478360 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/HolyTruth/DIR_878-1.30B08/blob/main/2.md"]}, {"cve": "CVE-2023-36563", "desc": "Microsoft WordPad Information Disclosure Vulnerability", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-6933", "desc": "The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/w2xim3/CVE-2023-6933"]}, {"cve": "CVE-2023-1436", "desc": "An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.", "poc": ["https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/"]}, {"cve": "CVE-2023-24170", "desc": "Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/fromSetWirelessRepeat.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC18/3/3.md"]}, {"cve": "CVE-2023-20932", "desc": "In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-248251018", "poc": ["https://github.com/nidhi7598/packages_apps_EmergencyInfo_AOSP_10_r33_CVE-2023-20932"]}, {"cve": "CVE-2023-4873", "desc": "A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-239358 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/cugerQDHJ/cve/blob/main/rce.md"]}, {"cve": "CVE-2023-26775", "desc": "File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the assets/php/upload.php endpoint.", "poc": ["http://packetstormsecurity.com/files/171705/Monitorr-1.7.6-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-0608", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.", "poc": ["https://huntr.dev/bounties/02a86e0d-dff7-4e27-89d5-2f7dcd4b580c"]}, {"cve": "CVE-2023-33891", "desc": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41981", "desc": "The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations.", "poc": ["https://github.com/c22dev/BES", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48945", "desc": "A stack overflow in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1172"]}, {"cve": "CVE-2023-38301", "desc": "An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers. Various software builds for the BLU View 2, Boost Mobile Celero 5G, Sharp Rouvo V, Motorola Moto G Pure, Motorola Moto G Power, T-Mobile Revvl 6 Pro 5G, and T-Mobile Revvl V+ 5G devices leak the device serial number to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances they are leaked by a high-privilege process and can be obtained indirectly. The software build fingerprints for each confirmed vulnerable device are as follows: BLU View 2 (BLU/B131DL/B130DL:11/RP1A.200720.011/1672046950:user/release-keys); Boost Mobile Celero 5G (Celero5G/Jupiter/Jupiter:11/RP1A.200720.011/SW_S98119AA1_V067:user/release-keys); Sharp Rouvo V (SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_530:user/release-keys); Motorola Moto G Pure (motorola/ellis_trac/ellis:11/RRHS31.Q3-46-110-2/74844:user/release-keys, motorola/ellis_trac/ellis:11/RRHS31.Q3-46-110-7/5cde8:user/release-keys, motorola/ellis_trac/ellis:11/RRHS31.Q3-46-110-10/d67faa:user/release-keys, motorola/ellis_trac/ellis:11/RRHS31.Q3-46-110-13/b4a29:user/release-keys, motorola/ellis_trac/ellis:12/S3RH32.20-42-10/1c2540:user/release-keys, motorola/ellis_trac/ellis:12/S3RHS32.20-42-13-2-1/6368dd:user/release-keys, motorola/ellis_a/ellis:11/RRH31.Q3-46-50-2/20fec:user/release-keys, motorola/ellis_vzw/ellis:11/RRH31.Q3-46-138/103bd:user/release-keys, motorola/ellis_vzw/ellis:11/RRHS31.Q3-46-138-2/e5502:user/release-keys, and motorola/ellis_vzw/ellis:12/S3RHS32.20-42-10-14-2/5e0b0:user/release-keys); Motorola Moto G Power (motorola/tonga_g/tonga:11/RRQ31.Q3-68-16-2/e5877:user/release-keys and motorola/tonga_g/tonga:12/S3RQS32.20-42-10-6/f876d3:user/release-keys); T-Mobile Revvl 6 Pro 5G (T-Mobile/Augusta/Augusta:12/SP1A.210812.016/SW_S98121AA1_V070:user/release-keys); and T-Mobile Revvl V+ 5G (T-Mobile/Sprout/Sprout:11/RP1A.200720.011/SW_S98115AA1_V077:user/release-keys). This malicious app reads from the \"vendor.gsm.serial\" system property to indirectly obtain the device serial number.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34260", "desc": "Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed by a directory reference such as %2fetc%00index.htm to try to read the /etc directory.", "poc": ["https://seclists.org/fulldisclosure/2023/Jul/15"]}, {"cve": "CVE-2023-4463", "desc": "A vulnerability classified as problematic was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument Cookie leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249256.", "poc": ["https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"]}, {"cve": "CVE-2023-7135", "desc": "A vulnerability classified as problematic has been found in code-projects Record Management System 1.0. Affected is an unknown function of the file /main/offices.php of the component Offices Handler. The manipulation of the argument officename with the input \"> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249138 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/Record_Management_System/Record_Management_System-Blind_Cross_Site_Scripting-1.md", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-36486", "desc": "The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46132", "desc": "Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called \"cross-linking\" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the transactions in a way that alters the way the peers parse the transactions. If a first peer receives a block B and a second peer receives a block identical to B but with the transactions being cross-linked, the second peer will parse transactions in a different way and thus its world state will deviate from the first peer. Orderers or peers cannot detect that a block has its transactions cross-linked, because there is a vulnerability in the way Fabric hashes the transactions of blocks. It simply and naively concatenates them, which is insecure and lets an adversary craft a \"cross-linked block\" (block with cross-linked transactions) which alters the way peers process transactions. For example, it is possible to select a transaction and manipulate a peer to completely avoid processing it, without changing the computed hash of the block. Additional validations have been added in v2.2.14 and v2.5.5 to detect potential cross-linking issues before processing blocks. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/hyperledger/fabric/security/advisories/GHSA-v9w2-543f-h69m"]}, {"cve": "CVE-2023-46451", "desc": "Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.", "poc": ["https://github.com/sajaljat/CVE-2023-46451", "https://youtu.be/f8B3_m5YfqI", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sajaljat/CVE-2023-46451"]}, {"cve": "CVE-2023-26562", "desc": "In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49124", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48206", "desc": "A Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inject JavaScript via the page parameter to login.php or header.php.", "poc": ["http://packetstormsecurity.com/files/175803"]}, {"cve": "CVE-2023-0050", "desc": "An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Threekiii/CVE", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/wh-gov/CVE-2023-0050"]}, {"cve": "CVE-2023-49438", "desc": "An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.", "poc": ["https://github.com/brandon-t-elliott/CVE-2023-49438", "https://github.com/brandon-t-elliott/CVE-2023-49438", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-47706", "desc": "IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22500", "desc": "GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by unauthenticated users. This issue is patched in version 10.0.6. As a workaround, disable native inventory and delete inventory files from server (default location is `files/_inventory`).", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Feals-404/GLPIAnarchy"]}, {"cve": "CVE-2023-50430", "desc": "The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux, and accepts an unauthenticated configuration packet to select the Windows template database, which allows bypass of Windows Hello authentication by enrolling an attacker's fingerprint.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34969", "desc": "D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.", "poc": ["https://github.com/adegoodyer/kubernetes-admin-toolkit", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-47489", "desc": "CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components.", "poc": ["https://bugplorer.github.io/cve-csv-itop/", "https://nitipoom-jar.github.io/CVE-2023-47489/", "https://github.com/nitipoom-jar/CVE-2023-47489", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2421", "desc": "A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2/#/add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://youtu.be/4JOLhAuoizE"]}, {"cve": "CVE-2023-24733", "desc": "PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950_new.php.", "poc": ["https://github.com/AetherBlack/CVE/tree/main/PMB"]}, {"cve": "CVE-2023-24934", "desc": "Microsoft Defender Security Feature Bypass Vulnerability", "poc": ["https://github.com/SafeBreach-Labs/wd-pretender"]}, {"cve": "CVE-2023-21097", "desc": "In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261858325", "poc": ["https://github.com/Trinadh465/frameworks_base_AOSP10_r33_CVE-2023-21097", "https://github.com/nidhi7598/frameworks_base_AOSP_06_r22_core_java_CVE-2023-21097", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/uthrasri/frameworks_base_AOSP10_r33_CVE-2023-21097"]}, {"cve": "CVE-2023-38971", "desc": "Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function.", "poc": ["https://panda002.hashnode.dev/badaso-version-297-has-xss-vulnerability-in-add-ranks"]}, {"cve": "CVE-2023-29681", "desc": "Cleartext Transmission in cookie:ecos_pw: in Tenda N301 v6.0, firmware v12.03.01.06_pt allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password.", "poc": ["https://medium.com/@0ta/tenda-n301-v6-cve-2023-29680-cve-2023-29681-a40f7ae6dc62", "https://www.youtube.com/watch?v=Xy9_hmpvvA4&ab_channel=0ta"]}, {"cve": "CVE-2023-5884", "desc": "The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.", "poc": ["https://wpscan.com/vulnerability/f4a7937c-6f4b-49dd-b88a-67ebe718ad19"]}, {"cve": "CVE-2023-32792", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to eliminate roles within the platform by sending a specifically crafted query to the server. The vulnerability is based on the absence of proper validation of the origin of incoming requests.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35965", "desc": "Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger these vulnerabilities.This integer overflow result is used as argument for the malloc function.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1787"]}, {"cve": "CVE-2023-35840", "desc": "_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.", "poc": ["https://github.com/afine-com/CVE-2023-35840", "https://github.com/afine-com/research", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5197", "desc": "A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.", "poc": ["http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html"]}, {"cve": "CVE-2023-30963", "desc": "A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry instances. No further intervention is required.", "poc": ["https://palantir.safebase.us/?tcuUid=3c6b63b7-fb67-4202-a94a-9c83515efb8a"]}, {"cve": "CVE-2023-45016", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43865", "desc": "D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPTP function.", "poc": ["https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md"]}, {"cve": "CVE-2023-4282", "desc": "The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above, to delete plugin settings.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5840", "desc": "Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9.", "poc": ["https://huntr.com/bounties/8042d8c3-650e-4c0d-9146-d9ccf6082b30", "https://github.com/sev-hack/sev-hack"]}, {"cve": "CVE-2023-25199", "desc": "A reflected cross-site scripting (XSS) vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to execute JavaScript code and obtain sensitive information in a victim's browser.", "poc": ["https://summitinfosec.com/blog/x-ray-vision-identifying-cve-2023-25199-and-cve-2023-25200-in-manufacturing-equipment/"]}, {"cve": "CVE-2023-30375", "desc": "In Tenda AC15 V15.03.05.19, the function \"getIfIp\" contains a stack-based buffer overflow vulnerability.", "poc": ["https://github.com/2205794866/Tenda/blob/main/AC15/1.md"]}, {"cve": "CVE-2023-20873", "desc": "In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9", "https://github.com/scordero1234/java_sec_demo-main"]}, {"cve": "CVE-2023-1722", "desc": "Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.", "poc": ["https://fluidattacks.com/advisories/wyckoff/"]}, {"cve": "CVE-2023-29234", "desc": "A deserialization vulnerability existed when decode a\u00a0malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4.Users are recommended to upgrade to the latest version, which fixes the issue.", "poc": ["https://github.com/Marco-zcl/POC", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/enomothem/PenTestNote", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tanjiti/sec_profile", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-"]}, {"cve": "CVE-2023-27010", "desc": "Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability allows attackers to escalate privileges via modifying or overwriting the executable.", "poc": ["https://packetstormsecurity.com/files/171301/Wondershare-Dr-Fone-12.9.6-Weak-Permissions-Privilege-Escalation.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-34552", "desc": "In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_pack_type functions of the SADP multicast protocol can allow an unauthenticated attacker present on the same local network as the camera to achieve remote code execution. This affects CS-C6N-B0-1G2WF Firmware versions before V5.3.0 build 230215 and CS-C6N-R101-1G2WF Firmware versions before V5.3.0 build 230215 and CS-CV310-A0-1B2WFR Firmware versions before V5.3.0 build 230221 and CS-CV310-A0-1C2WFR-C Firmware versions before V5.3.2 build 230221 and CS-C6N-A0-1C2WFR-MUL Firmware versions before V5.3.2 build 230218 and CS-CV310-A0-3C2WFRL-1080p Firmware versions before V5.2.7 build 230302 and CS-CV310-A0-1C2WFR Wifi IP66 2.8mm 1080p Firmware versions before V5.3.2 build 230214 and CS-CV248-A0-32WMFR Firmware versions before V5.2.3 build 230217 and EZVIZ LC1C Firmware versions before V5.3.4 build 230214.", "poc": ["https://github.com/infobyte/ezviz_lan_rce"]}, {"cve": "CVE-2023-49551", "desc": "An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.", "poc": ["https://github.com/cesanta/mjs/issues/257"]}, {"cve": "CVE-2023-28763", "desc": "SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-25573", "desc": "metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/0day404/vulnerability-poc", "https://github.com/20142995/sectool", "https://github.com/KayCHENvip/vulnerability-poc", "https://github.com/Threekiii/Awesome-POC", "https://github.com/codeb0ss/CVE-2023-25573-PoC", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-28931", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Never5 Post Connector plugin <=\u00a01.0.9 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23078", "desc": "Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.", "poc": ["https://bugbounty.zohocorp.com/bb/#/bug/101000006458675?tab=originator"]}, {"cve": "CVE-2023-0696", "desc": "Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-4270", "desc": "The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/04560bf1-676b-46fb-9344-4150862f2686"]}, {"cve": "CVE-2023-1312", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.", "poc": ["https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356", "https://github.com/ARPSyndicate/cvemon", "https://github.com/khanhchauminh/khanhchauminh"]}, {"cve": "CVE-2023-28994", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UX-themes Flatsome plugin <=\u00a03.16.8 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28261", "desc": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-23080", "desc": "Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906024_2025 and Tenda IT7-PCS Tenda IT7-PCS<=V2209020914 and Tenda IT7-LCS Tenda IT7-LCS<=V2209020914 and Tenda IT7-PRS Tenda IT7-PRS<=V2209020908.", "poc": ["https://github.com/fxc233/iot-vul/tree/main/Tenda/IPC", "https://github.com/ARPSyndicate/cvemon", "https://github.com/fxc233/iot-vul"]}, {"cve": "CVE-2023-34596", "desc": "A vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.", "poc": ["https://github.com/iot-sec23/HubFuzzer"]}, {"cve": "CVE-2023-51364", "desc": "A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.4.2596 build 20231128 and laterQTS 4.5.4.2627 build 20231225 and laterQuTS hero h5.1.3.2578 build 20231110 and laterQuTS hero h4.5.4.2626 build 20231225 and laterQuTScloud c5.1.5.2651 and later", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6317", "desc": "A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN.\u00a0Full versions and TV models affected:webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA webOS 5.5.0 - 04.50.51 running on OLED55CXPUA webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB \u00a0webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48826", "desc": "Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List.", "poc": ["http://packetstormsecurity.com/files/176034", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25279", "desc": "OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.", "poc": ["https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20In%20tools_AccountName"]}, {"cve": "CVE-2023-37369", "desc": "In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4290", "desc": "The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/5fad5245-a089-4ba3-9958-1e2c3d066eea"]}, {"cve": "CVE-2023-27265", "desc": "Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the \"Regenerate Invite Id\" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-0278", "desc": "The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/98deb84e-01ca-4b70-a8f8-0a226daa85a6"]}, {"cve": "CVE-2023-3077", "desc": "The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.", "poc": ["https://wpscan.com/vulnerability/9480d0b5-97da-467d-98f6-71a32599a432"]}, {"cve": "CVE-2023-31584", "desc": "GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the User Input field.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rootd4ddy/CVE-2023-31584", "https://github.com/rootd4ddy/CVE-2023-43838"]}, {"cve": "CVE-2023-26257", "desc": "An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is not released after it is allocated in dlt-control-common.c.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-4759", "desc": "Arbitrary File Overwrite in Eclipse JGit <= 6.6.0In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.This can happen on checkout (DirCacheCheckout), merge (ResolveMerger\u00a0via its WorkingTreeUpdater), pull (PullCommand\u00a0using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.Setting git configuration option core.symlinks = false\u00a0before checking out avoids the problem.The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/ \u00a0and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r.The JGit maintainers would like to thank RyotaK for finding and reporting this issue.", "poc": ["https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/11", "https://github.com/faiz-aljohani/Refactorfirst_copy", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/jimbethancourt/RefactorFirst", "https://github.com/refactorfirst/RefactorFirst"]}, {"cve": "CVE-2023-2648", "desc": "A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/sunyixuan1228/cve/blob/main/weaver.md", "https://github.com/Co5mos/nuclei-tps", "https://github.com/MD-SEC/MDPOCS", "https://github.com/MzzdToT/HAC_Bored_Writing", "https://github.com/bingtangbanli/cve-2023-2523-and-cve-2023-2648", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/kuang-zy/2023-Weaver-pocs", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zhaoyumi/WeaverExploit_All"]}, {"cve": "CVE-2023-2840", "desc": "NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.", "poc": ["https://huntr.dev/bounties/21926fc2-6eb1-4e24-8a36-e60f487d0257"]}, {"cve": "CVE-2023-31851", "desc": "Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter.", "poc": ["https://github.com/CalfCrusher/CVE-2023-31851", "https://github.com/CalfCrusher/CVE-2023-31851", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-32434", "desc": "An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "poc": ["https://github.com/Balistic123/Iphone11IOS16.1KFDFONT", "https://github.com/DarkNavySecurity/PoC", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Phuc559959d/kfund", "https://github.com/PureKFD/PureKFD", "https://github.com/PureKFD/PureKFDRepo", "https://github.com/Spoou/123", "https://github.com/ZZY3312/CVE-2023-32434", "https://github.com/em1ga3l/cve-msrc-extractor", "https://github.com/evelyneee/kfd-on-crack", "https://github.com/felix-pb/kfd", "https://github.com/larrybml/test1", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/vftable/kfund", "https://github.com/vntrcl/kfund"]}, {"cve": "CVE-2023-33468", "desc": "KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical screen.", "poc": ["https://github.com/Sharpe-nl/CVEs"]}, {"cve": "CVE-2023-3245", "desc": "The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/f9f8ae7e-6621-4e29-9257-b8306dbe8811"]}, {"cve": "CVE-2023-4861", "desc": "The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.", "poc": ["https://wpscan.com/vulnerability/7fa03f00-25c7-4e40-8592-bb4001ce019d"]}, {"cve": "CVE-2023-24351", "desc": "D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the FILECODE parameter at /goform/formLogin.", "poc": ["https://github.com/1160300418/Vuls/tree/main/D-Link/DIR-605L/01"]}, {"cve": "CVE-2023-5159", "desc": "Mattermost fails to properly verify the permissions when managing/updating a bot allowing a\u00a0User Manager role with user edit permissions to manage/update bots.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46929", "desc": "An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers to crash the application.", "poc": ["https://github.com/gpac/gpac/issues/2662"]}, {"cve": "CVE-2023-29911", "desc": "H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/SyTaRoCJn"]}, {"cve": "CVE-2023-5690", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.", "poc": ["https://huntr.com/bounties/980c75a5-d978-4b0e-9bcc-2b2682c97e01"]}, {"cve": "CVE-2023-51798", "desc": "Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at libavfilter/vf_minterpolate.c:1078:60 in interpolate.", "poc": ["https://ffmpeg.org/", "https://trac.ffmpeg.org/ticket/10758"]}, {"cve": "CVE-2023-0073", "desc": "The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/e5599968-a435-405a-8829-9840a2144987"]}, {"cve": "CVE-2023-37991", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Monchito.Net WP Emoji One plugin <=\u00a00.6.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1260", "desc": "An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions \"update, patch\" the \"pods/ephemeralcontainers\" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44395", "desc": "Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform arbitrary file reads. Version 2.12.0 contains a patch. There are no feasible workarounds for this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24042", "desc": "A race condition in LightFTP through 2.2 allows an attacker to achieve path traversal via a malformed FTP request. A handler thread can use an overwritten context->FileName.", "poc": ["https://github.com/RoyTonmoy/Vulnerability-of-LightFTP-2.2", "https://github.com/mkovy39/Concordia-INSE6140-Project", "https://github.com/mkovy39/INSE6140-Project"]}, {"cve": "CVE-2023-7199", "desc": "The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request", "poc": ["https://wpscan.com/vulnerability/0c96a128-4473-41f5-82ce-94bba33ca4a3/"]}, {"cve": "CVE-2023-31047", "desc": "In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's \"Uploading multiple files\" documentation suggested otherwise.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/hheeyywweellccoommee/Django_rce-nwvba", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-21517", "desc": "Heap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51766", "desc": "Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports . but some other popular e-mail servers do not.", "poc": ["https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hannob/smtpsmug"]}, {"cve": "CVE-2023-4474", "desc": "The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.", "poc": ["https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/", "https://github.com/Tig3rHu/Awesome_IOT_Vul_lib"]}, {"cve": "CVE-2023-0536", "desc": "The Wp-D3 WordPress plugin through 2.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/7b19d792-8083-4c0c-a45e-a99c1f5f0df0"]}, {"cve": "CVE-2023-26434", "desc": "When adding an external mail account, processing of POP3 \"capabilities\" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server response to reasonable length/size. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html"]}, {"cve": "CVE-2023-3202", "desc": "The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-28530", "desc": "IBM Cognos Analytics 11.1 and 11.2 is vulnerable to stored cross-site scripting, caused by improper validation of SVG Files in Custom Visualizations. A remote attacker could exploit this vulnerability to execute scripts in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 251214.", "poc": ["https://github.com/DojoSecurity/DojoSecurity", "https://github.com/afine-com/research"]}, {"cve": "CVE-2023-34494", "desc": "NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.", "poc": ["https://github.com/emqx/nanomq/issues/1180"]}, {"cve": "CVE-2023-30961", "desc": "Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link.", "poc": ["https://palantir.safebase.us/?tcuUid=2755c49f-2c30-459e-8bdf-f95ef3692da4"]}, {"cve": "CVE-2023-35364", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0373", "desc": "The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/fe60ea83-b584-465a-8128-b7358d8da3af"]}, {"cve": "CVE-2023-47779", "desc": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22974", "desc": "A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server.", "poc": ["https://github.com/gbrsh/CVE-2023-22974", "https://github.com/hktalent/TOP", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0306", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.", "poc": ["https://huntr.dev/bounties/cbba22f0-89ed-4d01-81ea-744979c8cbde"]}, {"cve": "CVE-2023-5087", "desc": "The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code.", "poc": ["https://wpscan.com/vulnerability/3b45cc0b-7378-49f3-900e-d0e18cd4b878"]}, {"cve": "CVE-2023-41506", "desc": "An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.", "poc": ["https://github.com/ASR511-OO7/CVE-2023-41506", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4824", "desc": "The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/71c616ff-0a7e-4f6d-950b-79c469a28263"]}, {"cve": "CVE-2023-27463", "desc": "A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The audit log form of affected applications is vulnerable to SQL injection. This could allow authenticated remote attackers to execute arbitrary SQL queries on the server database.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-2050", "desc": "A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/positions_add.php. The manipulation of the argument description leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225935.", "poc": ["https://github.com/E1CHO/cve_hub/blob/main/Advanced%20Online%20Voting%20System/Advanced%20Online%20Voting%20System%20-%20vuln%204.pdf"]}, {"cve": "CVE-2023-7150", "desc": "A vulnerability classified as critical was found in Campcodes Chic Beauty Salon 20230703. Affected by this vulnerability is an unknown functionality of the file product-list.php of the component Product Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249157 was assigned to this vulnerability.", "poc": ["https://github.com/laoquanshi/Chic-Vulnerability-"]}, {"cve": "CVE-2023-28302", "desc": "Microsoft Message Queuing Denial of Service Vulnerability", "poc": ["https://github.com/TayoG/44con2023-resources", "https://github.com/clearbluejar/44con2023-resources", "https://github.com/clearbluejar/recon2023-resources", "https://github.com/timeisflowing/recon2023-resources"]}, {"cve": "CVE-2023-27131", "desc": "Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code viathe Post Editorparameter.", "poc": ["https://github.com/typecho/typecho/issues/1536", "https://github.com/Srpopty/Corax"]}, {"cve": "CVE-2023-21903", "desc": "Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: OBVAM Internal Tfr Domain). Supported versions that are affected are 14.5, 14.6 and 14.7. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Banking Virtual Account Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Virtual Account Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Banking Virtual Account Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Virtual Account Management. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-36146", "desc": "A Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733.", "poc": ["https://github.com/leonardobg/CVE-2023-36146/#readme", "https://github.com/leonardobg/CVE-2023-36146", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-23327", "desc": "An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stored using the current date as the filename and hosted on the web server without access controls.", "poc": ["https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md"]}, {"cve": "CVE-2023-3115", "desc": "An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/414367", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40187", "desc": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of the 3.x beta branch are subject to a Use-After-Free issue in the `avc420_ensure_buffer` and `avc444_ensure_buffer` functions. If the value of `piDstSize[x]` is 0, `ppYUVDstData[x]` will be freed. However, in this case `ppYUVDstData[x]` will not have been updated which leads to a Use-After-Free vulnerability. This issue has been addressed in version 3.0.0-beta3. Users of the 3.x beta releases are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pwf9-v5p9-ch4f"]}, {"cve": "CVE-2023-4714", "desc": "A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The identifier VDB-238577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/174446/PlayTube-3.0.1-Information-Disclosure.html", "https://github.com/Threekiii/Awesome-POC", "https://github.com/d4n-sec/d4n-sec.github.io"]}, {"cve": "CVE-2023-2109", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.", "poc": ["https://huntr.dev/bounties/fd5999fd-b1fd-44b4-ae2e-8f95b5c3d1b6", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-24128", "desc": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet.", "poc": ["https://oxnan.com/posts/WifiBasic_wepkey2_DoS"]}, {"cve": "CVE-2023-38609", "desc": "An injection issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.5. An app may be able to bypass certain Privacy preferences.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-35132", "desc": "A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.", "poc": ["https://github.com/kip93/kip93"]}, {"cve": "CVE-2023-30149", "desc": "SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type, input_name. or q parameter in the autocompletion.php front controller.", "poc": ["https://friends-of-presta.github.io/security-advisories/module/2023/06/01/cityautocomplete.html"]}, {"cve": "CVE-2023-44325", "desc": "Adobe Animate versions 23.0.2 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1890", "desc": "The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting", "poc": ["http://packetstormsecurity.com/files/173727/WordPress-Tablesome-Cross-Site-Scripting.html", "https://wpscan.com/vulnerability/8ef64490-30cd-4e07-9b7c-64f551944f3d"]}, {"cve": "CVE-2023-1245", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.", "poc": ["https://huntr.dev/bounties/f8011bb3-8212-4937-aa58-79f4b73be004"]}, {"cve": "CVE-2023-5089", "desc": "The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.", "poc": ["https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30772", "desc": "The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.9", "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=06615d11cc78162dfd5116efb71f29eb29502d37"]}, {"cve": "CVE-2023-45659", "desc": "Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/engelsystem/engelsystem/security/advisories/GHSA-f6mm-3v2h-jm6x", "https://github.com/sev-hack/sev-hack"]}, {"cve": "CVE-2023-49239", "desc": "Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0948", "desc": "The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting", "poc": ["https://wpscan.com/vulnerability/a78d75b2-85a0-41eb-9720-c726ca2e8718"]}, {"cve": "CVE-2023-33929", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joaqu\u00edn Ruiz Easy Admin Menu plugin <=\u00a01.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2343", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/2fa17227-a717-4b66-ab5a-16bffbb4edb2", "https://github.com/khanhchauminh/khanhchauminh"]}, {"cve": "CVE-2023-50257", "desc": "eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the application of SROS2, due to the issue where the data (`p[UD]`) and `guid` values used to disconnect between nodes are not encrypted, a vulnerability has been discovered where a malicious attacker can forcibly disconnect a Subscriber and can deny a Subscriber attempting to connect. Afterwards, if the attacker sends the packet for disconnecting, which is data (`p[UD]`), to the Global Data Space (`239.255.0.1:7400`) using the said Publisher ID, all the Subscribers (Listeners) connected to the Publisher (Talker) will not receive any data and their connection will be disconnected. Moreover, if this disconnection packet is sent continuously, the Subscribers (Listeners) trying to connect will not be able to do so. Since the initial commit of the `SecurityManager.cpp` code (`init`, `on_process_handshake`) on Nov 8, 2016, the Disconnect Vulnerability in RTPS Packets Used by SROS2 has been present prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7.", "poc": ["https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-v5r6-8mvh-cp98"]}, {"cve": "CVE-2023-37302", "desc": "An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).", "poc": ["https://phabricator.wikimedia.org/T339111"]}, {"cve": "CVE-2023-38146", "desc": "Windows Themes Remote Code Execution Vulnerability", "poc": ["http://packetstormsecurity.com/files/176391/Themebleed-Windows-11-Themes-Arbitrary-Code-Execution.html", "https://github.com/CalegariMindSec/HTB_Writeups", "https://github.com/Durge5/ThemeBleedPy", "https://github.com/Jnnshschl/CVE-2023-38146", "https://github.com/Jnnshschl/ThemeBleedReverseShellDLL", "https://github.com/Threekiii/CVE", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/ankitosh/temp", "https://github.com/gabe-k/themebleed", "https://github.com/johe123qwe/github-trending", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-42926", "desc": "Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.", "poc": ["http://packetstormsecurity.com/files/176535/macOS-AppleGVA-Memory-Handling.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20073", "desc": "A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement mechanisms in the context of file uploads. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to upload arbitrary files to the affected device.", "poc": ["https://github.com/CVEDB/awesome-cve-repo", "https://github.com/RegularITCat/CVE-2023-20073", "https://github.com/codeb0ss/CVE-2023-20073-", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-24120", "desc": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasicSet.", "poc": ["https://oxnan.com/posts/WifiBasic_wrlEn_5g_DoS"]}, {"cve": "CVE-2023-36365", "desc": "An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/Sedar2024/Sedar"]}, {"cve": "CVE-2023-36751", "desc": "A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The install-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.", "poc": ["https://github.com/sudo-jtcsec/CVE"]}, {"cve": "CVE-2023-35870", "desc": "When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the resource. Furthermore, a standard template could be deleted, hence making the resource temporarily unavailable.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-51618", "desc": "D-Link DIR-X3260 prog.cgi SetWLanRadioSecurity Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21595.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35098", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in John Brien WordPress NextGen GalleryView plugin <=\u00a00.5.5 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-26802", "desc": "An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request.", "poc": ["https://github.com/winmt/my-vuls/tree/main/DCN%20DCBI-Netlog-LAB"]}, {"cve": "CVE-2023-21212", "desc": "In multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the wifi server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262236031", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33202", "desc": "Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)", "poc": ["https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51070", "desc": "An access control issue in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows unauthenticated attackers to arbitrarily adjust sensitive SMB settings on the QStar Server.", "poc": ["https://github.com/Oracle-Security/CVEs/blob/main/QStar%20Archive%20Solutions/CVE-2023-51070.md"]}, {"cve": "CVE-2023-26974", "desc": "Irfanview v4.62 allows a user-mode write access violation via a crafted JPEG 2000 file starting at JPEG2000+0x0000000000001bf0.", "poc": ["https://github.com/overXsky/IrfanviewPoc"]}, {"cve": "CVE-2023-42323", "desc": "Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file.", "poc": ["https://github.com/mnbvcxz131421/douhaocms/blob/main/README.md"]}, {"cve": "CVE-2023-2659", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file view_product.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228801 was assigned to this vulnerability.", "poc": ["https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Online-Computer-and-Laptop-Store---Multiple-vulnerabilities.md#3sql-injection-vulnerability-in-view_productphp"]}, {"cve": "CVE-2023-32162", "desc": "Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of the WacomInstallI.txt file by the PrefUtil.exe utility. The issue results from incorrect permissions on the WacomInstallI.txt file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-16318.", "poc": ["https://github.com/LucaBarile/ZDI-CAN-16318", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-46667", "desc": "An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server\u2019s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch.", "poc": ["https://www.elastic.co/community/security"]}, {"cve": "CVE-2023-37268", "desc": "Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.", "poc": ["https://github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20065", "desc": "A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. \nThis vulnerability is due to insufficient restrictions on the hosted application. An attacker could exploit this vulnerability by logging in to and then escaping the Cisco IOx application container. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.", "poc": ["https://github.com/orangecertcc/security-research/security/advisories/GHSA-qrpq-fp26-7v9r", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-priv-escalate-Xg8zkyPk", "https://github.com/Orange-Cyberdefense/CVE-repository"]}, {"cve": "CVE-2023-5832", "desc": "Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.", "poc": ["https://huntr.com/bounties/afee3726-571f-416e-bba5-0828c815f5df", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33584", "desc": "Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate the SQL queries executed by the application. The application fails to properly validate user-supplied input in the username and password fields during the login process, enabling an attacker to inject malicious SQL code.", "poc": ["http://packetstormsecurity.com/files/172718/Enrollment-System-Project-1.0-Authentication-Bypass-SQL-Injection.html", "https://packetstormsecurity.com/files/cve/CVE-2023-33584", "https://www.exploit-db.com/exploits/51501", "https://github.com/akarrel/test_enrollment", "https://github.com/sudovivek/My-CVE"]}, {"cve": "CVE-2023-38035", "desc": "A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.", "poc": ["http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html", "https://github.com/LeakIX/sentryexploit", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Y4tacker/JavaSec", "https://github.com/horizon3ai/CVE-2023-38035", "https://github.com/mayur-esh/vuln-liners", "https://github.com/mind2hex/CVE-2023-38035", "https://github.com/mind2hex/MICS_Hunter", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/r3volved/CVEAggregate"]}, {"cve": "CVE-2023-35361", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2359", "desc": "The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations.", "poc": ["https://wpscan.com/vulnerability/a8350890-e6d4-4b04-a158-2b0ee3748e65"]}, {"cve": "CVE-2023-1192", "desc": "A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38970", "desc": "Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.", "poc": ["https://panda002.hashnode.dev/badaso-version-297-has-an-xss-vulnerability-in-new-member"]}, {"cve": "CVE-2023-21876", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-20900", "desc": "A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html \u00a0in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42468", "desc": "The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application (without any permissions) can craft an intent targeting com.cutestudio.dialer.activities.DialerActivity via the android.intent.action.CALL action in conjunction with a tel: URI, thereby placing a phone call.", "poc": ["https://github.com/actuator/com.cutestudio.colordialer/blob/main/CWE-284.md", "https://github.com/actuator/com.cutestudio.colordialer", "https://github.com/actuator/cve", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-21722", "desc": ".NET Framework Denial of Service Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-36530", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smartypants SP Project & Document Manager plugin <=\u00a04.67 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28467", "desc": "In MyBB before 1.8.34, there is XSS in the User CP module via the user email field.", "poc": ["https://github.com/ahmetaltuntas/CVE-2023-28467", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3519", "desc": "Unauthenticated remote code execution", "poc": ["http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html", "https://github.com/Aicks/Citrix-CVE-2023-3519", "https://github.com/BishopFox/CVE-2023-3519", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/Chocapikk/CVE-2023-3519", "https://github.com/D3s7R0/CVE-2023-3519-POC", "https://github.com/GhostTroops/TOP", "https://github.com/Jean-Francois-C/Windows-Penetration-Testing", "https://github.com/JonaNeidhart/CVE-2023-3519-BackdoorCheck", "https://github.com/KR0N-SECURITY/CVE-2023-3519", "https://github.com/Mohammaddvd/CVE-2023-3519", "https://github.com/Neo23x0/signature-base", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/PudgyDragon/IOCs", "https://github.com/SalehLardhi/CVE-2023-3519", "https://github.com/Staubgeborener/stars", "https://github.com/Threekiii/CVE", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/aneasystone/github-trending", "https://github.com/bhaveshharmalkar/learn365", "https://github.com/d0rb/CVE-2023-3519", "https://github.com/dorkerdevil/CitrixFall", "https://github.com/exph7/CVE-2023-3519", "https://github.com/f1tao/awesome-iot-security-resource", "https://github.com/frankenk/frankenk", "https://github.com/getdrive/PoC", "https://github.com/grgmrtn255/Links", "https://github.com/hktalent/TOP", "https://github.com/iluaster/getdrive_PoC", "https://github.com/izj007/wechat", "https://github.com/johe123qwe/github-trending", "https://github.com/knitteruntil0s/CVE-2023-3519", "https://github.com/mandiant/citrix-ioc-scanner-cve-2023-3519", "https://github.com/mr-r3b00t/CVE-2023-3519", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/passwa11/CVE-2023-3519", "https://github.com/rwincey/cve-2023-3519", "https://github.com/sanmasa3/citrix_CVE-2023-3519", "https://github.com/securekomodo/citrixInspector", "https://github.com/synfinner/CitriDish", "https://github.com/telekom-security/cve-2023-3519-citrix-scanner", "https://github.com/whoami13apt/files2", "https://github.com/xaitax/cisa-catalog-known-vulnerabilities"]}, {"cve": "CVE-2023-48063", "desc": "An issue was discovered in dreamer_cms 4.1.3. There is a CSRF vulnerability that can delete a theme project via /admin/category/delete.", "poc": ["https://github.com/CP1379767017/cms/blob/dreamcms_vul/There%20is%20a%20CSRF%20vulnerability%20at%20th%20menu%20management%20location.md"]}, {"cve": "CVE-2023-49978", "desc": "Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49978", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-46015", "desc": "Cross Site Scripting (XSS) vulnerability in index.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via 'msg' parameter in application URL.", "poc": ["https://github.com/ersinerenler/CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability", "https://github.com/ersinerenler/CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability", "https://github.com/ersinerenler/Code-Projects-Blood-Bank-1.0", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3394", "desc": "Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1.", "poc": ["https://huntr.dev/bounties/84bf3e85-cdeb-4b8d-9ea4-74156dbda83f"]}, {"cve": "CVE-2023-27706", "desc": "Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes.", "poc": ["https://github.com/RedTeamPentesting/bitwarden-windows-hello"]}, {"cve": "CVE-2023-38190", "desc": "An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter.", "poc": ["https://herolab.usd.de/security-advisories/usd-2023-0014/"]}, {"cve": "CVE-2023-27882", "desc": "A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1733"]}, {"cve": "CVE-2023-27197", "desc": "PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33630", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EditvsList interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/HkUA31-Mh"]}, {"cve": "CVE-2023-47565", "desc": "An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.We have already fixed the vulnerability in the following versions:QVR Firmware 5.0.0\u00a0and later", "poc": ["https://github.com/Ostorlab/KEV"]}, {"cve": "CVE-2023-33023", "desc": "Memory corruption while processing finish_sign command to pass a rsp buffer.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5354", "desc": "The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/aa380524-031d-4e49-9d0b-96e62d54557f"]}, {"cve": "CVE-2023-44361", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33558", "desc": "An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e-mails and usernames.", "poc": ["https://github.com/ninj4c0d3r/OcoMon-Research/commit/6357def478b11119270b89329fceb115f12c69fc", "https://github.com/ninj4c0d3r/OcoMon-Research", "https://github.com/ninj4c0d3r/ninj4c0d3r"]}, {"cve": "CVE-2023-40763", "desc": "User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5348", "desc": "The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.", "poc": ["https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1"]}, {"cve": "CVE-2023-4259", "desc": "Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.", "poc": ["http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html", "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gghm-c696-f4j4", "https://github.com/0xdea/advisories", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hnsecurity/vulns"]}, {"cve": "CVE-2023-51765", "desc": "sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports . but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.", "poc": ["https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/", "https://github.com/eeenvik1/CVE-2023-51764", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hannob/smtpsmug", "https://github.com/sagredo-dev/qmail"]}, {"cve": "CVE-2023-22040", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-0221", "desc": "Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution controls provided by ACC using the utilman program.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10370"]}, {"cve": "CVE-2023-4872", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Contact Manager App 1.0. This issue affects some unknown processing of the file add.php. The manipulation of the argument contact/contactName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239357 was assigned to this vulnerability.", "poc": ["https://skypoc.wordpress.com/2023/09/05/vuln1/"]}, {"cve": "CVE-2023-42643", "desc": "In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40207", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedNao Donations Made Easy \u2013 Smart Donations allows SQL Injection.This issue affects Donations Made Easy \u2013 Smart Donations: from n/a through 4.0.12.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27105", "desc": "A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player with Shanling MTouch OS v3.3 allows attackers to arbitrarily read, delete, or modify any critical system files via directory traversal.", "poc": ["https://github.com/HexaVector/4bf46f12"]}, {"cve": "CVE-2023-5564", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.", "poc": ["https://huntr.dev/bounties/9254d8f3-a847-4ae8-8477-d2ce027cff5c"]}, {"cve": "CVE-2023-44485", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21842", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-27810", "desc": "H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.", "poc": ["https://hackmd.io/@0dayResearch/ipqos_lanip_editlist"]}, {"cve": "CVE-2023-3720", "desc": "The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf.", "poc": ["https://wpscan.com/vulnerability/16375a7f-0a9f-4961-8510-d047ffbf3954", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42406", "desc": "SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute arbitrary code via the editrole.php component.", "poc": ["https://github.com/1dreamGN/CVE/blob/main/CVE-2023-42406.md", "https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000_sql_:sysmanage:editrole.php.md"]}, {"cve": "CVE-2023-39928", "desc": "A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1831"]}, {"cve": "CVE-2023-37772", "desc": "Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.", "poc": ["https://github.com/anky-123/CVE-2023-37772", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1587", "desc": "Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface. The issue was fixed with Avast and AVG Antivirus version 22.11", "poc": ["https://support.norton.com/sp/static/external/tools/security-advisories.html"]}, {"cve": "CVE-2023-1415", "desc": "A vulnerability was found in Simple Art Gallery 1.0. It has been declared as critical. This vulnerability affects the function sliderPicSubmit of the file adminHome.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. VDB-223126 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/0xxtoby/CVE-2023-1415", "https://github.com/0xxtoby/CVE-2023-1415-", "https://github.com/ARPSyndicate/cvemon", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-39073", "desc": "An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request.", "poc": ["https://gist.github.com/ph4nt0mbyt3/9456312e867c10de8f808250ec0b12d3"]}, {"cve": "CVE-2023-33298", "desc": "com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usingCAPath.", "poc": ["https://github.com/NSEcho/vos"]}, {"cve": "CVE-2023-5043", "desc": "Ingress nginx annotation injection causes arbitrary command execution.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/r0binak/CVE-2023-5043"]}, {"cve": "CVE-2023-50069", "desc": "WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker's file, and the result will render on the Matched page in the Body area, resulting in the execution of the payload. This occurs because the response body is not validated or sanitized.", "poc": ["https://github.com/holomekc/wiremock/issues/51"]}, {"cve": "CVE-2023-28370", "desc": "Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.", "poc": ["https://github.com/HotDB-Community/HotDB-Engine", "https://github.com/andersonloyem/magui"]}, {"cve": "CVE-2023-4307", "desc": "The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/06f7aa45-b5d0-4afb-95cc-8f1c82f6f8b3"]}, {"cve": "CVE-2023-2979", "desc": "A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230211.", "poc": ["https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be"]}, {"cve": "CVE-2023-0551", "desc": "The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments", "poc": ["https://wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-f12a2c655a7d"]}, {"cve": "CVE-2023-35844", "desc": "packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.", "poc": ["https://advisory.dw1.io/59", "https://github.com/Lserein/CVE-2023-35844", "https://github.com/Szlein/CVE-2023-35844", "https://github.com/izj007/wechat", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rat857/AtomsPanic", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-41601", "desc": "Multiple cross-site scripting (XSS) vulnerabilities in install/index.php of CSZ CMS v1.3.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Database Username or Database Host parameters.", "poc": ["https://github.com/al3zx/csz_cms_1_3_0_xss_in_install_page/blob/main/README.md"]}, {"cve": "CVE-2023-25754", "desc": "Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0.", "poc": ["https://github.com/elifesciences/github-repo-security-alerts"]}, {"cve": "CVE-2023-49974", "desc": "A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contact parameter at /customer_support/index.php?page=customer_list.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/geraldoalcantara/CVE-2023-49974", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3079", "desc": "Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html", "http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Threekiii/CVE", "https://github.com/Uniguri/CVE-1day", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/johe123qwe/github-trending", "https://github.com/kestryix/tisc-2023-writeups", "https://github.com/mistymntncop/CVE-2023-3079", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ret2eax/exploits", "https://github.com/sploitem/v8-writeups", "https://github.com/vu-ls/Zenbleed-Chrome-PoC", "https://github.com/wh1ant/vulnjs"]}, {"cve": "CVE-2023-50429", "desc": "IzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection.", "poc": ["https://github.com/orangecertcc/security-research/security/advisories/GHSA-mc3w-rv8p-f9xf", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25094", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the into_class_node function with either the class_name or old_class_name variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-7041", "desc": "A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some unknown functionality of the file /file-manager/rename.php. The manipulation of the argument newName leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248690 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20overwrite.md"]}, {"cve": "CVE-2023-38767", "desc": "SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-39144", "desc": "Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.", "poc": ["https://github.com/cduram/CVE-2023-39144", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5218", "desc": "Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3734", "desc": "Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26110", "desc": "All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-NODEBLUETOOTH-3311821"]}, {"cve": "CVE-2023-0796", "desc": "LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/499", "https://github.com/ARPSyndicate/cvemon", "https://github.com/peng-hui/CarpetFuzz", "https://github.com/waugustus/CarpetFuzz", "https://github.com/waugustus/waugustus"]}, {"cve": "CVE-2023-51541", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Uro\u0161evi\u0107 Stock Ticker allows Stored XSS.This issue affects Stock Ticker: from n/a through 3.23.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32821", "desc": "In video, there is a possible out of bounds write due to a permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08013430; Issue ID: ALPS08013433.", "poc": ["https://github.com/Resery/Resery"]}, {"cve": "CVE-2023-22049", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-34409", "desc": "In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticated API routes, to access otherwise protected API routes leading to escalation of privileges and information disclosure.", "poc": ["https://www.percona.com/blog/pmm-authentication-bypass-vulnerability-fixed-in-2-37-1/"]}, {"cve": "CVE-2023-3731", "desc": "Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)", "poc": ["https://github.com/zhchbin/zhchbin"]}, {"cve": "CVE-2023-49391", "desc": "An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message.", "poc": ["https://github.com/free5gc/free5gc/issues/497", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29862", "desc": "An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel parameters.", "poc": ["https://github.com/Duke1410/CVE"]}, {"cve": "CVE-2023-1841", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Honeywell MPA2 Access Panel (Web server modules) allows XSS Using Invalid Characters.This issue affects MPA2 Access Panel all version prior to R1.00.08.05.\u00a0Honeywell released firmware update package MPA2 firmware\u00a0R1.00.08.05 which addresses\u00a0this vulnerability. This version and all later versionscorrect the reported vulnerability.", "poc": ["https://https://www.honeywell.com/us/en/product-security", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44276", "desc": "OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.", "poc": ["https://www.x41-dsec.de/lab/advisories/x41-2023-001-opnsense"]}, {"cve": "CVE-2023-36617", "desc": "A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/lifeparticle/Ruby-Cheatsheet"]}, {"cve": "CVE-2023-41603", "desc": "D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers to arbitrarily access any services running on the device that may be inadvertently listening via IPv6.", "poc": ["https://github.com/YjjNJUPT/AsiaCCS2024_vul_report"]}, {"cve": "CVE-2023-3380", "desc": "A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of the argument pingIp leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/sleepyvv/vul_report/blob/main/WAVLINK/WAVLINK-WN579X3-RCE.md"]}, {"cve": "CVE-2023-39786", "desc": "Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sscanf function.", "poc": ["https://github.com/Xunflash/IOT/tree/main/Tenda_AC8_V4/3", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43339", "desc": "Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Database Name, DataBase User or Database Port components.", "poc": ["https://github.com/sromanhu/CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation/blob/main/README.md", "https://github.com/sromanhu/Cmsmadesimple-CMS-Stored-XSS/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation"]}, {"cve": "CVE-2023-2183", "desc": "Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.", "poc": ["https://github.com/grafana/bugbounty/security/advisories/GHSA-cvm3-pp2j-chr3"]}, {"cve": "CVE-2023-41877", "desc": "GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location to an arbitrary location. The admin console GeoServer Logs page provides a preview of these contents. As this issue requires GeoServer administrators access, often representing a trusted party, the vulnerability has not received a patch as of time of publication. As a workaround, a system administrator responsible for running GeoServer can use the `GEOSERVER_LOG_FILE` setting to override any configuration option provided by the Global Settings page. The `GEOSERVER_LOG_LOCATION` parameter can be set as system property, environment variables, or servlet context parameters.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37279", "desc": "Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.", "poc": ["https://github.com/contribsys/faktory/security/advisories/GHSA-x4hh-vjm7-g2jv"]}, {"cve": "CVE-2023-21285", "desc": "In setMetadata of MediaSessionRecord.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://android.googlesource.com/platform/frameworks/base/+/0c3b7ec3377e7fb645ec366be3be96bb1a252ca1", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/uthrasri/framework_base_CVE-2023-21285_NoPatch"]}, {"cve": "CVE-2023-1327", "desc": "Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain administrative access to the device's web management interface by resetting the admin password.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-47800", "desc": "Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to perform remote code execution, data exfiltration, or other nefarious actions such as tampering with data or destroying/disrupting MSSQL services.", "poc": ["https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2023-006.txt"]}, {"cve": "CVE-2023-5475", "desc": "Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4114", "desc": "A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235961 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/173932/PHPJabbers-Night-Club-Booking-1.0-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-38435", "desc": "An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Apache Felix Healthcheck Webconsole Plugin version 2.0.2 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack.Upgrade to Apache Felix Healthcheck Webconsole Plugin 2.1.0 or higher.", "poc": ["http://seclists.org/fulldisclosure/2023/Jul/43"]}, {"cve": "CVE-2023-43884", "desc": "A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' parameter.", "poc": ["https://github.com/dpuenteramirez/XSS-ReferenceID-Subrion_4.2.1"]}, {"cve": "CVE-2023-4807", "desc": "Issue summary: The POLY1305 MAC (message authentication code) implementationcontains a bug that might corrupt the internal state of applications on theWindows 64 platform when running on newer X86_64 processors supporting theAVX512-IFMA instructions.Impact summary: If in an application that uses the OpenSSL library an attackercan influence whether the POLY1305 MAC algorithm is used, the applicationstate might be corrupted with various application dependent consequences.The POLY1305 MAC (message authentication code) implementation in OpenSSL doesnot save the contents of non-volatile XMM registers on Windows 64 platformwhen calculating the MAC of data larger than 64 bytes. Before returning tothe caller all the XMM registers are set to zero rather than restoring theirprevious content. The vulnerable code is used only on newer x86_64 processorssupporting the AVX512-IFMA instructions.The consequences of this kind of internal application state corruption canbe various - from no consequences, if the calling application does notdepend on the contents of non-volatile XMM registers at all, to the worstconsequences, where the attacker could get complete control of the applicationprocess. However given the contents of the registers are just zeroized sothe attacker cannot put arbitrary values inside, the most likely consequence,if any, would be an incorrect result of some application dependentcalculations or a crash leading to a denial of service.The POLY1305 MAC algorithm is most frequently used as part of theCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)algorithm. The most common usage of this AEAD cipher is with TLS protocolversions 1.2 and 1.3 and a malicious client can influence whether this AEADcipher is used by the server. This implies that server applications usingOpenSSL can be potentially impacted. However we are currently not aware ofany concrete application that would be affected by this issue therefore weconsider this a Low severity security issue.As a workaround the AVX512-IFMA instructions support can be disabled atruntime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000The FIPS provider is not affected by this issue.", "poc": ["https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-52448", "desc": "In the Linux kernel, the following vulnerability has been resolved:gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dumpSyzkaller has reported a NULL pointer dereference when accessingrgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creatingrgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check ingfs2_rgrp_dump() to prevent that.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1267", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ulkem Company PtteM Kart.This issue affects PtteM Kart: before 2.1.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-24344", "desc": "D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWlanGuestSetup.", "poc": ["https://github.com/1160300418/Vuls/tree/main/D-Link/DIR-605L/webpage_Vuls/01"]}, {"cve": "CVE-2023-5554", "desc": "Lack of TLS certificate verification in log transmission of a financial module within LINE Client for iOS prior to 13.16.0.", "poc": ["https://github.com/aapooksman/certmitm", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38994", "desc": "The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2382", "desc": "A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument sysLogInfo.serverName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227660. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/1", "https://vuldb.com/?id.227660"]}, {"cve": "CVE-2023-1177", "desc": "Path Traversal: '\\..\\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.", "poc": ["https://huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28", "https://github.com/0day404/vulnerability-poc", "https://github.com/ARPSyndicate/cvemon", "https://github.com/KayCHENvip/vulnerability-poc", "https://github.com/Threekiii/Awesome-POC", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/hh-hunter/ml-CVE-2023-1177", "https://github.com/iumiro/CVE-2023-1177-MLFlow", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/protectai/Snaike-MLflow", "https://github.com/tiyeume25112004/CVE-2023-1177-rebuild"]}, {"cve": "CVE-2023-34747", "desc": "File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.", "poc": ["https://github.com/codeb0ss/CVE-2023-34747-PoC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-22010", "desc": "Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4.3.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-36940", "desc": "Cross Site Scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL v.1.2 allows attackers to execute arbitrary code via a crafted payload injected into the search field.", "poc": ["https://packetstormsecurity.com"]}, {"cve": "CVE-2023-32211", "desc": "A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1823379"]}, {"cve": "CVE-2023-7236", "desc": "The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it possible for unauthenticated attackers to retrieve the debug log which may contain information like system errors which could contain sensitive information.", "poc": ["https://wpscan.com/vulnerability/2a4557e2-b764-4678-a6d6-af39dd1ba76b/", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-46356", "desc": "In the module \"CSV Feeds PRO\" (csvfeeds) before 2.6.1 from Bl Modules for PrestaShop, a guest can perform SQL injection. The method `SearchApiCsv::getProducts()` has sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.", "poc": ["https://security.friendsofpresta.org/modules/2023/10/26/csvfeeds-89.html"]}, {"cve": "CVE-2023-2804", "desc": "A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash.", "poc": ["https://github.com/libjpeg-turbo/libjpeg-turbo/issues/668#issuecomment-1492586118", "https://github.com/libjpeg-turbo/libjpeg-turbo/issues/675"]}, {"cve": "CVE-2023-6693", "desc": "A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory and send it to the wire, causing an information leak.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2103", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.", "poc": ["https://huntr.dev/bounties/1df09505-9923-43b9-82ef-15d94bc3f9dc", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-52425", "desc": "libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.", "poc": ["https://github.com/GrigGM/05-virt-04-docker-hw", "https://github.com/Murken-0/docker-vulnerabilities", "https://github.com/PaulZtx/docker_practice", "https://github.com/TimoTielens/httpd-security", "https://github.com/egorvozhzhov/docker-test", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-45011", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Igor Buyanov WP Power Stats plugin <=\u00a02.2.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0340", "desc": "The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.", "poc": ["https://wpscan.com/vulnerability/71956598-90aa-4557-947a-c4716674543d"]}, {"cve": "CVE-2023-28391", "desc": "A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1732"]}, {"cve": "CVE-2023-36375", "desc": "Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Guardian relation, complimentary address, city, permanent address, and city parameters in the Book Hostel & Room Details page.", "poc": ["https://packetstormsecurity.com"]}, {"cve": "CVE-2023-47633", "desc": "Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/traefik/traefik/security/advisories/GHSA-6fwg-jrfw-ff7p"]}, {"cve": "CVE-2023-43518", "desc": "Memory corruption in video while parsing invalid mp2 clip.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40036", "desc": "Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-092_Notepad__/", "https://github.com/123papapro/123papapro"]}, {"cve": "CVE-2023-29465", "desc": "SageMath FlintQS 1.0 relies on pathnames under TMPDIR (typically world-writable), which (for example) allows a local user to overwrite files with the privileges of a different user (who is running FlintQS).", "poc": ["https://github.com/sagemath/FlintQS/issues/3"]}, {"cve": "CVE-2023-49040", "desc": "An issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the form_fast_setting_internet_set function.", "poc": ["https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/form_fast_setting_internet_set.md"]}, {"cve": "CVE-2023-25182", "desc": "Uncontrolled search path element in the Intel(R) Unite(R) Client software for Mac before version 4.2.11 may allow an authenticated user to potentially enable escalation of privilege via local access.", "poc": ["https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-3574", "desc": "Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.", "poc": ["https://huntr.dev/bounties/1dcb4f01-e668-4aa3-a6a3-838532e500c6"]}, {"cve": "CVE-2023-39977", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-3268. Reason: This candidate is a reservation duplicate of CVE-2023-3268. Notes: All CVE users should reference CVE-2023-3268 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4010", "desc": "A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole in its implementation. Due to the inappropriate judgment condition of the goto statement, the function cannot return under the input of a specific malformed descriptor file, so it falls into an endless loop, resulting in a denial of service.", "poc": ["https://github.com/wanrenmi/a-usb-kernel-bug"]}, {"cve": "CVE-2023-3738", "desc": "Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23583", "desc": "Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access.", "poc": ["https://github.com/EGI-Federation/SVG-advisories", "https://github.com/Mav3r1ck0x1/CVE-2023-23583-Reptar-", "https://github.com/blazcode/INTEL-SA-00950", "https://github.com/giterlizzi/secdb-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/speed47/spectre-meltdown-checker"]}, {"cve": "CVE-2023-26556", "desc": "io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/keygen/round_2.go. (bnb-chain/tss-lib and thorchain/tss are also affected.)", "poc": ["https://medium.com/@iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b"]}, {"cve": "CVE-2023-20937", "desc": "In several functions of the Android Linux kernel, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257443051References: Upstream kernel", "poc": ["http://packetstormsecurity.com/files/171239/Android-GKI-Kernels-Contain-Broken-Non-Upstream-Speculative-Page-Faults-MM-Code.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-40595", "desc": "In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50955", "desc": "IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installation which could aid in further attacks against the system. IBM X-Force ID: 275777.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32559", "desc": "A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36252", "desc": "An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via a the session expiration function.", "poc": ["https://www.zeroscience.mk/en/vulnerabilities/"]}, {"cve": "CVE-2023-7051", "desc": "A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/manage-notes.php of the component Notes Handler. The manipulation of the argument delid leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248738 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/csrf_delete_notes.md"]}, {"cve": "CVE-2023-0231", "desc": "The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/533c19d5-219c-4389-a8bf-8b3a35b33b20"]}, {"cve": "CVE-2023-3017", "desc": "A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as problematic. This affects an unknown part of the file admin/?page=user/manage_user of the component Manage User Page. The manipulation of the argument First Name/Middle Name/Last Name leads to basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230361 was assigned to this vulnerability.", "poc": ["https://medium.com/@akashpandey380/lost-and-found-information-system-v1-0-html-injection-3596f2b856c0"]}, {"cve": "CVE-2023-47865", "desc": "Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the Hardened Mode setting was enabled", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42974", "desc": "A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, macOS Sonoma 14.2. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43193", "desc": "Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). An attacker can create a malicious link in the forum that leads to XSS.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40757", "desc": "User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5390", "desc": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.", "poc": ["https://www.honeywell.com/us/en/product-security"]}, {"cve": "CVE-2023-37598", "desc": "A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function.", "poc": ["https://github.com/sahiloj/CVE-2023-37598", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sahiloj/CVE-2023-37598"]}, {"cve": "CVE-2023-6006", "desc": "This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must be able to write into the local C Drive. In addition, the attacker must have admin privileges to enable Print Archiving or encounter a misconfigured system. This vulnerability does not apply to PaperCut NG installs that have Print Archiving enabled and configured as per the recommended set up procedure. This specific flaw exists within the pc-pdl-to-image process. The process loads an executable from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM", "poc": ["https://www.papercut.com/kb/Main/CommonSecurityQuestions/"]}, {"cve": "CVE-2023-29532", "desc": "A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server.*Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1806394"]}, {"cve": "CVE-2023-26262", "desc": "An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server.", "poc": ["https://github.com/istern/CVE-2023-26262", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-24119", "desc": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet.", "poc": ["https://oxnan.com/posts/WifiBasic_wrlEn_5g_DoS"]}, {"cve": "CVE-2023-46712", "desc": "A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its privilege via specifically crafted HTTP requests.", "poc": ["https://github.com/vulsio/go-cve-dictionary"]}, {"cve": "CVE-2023-34756", "desc": "bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit.", "poc": ["https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability"]}, {"cve": "CVE-2023-27997", "desc": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Aicks/FortiGate-CVE-2023-27997", "https://github.com/BishopFox/CVE-2023-27997-check", "https://github.com/Cyb3rEnthusiast/CVE-2023-27997", "https://github.com/Guest-user1/sploits", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Pik-sec/cve-2023-27997", "https://github.com/TechinsightsPro/ShodanFortiOS", "https://github.com/Threekiii/CVE", "https://github.com/awchjimmy/CVE-2023-27997-tutorial", "https://github.com/bollwarm/SecToolSet", "https://github.com/delsploit/CVE-2023-27997", "https://github.com/f1tao/awesome-iot-security-resource", "https://github.com/gysf666/CVE-2023-27997-test", "https://github.com/h4x0r-dz/CVE-2024-21762", "https://github.com/hheeyywweellccoommee/CVE-2023-27997-POC-FortiOS-SSL-VPN-buffer-overflow-vulnerability-ssijz", "https://github.com/hheeyywweellccoommee/CVE-2023-27997-test-nleyl", "https://github.com/imbas007/CVE-2023-27997-Check", "https://github.com/l0n-b3cca/exploit_choom", "https://github.com/lexfo/xortigate-cve-2023-27997", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/m474r5/CVE-2023-27997-POC", "https://github.com/m474r5/CVE-2023-27997-findings", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/puckiestyle/cve-2023-27997", "https://github.com/rio128128/CVE-2023-27997-POC", "https://github.com/todb-cisa/kev-cwes"]}, {"cve": "CVE-2023-28159", "desc": "The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks.
*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 111.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1783561"]}, {"cve": "CVE-2023-4650", "desc": "Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.", "poc": ["https://huntr.dev/bounties/d92e8985-9d9d-4a62-92e8-ada014ee3b17"]}, {"cve": "CVE-2023-33985", "desc": "SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-22483", "desc": "cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.", "poc": ["https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c"]}, {"cve": "CVE-2023-4156", "desc": "A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.", "poc": ["https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-33785", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.", "poc": ["https://github.com/anhdq201/netbox/issues/8"]}, {"cve": "CVE-2023-0068", "desc": "The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/4abd1454-380c-4c23-8474-d7da4b2f3b8e"]}, {"cve": "CVE-2023-26431", "desc": "IPv4-mapped IPv6 addresses did not get recognized as \"local\" by the code and a connection attempt is made. Attackers with access to user accounts could use this to bypass existing deny-list functionality and trigger requests to restricted network infrastructure to gain insight about topology and running services. We now respect possible IPV4-mapped IPv6 addresses when checking if contained in a deny-list. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html"]}, {"cve": "CVE-2023-30145", "desc": "Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.", "poc": ["http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html", "https://github.com/paragbagul111/CVE-2023-30145", "https://github.com/ARPSyndicate/cvemon", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/paragbagul111/CVE-2023-30145"]}, {"cve": "CVE-2023-29656", "desc": "An improper authorization vulnerability in Darktrace mobile app (Android) prior to version 6.0.15 allows disabled and low-privilege users to control \"antigena\" actions(block/unblock traffic) from the mobile application. This vulnerability could create a \"shutdown\", blocking all ingress or egress traffic in the entire infrastructure where darktrace agents are deployed.", "poc": ["https://ramihub.github.io/", "https://github.com/ramihub/ramihub.github.io"]}, {"cve": "CVE-2023-22044", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-38674", "desc": "FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-006.md"]}, {"cve": "CVE-2023-5852", "desc": "Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3626", "desc": "A vulnerability, which was classified as critical, has been found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This issue affects some unknown processing of the file /Duty/AjaxHandle/UpLoadFloodPlanFile.ashx of the component UpLoadFloodPlanFile. The manipulation of the argument Filedata leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233579. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/MoeMion233/cve/blob/main/2.md"]}, {"cve": "CVE-2023-2900", "desc": "A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown function of the file /Login/CheckLogin. The manipulation leads to use of weak hash. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-229974 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/NFine-Rapid-development-platform-has-weak-password-vulnerability.md"]}, {"cve": "CVE-2023-5890", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.", "poc": ["https://huntr.com/bounties/b60e6e1f-e44d-4b11-acf8-b0548b915686"]}, {"cve": "CVE-2023-26602", "desc": "ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.", "poc": ["http://packetstormsecurity.com/files/171137/ASUS-ASMB8-iKVM-1.14.51-SNMP-Remote-Root.html", "http://seclists.org/fulldisclosure/2023/Feb/15", "https://nwsec.de/NWSSA-002-2023.txt", "https://github.com/ARPSyndicate/cvemon", "https://github.com/D1G17/CVE-2023-26602", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38902", "desc": "A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field.", "poc": ["https://gist.github.com/ZIKH26/18693c67ee7d2f8d2c60231b19194c37"]}, {"cve": "CVE-2023-46116", "desc": "Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.", "poc": ["https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644"]}, {"cve": "CVE-2023-0797", "desc": "LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/495", "https://github.com/ARPSyndicate/cvemon", "https://github.com/peng-hui/CarpetFuzz", "https://github.com/waugustus/CarpetFuzz", "https://github.com/waugustus/waugustus"]}, {"cve": "CVE-2023-3304", "desc": "Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.", "poc": ["https://huntr.dev/bounties/721fae61-3c8c-4e4b-8407-64321bc0ed17"]}, {"cve": "CVE-2023-51252", "desc": "PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing.", "poc": ["https://github.com/sanluan/PublicCMS/issues/79"]}, {"cve": "CVE-2023-41729", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <=\u00a01.22.3.31 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20761", "desc": "In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628604; Issue ID: ALPS07628582.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1300", "desc": "A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222661 was assigned to this vulnerability.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-21253", "desc": "In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/nidhi7598/frameworks_base_AOSP10_r33_CVE-2023-21253"]}, {"cve": "CVE-2023-51689", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 Easy Video Player allows Stored XSS.This issue affects Easy Video Player: from n/a through 1.2.2.10.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38618", "desc": "Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40035", "desc": "Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.", "poc": ["https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phw"]}, {"cve": "CVE-2023-52342", "desc": "In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26081", "desc": "In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.", "poc": ["https://github.com/google/security-research/security/advisories/GHSA-mhhf-w9xw-pp9x"]}, {"cve": "CVE-2023-2178", "desc": "The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/e84b71f9-4208-4efb-90e8-1c778e7d2ebb"]}, {"cve": "CVE-2023-37208", "desc": "When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1837675"]}, {"cve": "CVE-2023-5511", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.", "poc": ["https://huntr.dev/bounties/43206801-9862-48da-b379-e55e341d78bf"]}, {"cve": "CVE-2023-23595", "desc": "BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as \"machine example.com login daniel password qwerty\" in the documentation example for the .netrc file format. NOTE: 2.x versions are no longer supported. There is no available information about whether any later version is affected.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/colemanjp/XXE-Vulnerability-in-Bluecat-Device-Registration-Portal-DRP"]}, {"cve": "CVE-2023-3664", "desc": "The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.", "poc": ["https://wpscan.com/vulnerability/d59e6eac-3ebf-40e0-800c-8cbef345423f"]}, {"cve": "CVE-2023-2240", "desc": "Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.", "poc": ["https://huntr.dev/bounties/8f595559-7b4b-4b00-954c-7a627766e203"]}, {"cve": "CVE-2023-51521", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36629", "desc": "The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read.", "poc": ["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hunting-for-android-privilege-escalation-with-a-32-line-fuzzer/", "https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2023-007_Xiaomi_Redmi_10sNote-1.txt"]}, {"cve": "CVE-2023-49406", "desc": "Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet.", "poc": ["https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_telnet/w30e_telnet.md"]}, {"cve": "CVE-2023-5877", "desc": "The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.", "poc": ["https://wpscan.com/vulnerability/39ed4934-3d91-4924-8acc-25759fef9e81"]}, {"cve": "CVE-2023-1388", "desc": "A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory block, resulting in the service becoming unavailable.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10398"]}, {"cve": "CVE-2023-52438", "desc": "In the Linux kernel, the following vulnerability has been resolved:binder: fix use-after-free in shinker's callbackThe mmap read lock is used during the shrinker's callback, which meansthat using alloc->vma pointer isn't safe as it can race with munmap().As of commit dd2283f2605e (\"mm: mmap: zap pages with read mmap_sem inmunmap\") the mmap lock is downgraded after the vma has been isolated.I was able to reproduce this issue by manually adding some delays andtriggering page reclaiming through the shrinker's debug sysfs. Thefollowing KASAN report confirms the UAF: ================================================================== BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758 ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368 vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8 vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7cFix this issue by performing instead a vma_lookup() which will fail tofind the vma that was isolated before the mmap lock downgrade. Note thatthis option has better performance than upgrading to a mmap write lockwhich would increase contention. Plus, mmap_write_trylock() has beenrecently removed anyway.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1110", "desc": "The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/1830e829-4a43-4d98-8214-eecec6bef694"]}, {"cve": "CVE-2023-40605", "desc": "Auth. (contributor) Cross-Site Scripting (XSS) vulnerability in 93digital Typing Effect plugin <=\u00a01.3.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7079", "desc": "Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34164", "desc": "Vulnerability of incomplete input parameter verification in the communication framework module. Successful exploitation of this vulnerability may affect availability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28101", "desc": "Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-49245", "desc": "Unauthorized access vulnerability in the Huawei Share module. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38127", "desc": "An integer overflow exists in the \"HyperLinkFrame\" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the parser to make an under-sized allocation, which can later allow for memory corruption, potentially resulting in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1808", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1808"]}, {"cve": "CVE-2023-28813", "desc": "An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files.", "poc": ["https://github.com/LOURC0D3/ENVY-gitbook", "https://github.com/LOURC0D3/LOURC0D3", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25120", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_dmvpn function with the cisco_secret variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-20635", "desc": "In keyinstall, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07563028; Issue ID: ALPS07563028.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Resery/Resery"]}, {"cve": "CVE-2023-26612", "desc": "D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the HostName field in SetParentsControlInfo.", "poc": ["https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1/SetParentsControlInfo"]}, {"cve": "CVE-2023-3654", "desc": "cashIT! - serving solutions. Devices from \"PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH\" to 03.A06rks 2023.02.37 are affected by a origin bypass via the host header in an HTTP request.\u00a0This vulnerability can be triggered by an HTTP endpoint exposed to the network.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0668", "desc": "Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.", "poc": ["https://gitlab.com/wireshark/wireshark/-/issues/19087", "https://takeonme.org/cves/CVE-2023-0668.html"]}, {"cve": "CVE-2023-25616", "desc": "In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object\u00a0execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. Successful attack could highly impact the confidentiality, Integrity, and Availability of the system.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-29087", "desc": "An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP Retry-After header.", "poc": ["http://packetstormsecurity.com/files/172295/Shannon-Baseband-SIP-Retry-After-Header-Heap-Buffer-Overflow.html"]}, {"cve": "CVE-2023-43803", "desc": "Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6020", "desc": "LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.", "poc": ["https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-41249", "desc": "In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40931", "desc": "A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-40851", "desc": "Cross Site Scripting (XSS) vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to run arbitrary code via fname, lname, email, and contact fields of the user registration page.", "poc": ["https://www.exploit-db.com/exploits/51694"]}, {"cve": "CVE-2023-34486", "desc": "itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote code execution can be achieved by entering malicious code in the date selection box.", "poc": ["https://github.com/JunyanYip/itsourcecode_justines_xss_vul"]}, {"cve": "CVE-2023-31723", "desc": "yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function expand_mmac_params at /nasm/nasm-pp.c.", "poc": ["https://github.com/DaisyPo/fuzzing-vulncollect/blob/main/yasm/SEGV/nasm-pp.c:4008%20in%20expand_mmac_params/README.md", "https://github.com/yasm/yasm/issues/220"]}, {"cve": "CVE-2023-23456", "desc": "A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.", "poc": ["https://github.com/upx/upx/issues/632"]}, {"cve": "CVE-2023-45004", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wp3sixty Woo Custom Emails plugin <=\u00a02.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42876", "desc": "The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to a denial-of-service or potentially disclose memory contents.", "poc": ["https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-3987", "desc": "A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=user/manage_user&id=3. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235608.", "poc": ["https://github.com/draco1725/POC/blob/main/Exploit/Simple%20Online%20Men's%20Salon%20Management%20System/SQL%20Injection"]}, {"cve": "CVE-2023-5339", "desc": "Mattermost Desktop\u00a0fails to set an appropriate log level during initial run after fresh installation\u00a0resulting in logging all keystrokes\u00a0including password entry\u00a0being logged.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28104", "desc": "`silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with particularly large/complex graphql schemas. Users should upgrade to `silverstripe/graphql` 4.2.3 or 4.1.2 to remedy the vulnerability.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-4426", "desc": "** REJECT ** **REJECT** Not a valid security issue - vendor unable to replicate.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-47119", "desc": "Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.", "poc": ["https://github.com/BaadMaro/BaadMaro", "https://github.com/BaadMaro/CVE-2023-47119", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2378", "desc": "A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation of the argument suffix-rate-up leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227654 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/4"]}, {"cve": "CVE-2023-49471", "desc": "Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make(), which could allow authenticated remote attackers to execute arbitrary code.", "poc": ["https://github.com/zunak/CVE-2023-49471", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zunak/CVE-2023-49471"]}, {"cve": "CVE-2023-43567", "desc": "A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-7165", "desc": "The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.", "poc": ["https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/"]}, {"cve": "CVE-2023-1818", "desc": "Use after free in Vulkan in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/KirtiRamchandani/KirtiRamchandani"]}, {"cve": "CVE-2023-22795", "desc": "A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.", "poc": ["https://github.com/jasnow/585-652-ruby-advisory-db", "https://github.com/rubysec/ruby-advisory-db"]}, {"cve": "CVE-2023-28477", "desc": "Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5915", "desc": "A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation.\u00a0This vulnerability may allow to a remote attacker to cause a denial-of-service condition to the FCN/FCJ controller by sending a crafted packet. While sending the packet, the maintenance homepage of the controller could not be accessed. Therefore, functions of the maintenance homepage, changing configuration, viewing logs, etc. are not available. But the controller\u2019s operation is not stopped by the condition.The affected products and versions are as follows: STARDOM FCN/FCJ R1.01 to R4.31.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27637", "desc": "An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.", "poc": ["https://friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.html"]}, {"cve": "CVE-2023-4309", "desc": "Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused elections and enabled web application firewall (WAF) protection for current and future elections on or around 2023-08-12.", "poc": ["https://www.youtube.com/watch?v=yeG1xZkHc64", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6722", "desc": "A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of sensitive information. An attacker could access files such as application code or data, backend credentials, operating system files...", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36612", "desc": "Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses (containing sensitive information) to third-party applications by using a custom-crafted deeplink scheme.", "poc": ["https://github.com/Ch0pin/related_work"]}, {"cve": "CVE-2023-5057", "desc": "The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks", "poc": ["https://wpscan.com/vulnerability/58a63507-f0fd-46f1-a80c-6b1c41dddcf5"]}, {"cve": "CVE-2023-1714", "desc": "Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitrary code via (1) appending arbitrary content to existing PHP files or (2) PHAR deserialization.", "poc": ["https://starlabs.sg/advisories/23/23-1714/", "https://github.com/ForceFledgling/CVE-2023-1714", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5084", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.", "poc": ["https://huntr.dev/bounties/f3340570-6e59-4c72-a7d1-d4b829b4fb45"]}, {"cve": "CVE-2023-33218", "desc": "The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow. This could potentially lead to a Remote Code execution on the targeted device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4382", "desc": "A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /user/settings of the component Profile Settings. The manipulation of the argument avatar leads to cross site scripting. The attack may be launched remotely. VDB-237314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/174212/Hyip-Rio-2.1-Cross-Site-Scripting-File-Upload.html"]}, {"cve": "CVE-2023-49295", "desc": "quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6279", "desc": "The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name", "poc": ["https://wpscan.com/vulnerability/626bbc7d-0d0f-4418-ac61-666278a1cbdb/"]}, {"cve": "CVE-2023-28353", "desc": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to chain this vulnerability with others to cause a deployed DLL file to immediately execute as NT AUTHORITY/SYSTEM.", "poc": ["https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/", "https://research.nccgroup.com/?research=Technical%20advisories"]}, {"cve": "CVE-2023-3275", "desc": "A vulnerability classified as critical was found in PHPGurukul Rail Pass Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view-pass-detail.php of the component POST Request Handler. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The identifier VDB-231625 was assigned to this vulnerability.", "poc": ["https://github.com/scumdestroy/100-RedTeam-Projects"]}, {"cve": "CVE-2023-46672", "desc": "An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances.The prerequisites for the manifestation of this issue are: * Logstash is configured to log in JSON format https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html , which is not the default logging format. * Sensitive data is stored in the Logstash keystore and referenced as a variable in Logstash configuration.", "poc": ["https://www.elastic.co/community/security", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4250", "desc": "The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/9c271619-f478-45c3-91d9-be0f55ee06a2"]}, {"cve": "CVE-2023-50951", "desc": "IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive information about invalid authorization attempts. IBM X-Force ID: 275747.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2440", "desc": "The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'admin_page', 'userpro_verify_user' and 'verifyUnverifyAllUsers' functions. This makes it possible for unauthenticated attackers to modify the role of verified users to elevate verified user privileges to that of any user such as 'administrator' via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681"]}, {"cve": "CVE-2023-33894", "desc": "In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2672", "desc": "A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file items/view.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228888.", "poc": ["https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/CVE-2023-2672.md", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-0947", "desc": "Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.", "poc": ["https://huntr.dev/bounties/7379d702-72ff-4a5d-bc68-007290015496"]}, {"cve": "CVE-2023-0126", "desc": "Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.", "poc": ["https://github.com/Gerxnox/One-Liner-Collections", "https://github.com/thecybertix/One-Liner-Collections"]}, {"cve": "CVE-2023-4687", "desc": "The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts.", "poc": ["https://wpscan.com/vulnerability/31596fc5-4203-40c4-9b0a-e8a37faafddd"]}, {"cve": "CVE-2023-44252", "desc": "** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27801", "desc": "H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.", "poc": ["https://hackmd.io/@0dayResearch/DelDNSHnList"]}, {"cve": "CVE-2023-43789", "desc": "A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46071", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ClickDatos Protecci\u00f3n de Datos RGPD plugin <=\u00a03.1.0 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-30480", "desc": "Missing Authorization vulnerability in Sparkle WP Educenter.This issue affects Educenter: from n/a through 1.5.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46018", "desc": "SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \\allows attackers to run arbitrary SQL commands via 'remail' parameter.", "poc": ["https://github.com/ersinerenler/CVE-2023-46018-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability", "https://github.com/ersinerenler/CVE-2023-46018-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability", "https://github.com/ersinerenler/Code-Projects-Blood-Bank-1.0", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3771", "desc": "The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary websites.", "poc": ["https://wpscan.com/vulnerability/7c6fc499-de09-4874-ab96-bdc24d550cfb/"]}, {"cve": "CVE-2023-33320", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mohammad I. Okfie WP-Hijri plugin <=\u00a01.5.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20251", "desc": "A vulnerability in the memory buffer of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause memory leaks that could eventually lead to a device reboot.\nThis vulnerability is due to memory leaks caused by multiple clients connecting under specific conditions. An attacker could exploit this vulnerability by causing multiple wireless clients to attempt to connect to an access point (AP) on an affected device. A successful exploit could allow the attacker to cause the affected device to reboot after a significant amount of time, resulting in a denial of service (DoS) condition.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44466", "desc": "An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32.", "poc": ["https://github.com/google/security-research/security/advisories/GHSA-jg27-jx6w-xwph", "https://github.com/chenghungpan/test_data", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28748", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in biztechc Copy or Move Comments allows SQL Injection.This issue affects Copy or Move Comments: from n/a through 5.0.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33969", "desc": "Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an attacker to execute arbitrary Javascript and any user who views the task containing the malicious code will be exposed to the XSS attack. Note: The default CSP header configuration blocks this javascript attack. This issue has been addressed in version 1.2.30. Users are advised to upgrade. Users unable to upgrade should ensure that they have a restrictive CSP header config.", "poc": ["https://github.com/kanboard/kanboard/security/advisories/GHSA-8qvf-9847-gpc9"]}, {"cve": "CVE-2023-4462", "desc": "A vulnerability classified as problematic has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. This affects an unknown part of the component Web Configuration Application. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249255.", "poc": ["https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices", "https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"]}, {"cve": "CVE-2023-43995", "desc": "An issue in picot.golf mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33565", "desc": "** DISPUTED ** ROS2 (Robot Operating System 2) Foxy Fitzroy ROS_VERSION=2 and ROS_PYTHON_VERSION=3 are vulnerable to Denial-of-Service (DoS) attacks. A malicious user potentially exploited the vulnerability remotely and crashed the ROS2 nodes. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/16yashpatel/CVE-2023-33565", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2023-33565"]}, {"cve": "CVE-2023-7160", "desc": "A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Add Engineer Handler. The manipulation of the argument first name/last name with the input leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249182 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.249182"]}, {"cve": "CVE-2023-3721", "desc": "The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/3f90347a-6586-4648-9f2c-d4f321bf801a"]}, {"cve": "CVE-2023-40000", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rxerium/CVE-2023-40000", "https://github.com/rxerium/stars", "https://github.com/securitycipher/daily-bugbounty-writeups"]}, {"cve": "CVE-2023-3618", "desc": "A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/jgamblin/cvelint-action", "https://github.com/mprpic/cvelint"]}, {"cve": "CVE-2023-3513", "desc": "Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to\u00a0gain SYSTEM privilege via communicating with the named pipe as a low-privilege user and triggering an insecure .NET deserialization.", "poc": ["https://starlabs.sg/advisories/23/23-3513/", "https://github.com/SohelParashar/.Net-Deserialization-Cheat-Sheet", "https://github.com/star-sg/CVE"]}, {"cve": "CVE-2023-45111", "desc": "Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.\u00a0The 'email' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5033", "desc": "A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /admin/category/cate-edit-run.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239877 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.239877"]}, {"cve": "CVE-2023-39143", "desc": "PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).", "poc": ["https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/", "https://github.com/codeb0ss/CVE-2023-39143", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/nvn1729/advisories"]}, {"cve": "CVE-2023-21930", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-50312", "desc": "IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2342", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/01cd3ed5-dce8-4021-9de0-81cb14bf1829", "https://github.com/clearbluejar/ghidriff", "https://github.com/khanhchauminh/khanhchauminh"]}, {"cve": "CVE-2023-21923", "desc": "Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Health Sciences InForm. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Health Sciences InForm accessible data as well as unauthorized access to critical data or complete access to all Oracle Health Sciences InForm accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Health Sciences InForm. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-1067", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.", "poc": ["https://huntr.dev/bounties/31d17b34-f80d-49f2-86e7-97ae715cc045"]}, {"cve": "CVE-2023-50259", "desc": "Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testslack` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `slack_webhook` variable and passes it to the `notifiers.slack_notifier.test_notify` method, then `_notify_slack` and finally `_send_slack` method, which sends a POST request to the user-controlled URL on line 103 in `/medusa/notifiers/slack.py`, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.", "poc": ["https://github.com/pymedusa/Medusa/security/advisories/GHSA-8mcr-vffr-jwxv", "https://securitylab.github.com/advisories/GHSL-2023-201_GHSL-2023-202_Medusa/"]}, {"cve": "CVE-2023-39364", "desc": "Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php` file accepts `ref` as a URL parameter and reflects it in the form used to perform the change password. It's value is used to perform a redirect via `header` PHP function. A user can be tricked in performing the change password operation, e.g., via a phishing message, and then interacting with the malicious website where the redirection has been performed, e.g., downloading malwares, providing credentials, etc. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-4pjv-rmrp-r59x", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-4928", "desc": "SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.", "poc": ["https://huntr.dev/bounties/cb72cc17-5a0d-4392-9a5f-a13aa773de9e"]}, {"cve": "CVE-2023-26818", "desc": "Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.", "poc": ["https://github.com/Zeyad-Azima/CVE-2023-26818", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30620", "desc": "mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx", "https://github.com/Sim4n6/Sim4n6"]}, {"cve": "CVE-2023-27366", "desc": "Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20225.", "poc": ["https://github.com/Souf31/mqtt-pentest"]}, {"cve": "CVE-2023-21829", "desc": "Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Database RDBMS Security accessible data as well as unauthorized read access to a subset of Oracle Database RDBMS Security accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/MikeKutz/APEX--RAS-Cloud"]}, {"cve": "CVE-2023-5005", "desc": "The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/bfb174d4-7658-4883-a682-d06bda89ec44"]}, {"cve": "CVE-2023-28870", "desc": "Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged user accounts.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0004/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39354", "desc": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c3r2-pxxp-f8r6"]}, {"cve": "CVE-2023-6655", "desc": "A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_selfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument parentid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247358 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/willchen0011/cve/blob/main/HongJing-sql.md", "https://github.com/20142995/sectool"]}, {"cve": "CVE-2023-3393", "desc": "Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.", "poc": ["https://huntr.dev/bounties/e4df9280-900a-407a-a07e-e7fef3345914"]}, {"cve": "CVE-2023-21894", "desc": "Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer issues). Supported versions that are affected are Prior to 13.9.4.2.11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Global Lifecycle Management NextGen OUI Framework executes to compromise Oracle Global Lifecycle Management NextGen OUI Framework. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Global Lifecycle Management NextGen OUI Framework. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-33010", "desc": "A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-21964", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-26311", "desc": "A remote code execution vulnerability in the webview component of OPPO Store app.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48225", "desc": "Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another obj, the name of the obj itself will be used as the key, and the entire object structure will be integrated intact. When constructing the deployment instance of the app, env was found from the database and directly inserted into the template, resulting in controllability here. Sensitive information in the secret and configmap can be read through the k8s envFrom field. In a privatization environment, when `namespaceConf. fixed` is marked, it may lead to the leakage of sensitive information in the system. As of time of publication, it is unclear whether any patches or workarounds exist.", "poc": ["https://github.com/labring/laf/security/advisories/GHSA-hv2g-gxx4-fwxp"]}, {"cve": "CVE-2023-2927", "desc": "A vulnerability was found in JIZHICMS 2.4.5. It has been classified as critical. Affected is the function index of the file TemplateController.php. The manipulation of the argument webapi leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230082 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/HuBenLab/HuBenVulList/blob/main/JiZhiCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md"]}, {"cve": "CVE-2023-27019", "desc": "Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_458FBC function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC10/8/8.md"]}, {"cve": "CVE-2023-52424", "desc": "The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an \"SSID Confusion\" issue. This occurs because the SSID is not always used to derive the pairwise master key or session keys, and because there is not a protected exchange of an SSID during a 4-way handshake.", "poc": ["https://www.top10vpn.com/assets/2024/05/Top10VPN-x-Vanhoef-SSID-Confusion.pdf", "https://github.com/giterlizzi/secdb-feeds", "https://github.com/securitycipher/daily-bugbounty-writeups"]}, {"cve": "CVE-2023-51684", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads \u2013 Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital Downloads \u2013 Sell Digital Files (eCommerce Store & Payments Made Easy): from n/a through 3.2.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29732", "desc": "SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29732/CVE%20detail.md"]}, {"cve": "CVE-2023-25210", "desc": "Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromSetSysTime function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC5/1/1.md"]}, {"cve": "CVE-2023-37174", "desc": "GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dump_isom_scene function at /mp4box/filedump.c.", "poc": ["https://github.com/gpac/gpac/issues/2505"]}, {"cve": "CVE-2023-25231", "desc": "Tenda Router W30E V1.0.1.25(633) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface.", "poc": ["https://github.com/Funcy33/Vluninfo_Repo/tree/main/CNVDs/104"]}, {"cve": "CVE-2023-0147", "desc": "The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/af9cbb4a-42fc-43c5-88f3-349b417f1a6a"]}, {"cve": "CVE-2023-3567", "desc": "A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.", "poc": ["http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html", "http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html", "https://github.com/nidhi7598/linux-4.1.15_CVE-2023-3567", "https://github.com/nidhi7598/linux-4.19.72_CVE-2023-3567"]}, {"cve": "CVE-2023-2813", "desc": "All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2, BunnyPressLite WordPress theme before 2.1, Cafe Bistro WordPress theme before 1.1.4, College WordPress theme before 1.5.1, Connections Reloaded WordPress theme through 3.1, Counterpoint WordPress theme through 1.8.1, Digitally WordPress theme through 1.0.8, Directory WordPress theme before 3.0.2, Drop WordPress theme before 1.22, Everse WordPress theme before 1.2.4, Fashionable Store WordPress theme through 1.3.4, Fullbase WordPress theme before 1.2.1, Ilex WordPress theme before 1.4.2, Js O3 Lite WordPress theme through 1.5.8.2, Js Paper WordPress theme through 2.5.7, Kata WordPress theme before 1.2.9, Kata App WordPress theme through 1.0.5, Kata Business WordPress theme through 1.0.2, Looki Lite WordPress theme before 1.3.0, moseter WordPress theme through 1.3.1, Nokke WordPress theme before 1.2.4, Nothing Personal WordPress theme through 1.0.7, Offset Writing WordPress theme through 1.2, Opor Ayam WordPress theme through 18, Pinzolo WordPress theme before 1.2.10, Plato WordPress theme before 1.1.9, Polka Dots WordPress theme through 1.2, Purity Of Soul WordPress theme through 1.9, Restaurant PT WordPress theme before 1.1.3, Saul WordPress theme before 1.1.0, Sean Lite WordPress theme before 1.4.6, Tantyyellow WordPress theme through 1.0.0.5, TIJAJI WordPress theme through 1.43, Tiki Time WordPress theme through 1.3, Tuaug4 WordPress theme through 1.4, Tydskrif WordPress theme through 1.1.3, UltraLight WordPress theme through 1.2, Venice Lite WordPress theme before 1.5.5, Viala WordPress theme through 1.3.1, viburno WordPress theme before 1.3.2, Wedding Bride WordPress theme before 1.0.2, Wlow WordPress theme before 1.2.7 suffer from the same issue about the search box reflecting the results causing XSS which allows an unauthenticated attacker to exploit against users if they click a malicious link.", "poc": ["https://wpscan.com/vulnerability/f434afd3-7de4-4bf4-a9bb-9f9aeaae1dc5", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1850", "desc": "A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-224990 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.224990"]}, {"cve": "CVE-2023-7198", "desc": "The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses a significant security risk as it violates the principle of least privilege and compromises the integrity and privacy of user data.", "poc": ["https://wpscan.com/vulnerability/75fbee63-d622-441f-8675-082907b0b1e6/"]}, {"cve": "CVE-2023-4078", "desc": "Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27893", "desc": "An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions 2088_1_700, 2008_1_710, 740, can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform.\u00a0 Depending on the function executed, the attack can read or modify any user or application data and can make the application unavailable.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-41964", "desc": "The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0428", "desc": "The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/c933460b-f77d-4986-9f5a-32d9f3f8b412"]}, {"cve": "CVE-2023-4797", "desc": "The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.", "poc": ["https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92/"]}, {"cve": "CVE-2023-43668", "desc": "Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,\u00a0some sensitive params checks will be bypassed, like \"autoDeserizalize\",\"allowLoadLocalInfile\".....\u00a0\u00a0Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.[1]\u00a0 https://github.com/apache/inlong/pull/8604", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nbxiglk0/nbxiglk0"]}, {"cve": "CVE-2023-38905", "desc": "SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.", "poc": ["https://gist.github.com/wealeson1/e24fc8575f4e051320d69e9a75080642"]}, {"cve": "CVE-2023-33625", "desc": "D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function.", "poc": ["https://github.com/naihsin/IoT/blob/main/D-Link/DIR-600/cmd%20injection/README.md", "https://github.com/naihsin/IoT/tree/main/D-Link/DIR-600/cmd%20injection"]}, {"cve": "CVE-2023-39185", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1887", "desc": "Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/e4a58835-96b5-412c-a17e-3ceed30231e1", "https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-4895", "desc": "An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the 'group ip restriction' settings to access environment details of projects", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45158", "desc": "An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.", "poc": ["https://github.com/Evan-Zhangyf/CVE-2023-45158", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-47320", "desc": "Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in \"Maintenance Mode\" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below.", "poc": ["https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320", "https://github.com/RhinoSecurityLabs/CVEs"]}, {"cve": "CVE-2023-1186", "desc": "A vulnerability has been found in FabulaTech Webcam for Remote Desktop 2.8.42 and classified as problematic. This vulnerability affects the function 0x222010/0x222018 in the library ftwebcam.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-222358 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1186", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-20592", "desc": "Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity.", "poc": ["https://github.com/cispa/CacheWarp"]}, {"cve": "CVE-2023-24880", "desc": "Windows SmartScreen Security Feature Bypass Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/karimhabush/cyberowl", "https://github.com/whitfieldsdad/cisa_kev"]}, {"cve": "CVE-2023-30372", "desc": "In Tenda AC15 V15.03.05.19, The function \"xkjs_ver32\" contains a stack-based buffer overflow vulnerability.", "poc": ["https://github.com/2205794866/Tenda/blob/main/AC15/10.md"]}, {"cve": "CVE-2023-1713", "desc": "Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticated attackers to execute arbitrary code via uploading a crafted \".htaccess\" file.", "poc": ["https://starlabs.sg/advisories/23/23-1713/", "https://github.com/ForceFledgling/CVE-2023-1713", "https://github.com/k1rurk/check_bitrix", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31740", "desc": "There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the apply.cgi interface, thereby gaining shell privileges.", "poc": ["https://github.com/D2y6p/CVE/blob/main/Linksys/CVE-2023-31740/Linksys_E2000_RCE.pdf"]}, {"cve": "CVE-2023-33833", "desc": "IBM Security Verify Information Queue 10.0.4 and 10.0.5 stores sensitive information in plain clear text which can be read by a local user. IBM X-Force ID: 256013.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5483", "desc": "Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27290", "desc": "Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write access. IBM X-Force ID: 248737.", "poc": ["http://packetstormsecurity.com/files/171770/IBM-Instana-243-0-Missing-Authentication.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/karimhabush/cyberowl", "https://github.com/zipponnova/IBM-Instana-Exploits", "https://github.com/zipponnova/Microservices-Exploitation"]}, {"cve": "CVE-2023-0923", "desc": "A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27720", "desc": "D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_48d630 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/HolyTruth/DIR_878-1.30B08/blob/main/4.md"]}, {"cve": "CVE-2023-5956", "desc": "The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/b3d1fbae-88c9-45d1-92c6-0a529b21e3b2/"]}, {"cve": "CVE-2023-34346", "desc": "A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_20221108. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1764"]}, {"cve": "CVE-2023-31613", "desc": "An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1121", "https://github.com/Sedar2024/Sedar"]}, {"cve": "CVE-2023-2583", "desc": "Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.", "poc": ["https://huntr.dev/bounties/397ea68d-1e28-44ff-b830-c8883d067d96"]}, {"cve": "CVE-2023-6342", "desc": "Tyler Technologies Court Case Management Plus allows a remote attacker to authenticate as any user by manipulating at least the 'CmWebSearchPfp/Login.aspx?xyzldk=' and 'payforprint_CM/Redirector.ashx?userid=' parameters. The vulnerable \"pay for print\" feature was removed on or around 2023-11-01.", "poc": ["https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/", "https://github.com/qwell/disorder-in-the-court"]}, {"cve": "CVE-2023-24051", "desc": "A client side rate limit issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via brute force style attacks.", "poc": ["https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/"]}, {"cve": "CVE-2023-3855", "desc": "A vulnerability classified as problematic was found in phpscriptpoint JobSeeker 1.5. Affected by this vulnerability is an unknown functionality of the file /search-result.php. The manipulation of the argument kw/lc/ct/cp/p leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235207. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22325", "desc": "A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736"]}, {"cve": "CVE-2023-49425", "desc": "Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg .", "poc": ["https://github.com/ef4tless/vuln/blob/master/iot/AX12/setMacFilterCfg.md"]}, {"cve": "CVE-2023-2951", "desc": "A vulnerability classified as critical has been found in code-projects Bus Dispatch and Information System 1.0. Affected is an unknown function of the file delete_bus.php. The manipulation of the argument busid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230112.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Spr1te76/CVE-2023-2951", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-43274", "desc": "Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter.", "poc": ["https://github.com/nu11secur1ty/CVE-nu11secur1ty"]}, {"cve": "CVE-2023-5889", "desc": "Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.", "poc": ["https://huntr.com/bounties/fba2991a-1b8a-4c89-9689-d708526928e1"]}, {"cve": "CVE-2023-4436", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0. This issue affects some unknown processing of the file app/action/edit_update.php. The manipulation of the argument user_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237557 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6901", "desc": "A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/handle-command.php of the component HTTP POST Request Handler. The manipulation of the argument command with the input whoami leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248259.", "poc": ["https://github.com/g1an123/POC/blob/main/README.md"]}, {"cve": "CVE-2023-43801", "desc": "Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1088", "desc": "The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/a956f1cd-fce4-4235-b1af-4b7675a60ca2"]}, {"cve": "CVE-2023-4649", "desc": "Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.", "poc": ["https://huntr.dev/bounties/069bb1f3-0805-480d-a6e1-b3345cdc60f3"]}, {"cve": "CVE-2023-45992", "desc": "A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, could allow the attacker to gain full admin privileges on the exploited system.", "poc": ["https://github.com/harry935/CVE-2023-45992", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/harry935/CVE-2023-45992", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27293", "desc": "Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal other users\u2019 cookies and force users to make actions without their knowledge.", "poc": ["https://www.tenable.com/security/research/tra-2023-8"]}, {"cve": "CVE-2023-52223", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite \u2013 WooCommerce integration.This issue affects MailerLite \u2013 WooCommerce integration: from n/a through 2.0.8.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40010", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in realmag777 HUSKY \u2013 Products Filter for WooCommerce Professional.This issue affects HUSKY \u2013 Products Filter for WooCommerce Professional: from n/a through 1.3.4.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24367", "desc": "** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/mrojz/T24"]}, {"cve": "CVE-2023-33510", "desc": "Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.", "poc": ["https://carl1l.github.io/2023/05/08/jeecg-p3-biz-chat-1-0-5-jar-has-arbitrary-file-read-vulnerability/", "https://github.com/izj007/wechat", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-28436", "desc": "Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in version 1.34.0 and prior to prior to 1.38.2 in FreeBSD allows commands to be run with a higher privilege group ID than that specified in Tailscale SSH access rules. A difference in the behavior of the FreeBSD `setgroups` system call from POSIX meant that the Tailscale client running on a FreeBSD-based operating system did not appropriately restrict groups on the host when using Tailscale SSH. When accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process was used instead of that of the user specified in Tailscale SSH access rules. Tailscale SSH commands may have been run with a higher privilege group ID than that specified in Tailscale SSH access rules if they met all of the following criteria: the destination node was a FreeBSD device with Tailscale SSH enabled; Tailscale SSH access rules permitted access for non-root users; and a non-interactive SSH session was used. Affected users should upgrade to version 1.38.2 to remediate the issue.", "poc": ["https://tailscale.com/security-bulletins/#ts-2023-003"]}, {"cve": "CVE-2023-2942", "desc": "Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.", "poc": ["https://huntr.dev/bounties/dd56e7a0-9dff-48fc-bc59-9a22d91869eb"]}, {"cve": "CVE-2023-46952", "desc": "Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer header.", "poc": ["https://github.com/SadFox/ABO.CMS-Blind-XSS"]}, {"cve": "CVE-2023-39125", "desc": "NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c because a file's width, height, and BPP are not validated. NOTE: the vendor's perspective is \"this main application was not intended to be a well tested program, it's just something to demonstrate it works and for the user to see how to integrate it into their own programs.\"", "poc": ["https://github.com/LMP88959/NTSC-CRT/issues/32"]}, {"cve": "CVE-2023-3201", "desc": "The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This makes it possible for unauthenticated attackers to update new order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-39172", "desc": "The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.", "poc": ["https://seclists.org/fulldisclosure/2023/Nov/4"]}, {"cve": "CVE-2023-20711", "desc": "In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07581668; Issue ID: ALPS07581668.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Resery/Resery"]}, {"cve": "CVE-2023-22016", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.46 and Prior to 7.0.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-27856", "desc": "In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-31286", "desc": "An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist.", "poc": ["http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html", "http://seclists.org/fulldisclosure/2023/May/14"]}, {"cve": "CVE-2023-0571", "desc": "A vulnerability has been found in SourceCodester Canteen Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file createcustomer.php of the component Add Customer. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219730 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/ctflearner/Vulnerability/blob/main/Canteen%20Management%20System/Canteen_Management_System_XSS_IN_Add_Customer.md", "https://vuldb.com/?id.219730", "https://github.com/ctflearner/ctflearner"]}, {"cve": "CVE-2023-24026", "desc": "In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.", "poc": ["https://github.com/sixgroup-security/CVE"]}, {"cve": "CVE-2023-5060", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1.", "poc": ["https://huntr.dev/bounties/01b0917d-f92f-4903-9eca-bcfc46e847e3"]}, {"cve": "CVE-2023-27493", "desc": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy\u2019s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.", "poc": ["https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5w5-487h-qv8q"]}, {"cve": "CVE-2023-4697", "desc": "Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.", "poc": ["https://huntr.dev/bounties/3ff3325a-1dcb-4da7-894d-81a9cf726d81", "https://github.com/sjkp/devopsai"]}, {"cve": "CVE-2023-28346", "desc": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate with the private API endpoints exposed at /login, /consoleSettings, /console, etc. despite Virtual Host Routing being used to block this access. Remote attackers can interact with private pages on the web server, enabling them to perform privileged actions such as logging into the console and changing console settings if they have valid credentials.", "poc": ["https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/", "https://research.nccgroup.com/?research=Technical%20advisories"]}, {"cve": "CVE-2023-46088", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <=\u00a01.6.1 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-28867", "desc": "In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/srchen1987/springcloud-distributed-transaction"]}, {"cve": "CVE-2023-50693", "desc": "An issue in Jester v.0.6.0 and before allows a remote attacker to send a malicious crafted request.", "poc": ["https://github.com/dom96/jester/issues/326"]}, {"cve": "CVE-2023-44483", "desc": "All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled.\u00a0Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.", "poc": ["https://github.com/phax/ph-xmldsig"]}, {"cve": "CVE-2023-31099", "desc": "Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.", "poc": ["https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-33084", "desc": "Transient DOS while processing IE fragments from server during DTLS handshake.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44011", "desc": "An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at the Skin management component.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38431", "desc": "An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read.", "poc": ["https://github.com/chenghungpan/test_data", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44809", "desc": "D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.", "poc": ["https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug1.md"]}, {"cve": "CVE-2023-32790", "desc": "Cross-Site Scripting (XSS) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inject a malicious JavaScript payload into the 'Full Name' field during a user edit, due to improper sanitization of the input parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24165", "desc": "Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/initIpAddrInfo.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC18/7/7.md"]}, {"cve": "CVE-2023-6377", "desc": "A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1572", "desc": "A vulnerability has been found in DataGear up to 1.11.1 and classified as problematic. This vulnerability affects unknown code of the component Plugin Handler. The manipulation leads to cross site scripting. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223564.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-32433", "desc": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-47619", "desc": "Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of time of publication, no patches are available.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-203_GHSL-2023-204_audiobookshelf/"]}, {"cve": "CVE-2023-1532", "desc": "Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/171959/Chrome-media-mojom-VideoFrame-Missing-Validation.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-5850", "desc": "Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33970", "desc": "Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, which allows a User with the lowest privileges to leak all the tasks and projects titles within the software, even if they are not invited or it's a personal project. This could also lead to private/critical information being leaked if such information is in the title. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/kanboard/kanboard/security/advisories/GHSA-wfch-8rhv-v286"]}, {"cve": "CVE-2023-5989", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies LioXERP allows Stored XSS.This issue affects LioXERP: before v.146.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6906", "desc": "A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag with the input ie8 leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248268. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/unpWn4bL3/iot-security/blob/main/1.md"]}, {"cve": "CVE-2023-22803", "desc": "LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily.", "poc": ["https://github.com/goheea/goheea"]}, {"cve": "CVE-2023-40989", "desc": "SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.", "poc": ["https://github.com/Zone1-Z/CVE-2023-40989", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-28638", "desc": "Snappier is a high performance C# implementation of the Snappy compression algorithm. This is a buffer overrun vulnerability that can affect any user of Snappier 1.1.0. In this release, much of the code was rewritten to use byte references rather than pointers to pinned buffers. This change generally improves performance and reduces workload on the garbage collector. However, when the garbage collector performs compaction and rearranges memory, it must update any byte references on the stack to refer to the updated location. The .NET garbage collector can only update these byte references if they still point within the buffer or to a point one byte past the end of the buffer. If they point outside this area, the buffer itself may be moved while the byte reference stays the same. There are several places in 1.1.0 where byte references very briefly point outside the valid areas of buffers. These are at locations in the code being used for buffer range checks. While the invalid references are never dereferenced directly, if a GC compaction were to occur during the brief window when they are on the stack then it could invalidate the buffer range check and allow other operations to overrun the buffer. This should be very difficult for an attacker to trigger intentionally. It would require a repetitive bulk attack with the hope that a GC compaction would occur at precisely the right moment during one of the requests. However, one of the range checks with this problem is a check based on input data in the decompression buffer, meaning malformed input data could be used to increase the chance of success. Note that any resulting buffer overrun is likely to cause access to protected memory, which will then cause an exception and the process to be terminated. Therefore, the most likely result of an attack is a denial of service. This issue has been patched in release 1.1.1. Users are advised to upgrade. Users unable to upgrade may pin buffers to a fixed location before using them for compression or decompression to mitigate some, but not all, of these cases. At least one temporary decompression buffer is internal to the library and never pinned.", "poc": ["https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-2676", "desc": "A vulnerability, which was classified as critical, has been found in H3C R160 V1004004. Affected by this issue is some unknown functionality of the file /goForm/aspForm. The manipulation of the argument go leads to stack-based buffer overflow. The exploit has been disclosed to the public and may be used. VDB-228890 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/xinzhihen06/dxq-cve/blob/main/h3cr160.md"]}, {"cve": "CVE-2023-31541", "desc": "A unrestricted file upload vulnerability was discovered in the \u2018Browse and upload images\u2019 feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.", "poc": ["https://github.com/DreamD2v/CVE-2023-31541", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-25348", "desc": "ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.", "poc": ["https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25348", "https://github.com/10splayaSec/CVE-Disclosures", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-3656", "desc": "cashIT! - serving solutions. Devices from \"PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH\" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48121", "desc": "An authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior to v5.3.x build 20230401, Ezviz CS-CV310-xxx prior to v5.3.x build 20230401, Ezviz CS-C6CN-xxx prior to v5.3.x build 20230401, Ezviz CS-C3N-xxx prior to v5.3.x build 20230401 allows remote attackers to obtain sensitive information by sending crafted messages to the affected devices.", "poc": ["https://joerngermany.github.io/ezviz_vulnerability/", "https://github.com/joerngermany/ezviz_vulnerability"]}, {"cve": "CVE-2023-1080", "desc": "The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018tab\u2019 parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-22952", "desc": "In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.", "poc": ["http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/h00die-gr3y/Metasploit", "https://github.com/jakabakos/PHP-payload-injection-to-PNGs", "https://github.com/santosomar/kev_checker"]}, {"cve": "CVE-2023-30402", "desc": "** DISPUTED ** YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.", "poc": ["https://github.com/yasm/yasm/issues/206"]}, {"cve": "CVE-2023-5238", "desc": "The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.", "poc": ["https://wpscan.com/vulnerability/47a5fbfd-f47c-4356-8567-b29dadb48423"]}, {"cve": "CVE-2023-6320", "desc": "A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this vulnerability.Full versions and TV models affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA\u00a0 * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44769", "desc": "A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias.", "poc": ["https://github.com/sromanhu/CVE-2023-44769_ZenarioCMS--Reflected-XSS---Alias/tree/main", "https://github.com/sromanhu/ZenarioCMS--Reflected-XSS---Alias/tree/main", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-44769_ZenarioCMS--Reflected-XSS---Alias"]}, {"cve": "CVE-2023-49299", "desc": "Improper Input Validation vulnerability in Apache DolphinScheduler. An\u00a0authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9.Users are recommended to upgrade to version 3.1.9, which fixes the issue.", "poc": ["https://github.com/Drun1baby/JavaSecurityLearning"]}, {"cve": "CVE-2023-26866", "desc": "GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete takeover.", "poc": ["https://github.com/lionelmusonza/CVE-2023-26866", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-47250", "desc": "In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to a VNC session) to access the X11 desktops of other users by specifying their DISPLAY ID. This allows complete control of their desktop, including the ability to inject keystrokes and perform a keylogging attack.", "poc": ["http://packetstormsecurity.com/files/175949/m-privacy-TightGate-Pro-Code-Execution-Insecure-Permissions.html", "http://seclists.org/fulldisclosure/2023/Nov/13", "https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-m-privacy-tightgate-pro/"]}, {"cve": "CVE-2023-5121", "desc": "The Migration, Backup, Staging \u2013 WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33194", "desc": "Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn\u2019t fix it when clicking save. This issue was patched in version 4.4.6.", "poc": ["https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9"]}, {"cve": "CVE-2023-37711", "desc": "Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the deviceId parameter in the saveParentControlInfo function.", "poc": ["https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/saveParentControlInfo"]}, {"cve": "CVE-2023-34452", "desc": "Grav is a flat-file content management system. In versions 1.7.42 and prior, the \"/forgot_password\" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the \"email\" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browser, the impact is limited as it requires user interaction to trigger the vulnerability. As of time of publication, a patch is not available. Server-side validation should be implemented to prevent this vulnerability.", "poc": ["https://github.com/getgrav/grav/security/advisories/GHSA-xcr8-cc2j-62fc"]}, {"cve": "CVE-2023-36947", "desc": "TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.", "poc": ["https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/UploadCustomModule.md"]}, {"cve": "CVE-2023-1188", "desc": "A vulnerability was found in FabulaTech Webcam for Remote Desktop 2.8.42. It has been classified as problematic. Affected is the function 0x222018 in the library ftwebcam.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222360.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1188", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-6869", "desc": "A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to display under the guise of trusted content. This vulnerability affects Firefox < 121.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23581", "desc": "A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1741"]}, {"cve": "CVE-2023-1882", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/8ab09a1c-cfd5-4ce0-aae3-d33c93318957", "https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-45657", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSIMYTH Nexter allows SQL Injection.This issue affects Nexter: from n/a through 2.0.3.", "poc": ["https://github.com/RandomRobbieBF/CVE-2023-45657", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1473", "desc": "The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/a6e6c67b-7d9b-4fdb-8115-c33add7bfc3d"]}, {"cve": "CVE-2023-0301", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.", "poc": ["https://huntr.dev/bounties/8a91e127-2903-4c6b-9a66-e4d2e30f8dec"]}, {"cve": "CVE-2023-22995", "desc": "In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17"]}, {"cve": "CVE-2023-40135", "desc": "In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"]}, {"cve": "CVE-2023-32173", "desc": "Unified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the product is in its default configuration.The specific flaw exists within the implementation of the AddServer method. By specifying crafted arguments, an attacker can cause invalid characters to be inserted into an XML configuration file. An attacker can leverage this vulnerability to create a persistent denial-of-service condition on the system. . Was ZDI-CAN-20576.", "poc": ["https://github.com/0vercl0k/pwn2own2023-miami"]}, {"cve": "CVE-2023-4195", "desc": "PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.", "poc": ["https://huntr.dev/bounties/0bd5da2f-0e29-47ce-90f3-06518656bfd6"]}, {"cve": "CVE-2023-25116", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the local_virtual_ip and the remote_virtual_ip variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-4437", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/search_sell_paymen_report.php. The manipulation of the argument customer leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-237558 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.237558"]}, {"cve": "CVE-2023-37529", "desc": "A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information. This is not the same vulnerability as identified in CVE-2023-37530.", "poc": ["https://github.com/kaje11/CVEs"]}, {"cve": "CVE-2023-5320", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.", "poc": ["https://huntr.dev/bounties/3a2bc18b-5932-4fb5-a01e-24b2b0443b67"]}, {"cve": "CVE-2023-44348", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44044", "desc": "Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php.", "poc": ["https://github.com/TishaManandhar/Superstore-sql-poc/blob/main/SQL"]}, {"cve": "CVE-2023-6930", "desc": "EuroTel ETL3100 versions v01c01 and v01x37 suffer from an unauthenticated configuration and log download vulnerability. This enables the attacker to disclose sensitive information and assist in authentication bypass, privilege escalation, and full system access.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05"]}, {"cve": "CVE-2023-7247", "desc": "The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.", "poc": ["https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharing", "https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841/"]}, {"cve": "CVE-2023-44096", "desc": "Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35781", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in LWS Cleaner plugin <=\u00a02.3.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24343", "desc": "D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSchedule.", "poc": ["https://github.com/1160300418/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/01"]}, {"cve": "CVE-2023-1009", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub_1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input /../etc/passwd- leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221742 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/xxy1126/Vuln/blob/main/Draytek/1.md"]}, {"cve": "CVE-2023-50859", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through 2.1.6.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30446", "desc": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253361.", "poc": ["https://www.ibm.com/support/pages/node/7010557"]}, {"cve": "CVE-2023-45007", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fotomoto plugin <=\u00a01.2.8 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47215", "desc": "Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.", "poc": ["https://github.com/mute1008/mute1008", "https://github.com/mute1997/mute1997"]}, {"cve": "CVE-2023-40845", "desc": "Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'sub_34FD0.' In the function, it reads user provided parameters and passes variables to the function without any length checks.", "poc": ["https://github.com/XYIYM/Digging/blob/main/Tenda/AC6/bof/14/14.md"]}, {"cve": "CVE-2023-23073", "desc": "Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.", "poc": ["https://bugbounty.zohocorp.com/bb/#/bug/101000006459171?tab=originator"]}, {"cve": "CVE-2023-5843", "desc": "The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.", "poc": ["https://github.com/codeb0ss/CVE-2023-5843-PoC", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49083", "desc": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.", "poc": ["http://www.openwall.com/lists/oss-security/2023/11/29/2", "https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-2362", "desc": "The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/27e70507-fd68-4915-88cf-0b96ed55208e"]}, {"cve": "CVE-2023-32516", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GloriaFood Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation plugin <=\u00a02.3.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41578", "desc": "Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.", "poc": ["https://github.com/Snakinya/Snakinya"]}, {"cve": "CVE-2023-42663", "desc": "Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.", "poc": ["https://github.com/Y4tacker/JavaSec"]}, {"cve": "CVE-2023-33866", "desc": "A use-after-free vulnerability exists in the JavaScript engine of Foxit Software\u2019s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1757"]}, {"cve": "CVE-2023-4724", "desc": "The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server", "poc": ["https://wpscan.com/vulnerability/48820f1d-45cb-4f1f-990d-d132bfc5536f", "https://github.com/dipa96/my-days-and-not"]}, {"cve": "CVE-2023-41737", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGens Swifty Bar, sticky bar by WPGens plugin <=\u00a01.2.10 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22608", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none", "poc": ["https://github.com/13579and2468/Wei-fuzz"]}, {"cve": "CVE-2023-33035", "desc": "Memory corruption while invoking callback function of AFE from ADSP.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-41821", "desc": "A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30560", "desc": "The configuration from the PCU can be modified without authentication using physical connection to the PCU.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7101", "desc": "Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type \u201ceval\u201d. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.", "poc": ["https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md", "https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc", "https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html", "https://github.com/Ostorlab/KEV", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/vinzel-ops/vuln-barracuda"]}, {"cve": "CVE-2023-5860", "desc": "The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31418", "desc": "An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.", "poc": ["https://www.elastic.co/community/security"]}, {"cve": "CVE-2023-4805", "desc": "The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/1049e940-49b1-4236-bea2-c636f35c5647"]}, {"cve": "CVE-2023-22004", "desc": "Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Reports Configuration). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Technology accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-44855", "desc": "Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a remote attacker to execute arbitrary code via a crafted script to the rdiag, sender, and recipients parameters of the sub_219C4 function in the acu_web file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39246", "desc": "Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure Operation on Windows Junction Vulnerability during installation. A local malicious user could potentially exploit this vulnerability to create an arbitrary folder inside a restricted directory, leading to Privilege Escalation", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44016", "desc": "Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.", "poc": ["https://github.com/aixiao0621/Tenda/blob/main/AC10U/7/0.md", "https://github.com/aixiao0621/Tenda"]}, {"cve": "CVE-2023-4858", "desc": "The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://github.com/nightcloudos/bug_report/blob/main/vendors/poc2.md", "https://wpscan.com/vulnerability/ef8029e0-9282-401a-a77d-10b6656adaa6"]}, {"cve": "CVE-2023-25105", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_ike_profile function with the secrets_remote variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-22098", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: Only applicable to 7.0.x platform. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).", "poc": ["https://github.com/google/security-research"]}, {"cve": "CVE-2023-38975", "desc": "* Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked_vectors.rs component.", "poc": ["https://github.com/qdrant/qdrant/issues/2268"]}, {"cve": "CVE-2023-2935", "desc": "Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/173196/Chrome-v8-internal-Object-SetPropertyWithAccessor-Type-Confusion.html"]}, {"cve": "CVE-2023-6548", "desc": "Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway\u00a0allows an attacker with\u00a0access\u00a0to NSIP, CLIP or SNIP with management interface to perform\u00a0Authenticated (low privileged) remote code execution on Management Interface.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Roonye660/CVE-2023-6548-POC", "https://github.com/jake-44/Research", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4539", "desc": "Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Comarch ERP XL installations. This issue affects ERP XL: from 2020.2.2 through 2023.2.", "poc": ["https://github.com/defragmentator/mitmsqlproxy"]}, {"cve": "CVE-2023-43252", "desc": "XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow via a crafted image file.", "poc": ["http://packetstormsecurity.com/files/175145/XNSoft-Nconvert-7.136-Buffer-Overflow-Denial-Of-Service.html", "http://seclists.org/fulldisclosure/2023/Oct/15", "https://github.com/mrtouch93/exploits"]}, {"cve": "CVE-2023-23714", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <=\u00a03.6.4.1 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/UncannyOwl/Uncanny-Toolkit-for-LearnDash"]}, {"cve": "CVE-2023-1938", "desc": "The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wp_remote_get() function, leading to a Blind SSRF issue", "poc": ["https://wpscan.com/vulnerability/92b1c6d8-51db-46aa-bde6-abdfb091aab5"]}, {"cve": "CVE-2023-2761", "desc": "The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/8c82d317-f9f9-4e25-a7f1-43edb77e8aba", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2666", "desc": "Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.", "poc": ["https://huntr.dev/bounties/0bbdc9d4-d9dc-4490-93ef-0a83b451a20f"]}, {"cve": "CVE-2023-1741", "desc": "A vulnerability was found in jeecg-boot 3.5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file SysDictMapper.java of the component Sleep Command Handler. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224629 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.224629"]}, {"cve": "CVE-2023-2479", "desc": "OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.", "poc": ["https://github.com/Marco-zcl/POC", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/tanjiti/sec_profile", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-", "https://github.com/zn9988/publications"]}, {"cve": "CVE-2023-38602", "desc": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file system.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-37628", "desc": "Online Piggery Management System 1.0 is vulnerable to SQL Injection.", "poc": ["https://github.com/1337kid/Piggery_CMS_multiple_vulns_PoC/tree/main/CVE-2023-37628", "https://github.com/1337kid/Piggery_CMS_multiple_vulns_PoC"]}, {"cve": "CVE-2023-27114", "desc": "radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c.", "poc": ["https://github.com/radareorg/radare2/issues/21363"]}, {"cve": "CVE-2023-23997", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <=\u00a01.2.7 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35966", "desc": "Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger these vulnerabilities.This integer overflow result is used as argument for the realloc function.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1787"]}, {"cve": "CVE-2023-4218", "desc": "In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/sahilagichani14/sootUpTutorial"]}, {"cve": "CVE-2023-50333", "desc": "Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing\u00a0freshly demoted guests to change group names.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3218", "desc": "Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.", "poc": ["https://huntr.dev/bounties/94d50b11-20ca-46e3-9086-dd6836421675"]}, {"cve": "CVE-2023-45283", "desc": "The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.", "poc": ["https://github.com/20142995/sectool", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5882", "desc": "The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.", "poc": ["https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2", "https://github.com/dipa96/my-days-and-not"]}, {"cve": "CVE-2023-51704", "desc": "An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41325", "desc": "OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, `shdr_verify_signature` can make a double free. `shdr_verify_signature` used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (`sw_crypto_acipher_alloc_rsa_public_key`) will try to allocate a memory (which is optee\u2019s heap memory). RSA key is consist of exponent and modulus (represent as variable `e`, `n`) and it allocation is not atomic way, so it may succeed in `e` but fail in `n`. In this case sw_crypto_acipher_alloc_rsa_public_key` will free on `e` and return as it is failed but variable \u2018e\u2019 is remained as already freed memory address . `shdr_verify_signature` will free again that memory (which is `e`) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available.", "poc": ["https://github.com/OP-TEE/optee_os/security/advisories/GHSA-jrw7-63cq-7vhm"]}, {"cve": "CVE-2023-45798", "desc": "In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2281", "desc": "When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-4448", "desc": "A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 4dff387283060961c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier VDB-237569 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.237569"]}, {"cve": "CVE-2023-36562", "desc": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35794", "desc": "An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only Basic Authentication to the SSH console.", "poc": ["https://github.com/Dodge-MPTC/CVE-2023-35794-WebSSH-Hijacking", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-41814", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving the messages opens their notifications.\u00a0This issue affects Pandora FMS: from 700 through 774.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5914", "desc": "Cross-site scripting (XSS)", "poc": ["https://github.com/SohelParashar/.Net-Deserialization-Cheat-Sheet"]}, {"cve": "CVE-2023-37142", "desc": "ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees().", "poc": ["https://github.com/chakra-core/ChakraCore/issues/6887"]}, {"cve": "CVE-2023-50873", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages.This issue affects Add Any Extension to Pages: from n/a through 1.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32418", "desc": "The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. Processing a file may lead to unexpected app termination or arbitrary code execution.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-47757", "desc": "Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber \u2013 Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects AWeber \u2013 Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth: from n/a through 7.3.9.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45866", "desc": "Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.", "poc": ["https://github.com/skysafe/reblog/tree/main/cve-2023-45866", "https://github.com/Eason-zz/BluetoothDucky", "https://github.com/V33RU/CommandInWiFi", "https://github.com/V33RU/CommandInWiFi-Zeroclick", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/gato001k1/helt", "https://github.com/jjjjjjjj987/cve-2023-45866-py", "https://github.com/johe123qwe/github-trending", "https://github.com/marcnewlin/hi_my_name_is_keyboard", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/pentestfunctions/BlueDucky", "https://github.com/sampsonv/github-trending", "https://github.com/shirin-ehtiram/hi_my_name_is_keyboard", "https://github.com/tanjiti/sec_profile", "https://github.com/vs4vijay/exploits", "https://github.com/zhaoxiaoha/github-trending"]}, {"cve": "CVE-2023-6152", "desc": "A user changing their email after signing up and verifying it can change it without verification in profile settings.The configuration option \"verify_email_enabled\" will only validate email only on sign up.", "poc": ["https://github.com/grafana/bugbounty/security/advisories/GHSA-3hv4-r2fm-h27f"]}, {"cve": "CVE-2023-28949", "desc": "IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 251216.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37826", "desc": "A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fieldname parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27198", "desc": "PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow the execution of arbitrary commands by using the exec service and including a specific word in the command to be executed. The attacker must have physical USB access to the device in order to exploit this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23076", "desc": "OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.", "poc": ["https://bugbounty.zohocorp.com/bb/#/bug/101000006459751?tab=originator"]}, {"cve": "CVE-2023-1905", "desc": "The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003", "poc": ["https://wpscan.com/vulnerability/b6ac3e15-6f39-4514-a50d-cca7b9457736"]}, {"cve": "CVE-2023-2661", "desc": "A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Master.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228803.", "poc": ["https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Online-Computer-and-Laptop-Store---Multiple-vulnerabilities.md#5sql-injection-vulnerability-in-classesmasterphp"]}, {"cve": "CVE-2023-37148", "desc": "TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function.", "poc": ["https://github.com/DaDong-G/Vulnerability_info/blob/main/TOTOLINK/lr350/3/README.md"]}, {"cve": "CVE-2023-23376", "desc": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/jake-44/Research", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-3083", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.", "poc": ["https://huntr.dev/bounties/c6b29e46-02e0-43ad-920f-28ac482ea2ab"]}, {"cve": "CVE-2023-26953", "desc": "onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module.", "poc": ["https://github.com/keheying/onekeyadmin/issues/8"]}, {"cve": "CVE-2023-23504", "desc": "The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/adamdoupe/adamd-pocs", "https://github.com/houjingyi233/macOS-iOS-system-security", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zeroc00I/CVE-2023-23504"]}, {"cve": "CVE-2023-28709", "desc": "The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount\u00a0could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters\u00a0in the query string, the limit for uploaded request parts could be\u00a0bypassed with the potential for a denial of service to occur.", "poc": ["https://github.com/Dzmitry-Basiachenka/dist-foreign-aliakh", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-2699", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Lost and Found Information System 1.0. Affected by this issue is some unknown functionality of the file admin/?page=items/view_item of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228980.", "poc": ["https://vuldb.com/?id.228980", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-43873", "desc": "A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu.", "poc": ["https://github.com/sromanhu/e107-CMS-Stored-XSS---Manage/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43873-e107-CMS-Stored-XSS---Manage"]}, {"cve": "CVE-2023-3013", "desc": "Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.", "poc": ["https://huntr.dev/bounties/52f95edc-cc03-4a9f-9bf8-74f641260073"]}, {"cve": "CVE-2023-6606", "desc": "An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3432", "desc": "Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.", "poc": ["https://huntr.dev/bounties/8ac3316f-431c-468d-87e4-3dafff2ecf51", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45207", "desc": "An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising the JavaScript code present in a PDF document.)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21950", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-44291", "desc": "Dell DM5500 5.14.0.0 contains an OS command injection vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33592", "desc": "Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lfis/admin/?page=system_info/contact_information.", "poc": ["http://packetstormsecurity.com/files/173331/Lost-And-Found-Information-System-1.0-SQL-Injection.html", "https://github.com/0XRedRose/CVE-2023-33592", "https://github.com/Acous7icwav3/CVE-2023-33592", "https://github.com/FuckingHack3r/CVE-2023-33592", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-44796", "desc": "Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _generaloptions_panel.php component.", "poc": ["https://github.com/Hebing123/CVE-2023-44796/issues/1", "https://github.com/Hebing123/cve/issues/4", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-52214", "desc": "Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29849", "desc": "Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty parameter.", "poc": ["http://packetstormsecurity.com/files/171900/Bang-Resto-1.0-SQL-Injection.html"]}, {"cve": "CVE-2023-6862", "desc": "A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47256", "desc": "ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings", "poc": ["https://web.archive.org/web/20240208140218/https://gotham-security.com/screenconnect-cve-2023-47256"]}, {"cve": "CVE-2023-22012", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). The supported version that is affected is 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-46699", "desc": "Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention.", "poc": ["https://github.com/a-zara-n/a-zara-n"]}, {"cve": "CVE-2023-39709", "desc": "Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add Member section.", "poc": ["https://github.com/Arajawat007/CVE-2023-39709", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-51972", "desc": "Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp.", "poc": ["https://github.com/toxyl/lscve"]}, {"cve": "CVE-2023-20249", "desc": "A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6210", "desc": "When an https: web page created a pop-up from a \"javascript:\" URL, that pop-up was incorrectly allowed to load blockable content such as iframes from insecure http: URLs This vulnerability affects Firefox < 120.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1801501"]}, {"cve": "CVE-2023-27334", "desc": "Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20498.", "poc": ["https://github.com/claroty/opcua-exploit-framework"]}, {"cve": "CVE-2023-28231", "desc": "DHCP Server Service Remote Code Execution Vulnerability", "poc": ["https://github.com/2lambda123/diaphora", "https://github.com/ARPSyndicate/cvemon", "https://github.com/elefantesagradodeluzinfinita/elefantesagradodeluzinfinita", "https://github.com/glavstroy/CVE-2023-28231", "https://github.com/joxeankoret/diaphora", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5838", "desc": "Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9.", "poc": ["https://huntr.com/bounties/8f6feca3-386d-4897-801c-39b9e3e5eb03", "https://github.com/sev-hack/sev-hack"]}, {"cve": "CVE-2023-40194", "desc": "An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace characters. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1833"]}, {"cve": "CVE-2023-26847", "desc": "A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/cassis-sec/CVE", "https://github.com/cassis-sec/cassis-sec"]}, {"cve": "CVE-2023-51079", "desc": "** DISPUTED ** A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because \"the only thing that you could expect is that the parser will take a crazy amount of time to complete its task.\"", "poc": ["https://github.com/mvel/mvel/issues/348", "https://github.com/mvel/mvel/issues/348#issuecomment-1874047271"]}, {"cve": "CVE-2023-49467", "desc": "Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merging_candidates function at motion.cc.", "poc": ["https://github.com/strukturag/libde265/issues/434"]}, {"cve": "CVE-2023-22616", "desc": "An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM.", "poc": ["https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/"]}, {"cve": "CVE-2023-49689", "desc": "Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.\u00a0The 'JobId' parameter of the Employer/DeleteJob.php resource\u00a0does not validate the characters received and they\u00a0are sent unfiltered to the database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29499", "desc": "A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28319", "desc": "A use after free vulnerability exists in curl= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher().", "poc": ["https://security.friendsofpresta.org/modules/2024/02/08/oparteasyredirect.html"]}, {"cve": "CVE-2023-30561", "desc": "The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a specially crafted device while an infusion is running.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48322", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eDoc Intelligence eDoc Employee Job Application \u2013 Best WordPress Job Manager for Employees allows Reflected XSS.This issue affects eDoc Employee Job Application \u2013 Best WordPress Job Manager for Employees: from n/a through 1.13.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-6544", "desc": "A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30487", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThimPress LearnPress Export Import plugin <=\u00a04.0.2 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-1093", "desc": "The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d"]}, {"cve": "CVE-2023-46059", "desc": "Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the Service, and website URL to Ping parameters of the admin/trackback.php component.", "poc": ["https://github.com/CrownZTX/vulnerabilities/blob/main/geeklog/reflected_XSS_in_editservice.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29713", "desc": "Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the GET request after the /css/ directory.", "poc": ["https://info.vadesecure.com/hubfs/Ressource%20Marketing%20Website/Datasheet/EN/Vade_Secure_DS_Gateway_EN.pdf"]}, {"cve": "CVE-2023-49043", "desc": "Buffer Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the wpapsk_crypto parameter in the function fromSetWirelessRepeat.", "poc": ["https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/fromSetWirelessRepeat.md"]}, {"cve": "CVE-2023-30350", "desc": "FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password.", "poc": ["http://packetstormsecurity.com/files/172124/FS-S3900-24T4S-Privilege-Escalation.html"]}, {"cve": "CVE-2023-48842", "desc": "D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi.", "poc": ["https://github.com/creacitysec/CVE-2023-48842", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31724", "desc": "yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function do_directive at /nasm/nasm-pp.c.", "poc": ["https://github.com/DaisyPo/fuzzing-vulncollect/tree/main/yasm/SEGV/nasm-pp.c:3570%20in%20do_directive", "https://github.com/yasm/yasm/issues/222"]}, {"cve": "CVE-2023-26126", "desc": "All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile function.", "poc": ["https://gist.github.com/lirantal/dcb32c11ce87f5aafd2282b90b4dc998", "https://security.snyk.io/vuln/SNYK-JS-MSTATIC-3244915"]}, {"cve": "CVE-2023-36672", "desc": "An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that traffic to the local network is sent in plaintext outside the VPN tunnel even if the local network is using a non-RFC1918 IP subnet. This allows an adversary to trick the victim into sending arbitrary IP traffic in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to \"LocalNet attack resulting in leakage of traffic in plaintext\" rather than to only Clario.", "poc": ["https://mullvad.net/de/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure/"]}, {"cve": "CVE-2023-51208", "desc": "** DISPUTED ** An Arbitrary File Upload vulnerability in ROS2 Foxy Fitzroy ROS_VERSION=2 and ROS_PYTHON_VERSION=3 allows attackers to run arbitrary code and cause other impacts via upload of crafted file. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/16yashpatel/CVE-2023-51208", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2023-51208"]}, {"cve": "CVE-2023-46981", "desc": "SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list.", "poc": ["https://github.com/JunFengDeng/Cve-List/blob/main/novel-plus/20231027/vuln/readme.md"]}, {"cve": "CVE-2023-48830", "desc": "Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export.", "poc": ["http://packetstormsecurity.com/files/176038"]}, {"cve": "CVE-2023-0261", "desc": "The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.", "poc": ["https://wpscan.com/vulnerability/6a3b6752-8d72-4ab4-9d49-b722a947d2b0", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-36162", "desc": "Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php.", "poc": ["https://github.com/779789571/zzcms/blob/main/README.md"]}, {"cve": "CVE-2023-30738", "desc": "An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Odyssey allows local attacker to execute SMM memory corruption.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30256", "desc": "Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file.", "poc": ["http://packetstormsecurity.com/files/172542/Webkul-Qloapps-1.5.2-Cross-Site-Scripting.html", "https://github.com/ahrixia/CVE-2023-30256", "https://github.com/ahrixia/CVE-2023-30256", "https://github.com/ahrixia/ahrixia", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26457", "desc": "SAP Content Server - version 7.53, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can read and modify some sensitive information but cannot delete the data.", "poc": ["https://launchpad.support.sap.com/#/notes/3281484", "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-0175", "desc": "The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/cdcd3c2c-cb29-4b21-8d3d-7eafbc1d3098"]}, {"cve": "CVE-2023-43511", "desc": "Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28140", "desc": "An Executable Hijacking condition exists in theQualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackersmay load a malicious copy of a Dependency Link Library (DLL) via a localattack vector instead of the DLL that the application was expecting, whenprocesses are running with escalated privileges. This vulnerabilityis bounded only to the time of uninstallation and can only be exploitedlocally.At the time of this disclosure, versions before 4.0 are classified as End ofLife.", "poc": ["https://www.qualys.com/security-advisories/"]}, {"cve": "CVE-2023-1817", "desc": "Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-0704", "desc": "Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-2697", "desc": "A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file /jurusan/data of the component POST Parameter Handler. The manipulation of the argument columns[1][data] leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-228978 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-34929", "desc": "A stack overflow in the AddMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", "poc": ["https://github.com/h4kuy4/vuln/blob/main/H3C_B1STW/CVE-2023-34929.md"]}, {"cve": "CVE-2023-5633", "desc": "The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/shakyaraj9569/Documentation"]}, {"cve": "CVE-2023-0489", "desc": "The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/238842ee-6392-4eb2-96cb-08e4ece6fca1"]}, {"cve": "CVE-2023-37983", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in No\u00ebl Jackson Art Direction plugin <=\u00a00.2.4 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23608", "desc": "Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include \"..\", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1.", "poc": ["https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555v"]}, {"cve": "CVE-2023-38886", "desc": "An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.", "poc": ["https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38886_Dolibarr_RCE-1.pdf"]}, {"cve": "CVE-2023-31804", "desc": "Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters.", "poc": ["https://github.com/msegoviag/discovered-vulnerabilities", "https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-21388", "desc": "In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28588", "desc": "Transient DOS in Bluetooth Host while rfc slot allocation.", "poc": ["https://github.com/Trinadh465/CVE-2023-28588", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/uthrasri/CVE-2023-28588", "https://github.com/uthrasri/CVE-2023-28588_G2.5_singlefile", "https://github.com/uthrasri/CVE-2023-28588_Singlefile", "https://github.com/uthrasri/CVE-2023-28588_system_bt"]}, {"cve": "CVE-2023-30613", "desc": "Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an `.exe` file or a file containing embedded JavaScript and trick others into clicking on these files, causing vulnerable browsers to execute malicious code on another computer.Kiwi TCMS v12.2 comes with functionality that allows administrators to configure additional upload validator functions which give them more control over what file types are accepted for upload. By default `.exe` are denied. Other files containing the `zohkx leads to cross site scripting. The attack may be launched remotely. VDB-246122 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/175925/osCommerce-4-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-6821", "desc": "The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 contains a vulnerability that allows you to read and download PHP logs without authorization", "poc": ["https://wpscan.com/vulnerability/6b1a998d-c97c-4305-b12a-69e29408ebd9/", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-44693", "desc": "D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5611", "desc": "The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them", "poc": ["https://wpscan.com/vulnerability/8cb8a5e9-2ab6-4d9b-9ffc-ef530e346f8d"]}, {"cve": "CVE-2023-44306", "desc": "Dell DM5500 contains a path traversal vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this vulnerability to overwrite configuration files stored on the server filesystem.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0800", "desc": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/496", "https://github.com/ARPSyndicate/cvemon", "https://github.com/peng-hui/CarpetFuzz", "https://github.com/waugustus/CarpetFuzz", "https://github.com/waugustus/waugustus"]}, {"cve": "CVE-2023-25366", "desc": "In Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password.", "poc": ["https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25366.md", "https://github.com/BretMcDanel/CVE"]}, {"cve": "CVE-2023-49810", "desc": "A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1898"]}, {"cve": "CVE-2023-0423", "desc": "The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/73d588d7-26ae-42e2-8282-aa02bcb109b6"]}, {"cve": "CVE-2023-43611", "desc": "The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.\u00a0 This vulnerability is due to an incomplete fix for CVE-2023-38418.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41835", "desc": "When a Multipart request is performed but some of the fields exceed the maxStringLength\u00a0 limit, the upload files will remain in struts.multipart.saveDir\u00a0 even if the request has been denied.Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3524", "desc": "The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting", "poc": ["https://wpscan.com/vulnerability/89570379-769b-4684-b8a7-28c37b408e5d"]}, {"cve": "CVE-2023-4390", "desc": "The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).", "poc": ["https://wpscan.com/vulnerability/9fd2eb81-185d-4d42-8acf-925664b7cb2f"]}, {"cve": "CVE-2023-2982", "desc": "The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.", "poc": ["https://github.com/Ecodeviewer/CVE-2023", "https://github.com/H4K6/CVE-2023-2982-POC", "https://github.com/LoaiEsam37/CVE-2023-2982", "https://github.com/RandomRobbieBF/CVE-2023-2982", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/hansengentle/CVE-2023", "https://github.com/hheeyywweellccoommee/CVE-2023-2982-ugdqh", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/truocphan/VulnBox", "https://github.com/wshinkle/CVE-2023-2982"]}, {"cve": "CVE-2023-5524", "desc": "Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36874", "desc": "Windows Error Reporting Service Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/174843/Microsoft-Error-Reporting-Local-Privilege-Elevation.html", "https://github.com/0xsyr0/OSCP", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/DarkFunct/CVE_Exploits", "https://github.com/GhostTroops/TOP", "https://github.com/Octoberfest7/CVE-2023-36874_BOF", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/SirElmard/ethical_hacking", "https://github.com/Threekiii/CVE", "https://github.com/Wh04m1001/CVE-2023-36874", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/c4m3l-security/CVE-2023-36874", "https://github.com/crisprss/CVE-2023-36874", "https://github.com/d0rb/CVE-2023-36874", "https://github.com/grgmrtn255/Links", "https://github.com/hktalent/TOP", "https://github.com/johe123qwe/github-trending", "https://github.com/kgwanjala/oscp-cheatsheet", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/oscpname/OSCP_cheat", "https://github.com/revanmalang/OSCP", "https://github.com/txuswashere/OSCP", "https://github.com/xhref/OSCP", "https://github.com/zer0yu/Awesome-CobaltStrike"]}, {"cve": "CVE-2023-38176", "desc": "Azure Arc-Enabled Servers Elevation of Privilege Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41453", "desc": "Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the cmd parameter in the index.php component.", "poc": ["https://gist.github.com/RNPG/be2ca92cb1f943d4c340c75fbfc9b783", "https://github.com/RNPG/CVEs", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1406", "desc": "The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.", "poc": ["https://wpscan.com/vulnerability/2a81b6b1-2339-4889-9c28-1af133df8b65"]}, {"cve": "CVE-2023-0763", "desc": "The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/4b55f868-62f8-43a1-9817-68cd1fc6190f"]}, {"cve": "CVE-2023-1229", "desc": "Inappropriate implementation in Permission prompts in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-29549", "desc": "Under certain circumstances, a call to the as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a\u00a0CSRF attack.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26427", "desc": "Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html"]}, {"cve": "CVE-2023-52312", "desc": "Nullptr dereference in paddle.crop\u00a0in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-021.md"]}, {"cve": "CVE-2023-33898", "desc": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22451", "desc": "Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can\u2019t be too similar to other personal information, must contain at least 10 characters, can\u2019t be a commonly used password, and can\u2019t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.", "poc": ["https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73"]}, {"cve": "CVE-2023-44042", "desc": "A stored cross-site scripting (XSS) vulnerability in /settings/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website header parameter.", "poc": ["https://github.com/Gi0rgi0R/xss_frontend_settings_blackcat_cms_1.4.1"]}, {"cve": "CVE-2023-4311", "desc": "The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode.", "poc": ["https://wpscan.com/vulnerability/21950116-1a69-4848-9da0-e912096c0fce"]}, {"cve": "CVE-2023-21567", "desc": "Visual Studio Denial of Service Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/ycdxsb/ycdxsb"]}, {"cve": "CVE-2023-21911", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-1996", "desc": "A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31436", "desc": "qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.", "poc": ["http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html", "http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html", "http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html", "https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.13"]}, {"cve": "CVE-2023-52207", "desc": "Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Playlist Free.This issue affects HTML5 MP3 Player with Playlist Free: from n/a through 3.0.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49446", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.", "poc": ["https://github.com/ysuzhangbin/cms/blob/main/There%20is%20a%20CSRF%20in%20the%20newly%20added%20navigation%20management%20area.md"]}, {"cve": "CVE-2023-4112", "desc": "A vulnerability was found in PHP Jabbers Shuttle Booking Software 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-235959. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/173930/PHPJabbers-Shuttle-Booking-Software-1.0-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-46871", "desc": "GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300. This vulnerability may lead to a denial of service.", "poc": ["https://gist.github.com/ReturnHere/d0899bb03b8f5e8fae118f2b76888486", "https://github.com/gpac/gpac/issues/2658"]}, {"cve": "CVE-2023-2580", "desc": "The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).", "poc": ["https://wpscan.com/vulnerability/7ee1efb1-9969-40b2-8ab2-ea427091bbd8"]}, {"cve": "CVE-2023-31942", "desc": "Cross Site Scripting vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the description parameter in insert.php.", "poc": ["https://github.com/DiliLearngent/BugReport"]}, {"cve": "CVE-2023-4406", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS.This issue affects E-Commerce Software: through 20231123.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34038", "desc": "VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the internal network configuration.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/grampae/VMSA-2023-0017"]}, {"cve": "CVE-2023-0334", "desc": "The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/b027a8db-0fd6-444d-b14a-0ae58f04f931"]}, {"cve": "CVE-2023-0457", "desc": "Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.", "poc": ["https://github.com/goheea/goheea"]}, {"cve": "CVE-2023-28153", "desc": "An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restrictions temporarily without the parents noticing by rebooting into Android Safe Mode and disabling the \"Display over other apps\" permission.", "poc": ["https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-kiddoware-kids-place-parental-control-android-app/"]}, {"cve": "CVE-2023-39240", "desc": "It is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.", "poc": ["https://github.com/ShielderSec/poc"]}, {"cve": "CVE-2023-39293", "desc": "A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute arbitrary commands within the context of the system.", "poc": ["https://github.com/SYNgularity1/mitel-exploits"]}, {"cve": "CVE-2023-42755", "desc": "A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.", "poc": ["https://seclists.org/oss-sec/2023/q3/229"]}, {"cve": "CVE-2023-29910", "desc": "H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/S1aGs1Jl2"]}, {"cve": "CVE-2023-34060", "desc": "VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 froman older version.\u00a0On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass loginrestrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console) . This bypass is not present on port 443 (VCD providerand tenant login). On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present.\u00a0VMware Cloud Director Appliance is impacted since it uses an affected version of sssd from the underlying Photon OS. The sssd issue is no longer present in versions of Photon OS that ship with sssd-2.8.1-11 or higher (Photon OS 3) or sssd-2.8.2-9 or higher (Photon OS 4 and 5).", "poc": ["https://github.com/absholi7ly/absholi7ly"]}, {"cve": "CVE-2023-43191", "desc": "SpringbootCMS 1.0 foreground message can be embedded malicious code saved in the database. When users browse the comments, these malicious codes embedded in the HTML will be executed, and the user's browser will be controlled by the attacker, so as to achieve the special purpose of the attacker, such as cookie theft", "poc": ["https://github.com/etn0tw/cmscve_test", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34103", "desc": "Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are stored and no specific timing is required. This issue has been addressed in commit `7891c01e` which is expected to be included in the next release of avo. Users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation.", "poc": ["https://github.com/avo-hq/avo/security/advisories/GHSA-5cr9-5jx3-2g39"]}, {"cve": "CVE-2023-1809", "desc": "The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files.", "poc": ["https://wpscan.com/vulnerability/57f0a078-fbeb-4b05-8892-e6d99edb82c1"]}, {"cve": "CVE-2023-28665", "desc": "The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the techno_get_products action, which can only be triggered by an authenticated user.", "poc": ["https://www.tenable.com/security/research/tra-2023-3", "https://github.com/ARPSyndicate/cvemon", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-34395", "desc": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.Starting version 4.0.0 driver can be set only from the hook constructor.This issue affects Apache Airflow ODBC Provider: before 4.0.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6554", "desc": "When access to the \"admin\" folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download protected information like exam answers.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4422", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.", "poc": ["https://huntr.dev/bounties/2e12b773-b6a2-48da-a4bb-55d5d1307d2e"]}, {"cve": "CVE-2023-20048", "desc": "A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense (FTD) device that is managed by the FMC Software. This vulnerability is due to insufficient authorization of configuration commands that are sent through the web service interface. An attacker could exploit this vulnerability by authenticating to the FMC web services interface and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to execute certain configuration commands on the targeted FTD device. To successfully exploit this vulnerability, an attacker would need valid credentials on the FMC Software.", "poc": ["https://github.com/0zer0d4y/FuegoTest", "https://github.com/absholi7ly/absholi7ly", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0247", "desc": "Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1.", "poc": ["https://huntr.dev/bounties/cab50e44-0995-4ac1-a5d5-889293b9704f"]}, {"cve": "CVE-2023-28488", "desc": "client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.", "poc": ["https://github.com/moehw/poc_exploits/tree/master/CVE-2023-28488", "https://github.com/ARPSyndicate/cvemon", "https://github.com/moehw/poc_exploits"]}, {"cve": "CVE-2023-46058", "desc": "Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the grp_desc parameter of the admin/group.php component.", "poc": ["https://github.com/CrownZTX/vulnerabilities/blob/main/geeklog/Stored_XSS_in_group.php.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48310", "desc": "TestingPlatform is a testing platform for Internet Security Standards. Prior to version 2.1.1, user input is not filtered correctly. Nmap options are accepted. In this particular case, the option to create log files is accepted in addition to a host name (and even without). A log file is created at the location specified. These files are created as root. If the file exists, the existing file is being rendered useless. This can result in denial of service. Additionally, input for scanning can be any CIDR blocks passed to nmap. An attacker can scan 0.0.0.0/0 or even local networks. Version 2.1.1 contains a patch for this issue.", "poc": ["https://github.com/NC3-LU/TestingPlatform/security/advisories/GHSA-9fhc-f3mr-w6h6", "https://github.com/NC3-LU/TestingPlatform/security/advisories/GHSA-mmpf-rw6c-67mm"]}, {"cve": "CVE-2023-29745", "desc": "An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29745/CVE%20detail.md"]}, {"cve": "CVE-2023-34205", "desc": "In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).", "poc": ["https://github.com/moov-io/signedxml/issues/23"]}, {"cve": "CVE-2023-4190", "desc": "Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.", "poc": ["https://huntr.dev/bounties/71bc75d2-320c-4332-ad11-9de535a06d92"]}, {"cve": "CVE-2023-49247", "desc": "Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3230", "desc": "Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0.", "poc": ["https://huntr.dev/bounties/390643f0-106b-4424-835d-52610aefa4c7"]}, {"cve": "CVE-2023-49418", "desc": "TOTOLink A7000R V9.1.0u.6115_B20201022has a stack overflow vulnerability via setIpPortFilterRules.", "poc": ["https://github.com/cnitlrt/iot_vuln/tree/master/totolink/A7000R/setIpPortFilterRules"]}, {"cve": "CVE-2023-0924", "desc": "The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Administrator) to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install.", "poc": ["https://wpscan.com/vulnerability/0fd0d7a5-9263-43b6-9244-7880c3d3e6f4"]}, {"cve": "CVE-2023-21118", "desc": "In unflattenString8 of Sensor.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-269014004", "poc": ["https://github.com/Satheesh575555/frameworks_native_AOSP10_r33_CVE-2023-21118", "https://github.com/Trinadh465/frameworks_native_AOSP-10_r33_CVE-2023-21118", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30285", "desc": "An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/synchronizer/1.0/technicalUser.", "poc": ["https://github.com/D23K4N/CVE/blob/main/CVE-2023-30285.md"]}, {"cve": "CVE-2023-28379", "desc": "A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1738"]}, {"cve": "CVE-2023-21282", "desc": "In TRANSPOSER_SETTINGS of lpp_tran.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.", "poc": ["https://android.googlesource.com/platform/external/aac/+/4242f97d149b0bf0cd96f00cd1e9d30d5922cd46", "https://github.com/Trinadh465/external_aac_AOSP10_r33_CVE-2023-21282", "https://github.com/Trinadh465/external_aac_android-4.2.2_r1_CVE-2023-21282", "https://github.com/nidhi7598/external_aac_AOSP04-r1_CVE-2023-21282", "https://github.com/nidhi7598/external_aac_AOSP_06_r22_CVE-2023-21282", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5441", "desc": "NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.", "poc": ["https://huntr.dev/bounties/b54cbdf5-3e85-458d-bb38-9ea2c0b669f2"]}, {"cve": "CVE-2023-4180", "desc": "A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is an unknown functionality of the file /vm/login.php. The manipulation of the argument useremail/userpassword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236215.", "poc": ["https://github.com/Yesec/Free-Hospital-Management-System-for-Small-Practices/blob/main/SQL%20Injection%20in%20login.php/vuln.md"]}, {"cve": "CVE-2023-26142", "desc": "All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set_header and add_header functions. An attacker can add the \\r\\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.", "poc": ["https://gist.github.com/dellalibera/9247769cc90ed96c0d72ddbcba88c65c", "https://security.snyk.io/vuln/SNYK-UNMANAGED-CROW-5665556", "https://github.com/dellalibera/dellalibera"]}, {"cve": "CVE-2023-33923", "desc": "Missing Authorization vulnerability in HashThemes Viral News, HashThemes Viral, HashThemes HashOne.This issue affects Viral News: from n/a through 1.4.5; Viral: from n/a through 1.8.0; HashOne: from n/a through 1.3.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34093", "desc": "Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the `privateAttributes` getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes). Anyone can be impacted, depending on how people are using/extending content-types. If the users are mutating the content-type, they will not be affected. Version 4.10.8 contains a patch for this issue.", "poc": ["https://github.com/strapi/strapi/commit/2fa8f30371bfd1db44c15e5747860ee5789096de", "https://github.com/strapi/strapi/releases/tag/v4.10.8", "https://github.com/strapi/strapi/security/advisories/GHSA-chmr-rg2f-9jmf"]}, {"cve": "CVE-2023-29579", "desc": "** DISPUTED ** yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the component yasm/yasm+0x43b466 in vsprintf. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.", "poc": ["https://github.com/yasm/yasm/issues/214", "https://github.com/z1r00/fuzz_vuln/blob/main/yasm/stack-buffer-overflow/yasm/readmd.md", "https://github.com/z1r00/fuzz_vuln"]}, {"cve": "CVE-2023-3847", "desc": "A vulnerability classified as problematic was found in mooSocial mooDating 1.2. This vulnerability affects unknown code of the file /users of the component URL Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-235198 is the identifier assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.", "poc": ["http://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31492", "desc": "Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.", "poc": ["http://packetstormsecurity.com/files/177091/ManageEngine-ADManager-Plus-Recovery-Password-Disclosure.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4273", "desc": "A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.", "poc": ["https://github.com/kherrick/lobsters", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-35668", "desc": "In visitUris of Notification.java, there is a possible way to display images from another user due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://android.googlesource.com/platform/frameworks/base/+/b7bd7df91740da680a5c3a84d8dd91b4ca6956dd"]}, {"cve": "CVE-2023-26449", "desc": "The \"OX Chat\" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37470", "desc": "Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, a vulnerability could potentially allow remote code execution on one's Metabase server. The core issue is that one of the supported data warehouses (an embedded in-memory database H2), exposes a number of ways for a connection string to include code that is then executed by the process running the embedded database. Because Metabase allows users to connect to databases, this means that a user supplied string can be used to inject executable code. Metabase allows users to validate their connection string before adding a database (including on setup), and this validation API was the primary vector used as it can be called without validation. Versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4 fix this issue by removing the ability of users to add H2 databases entirely. As a workaround, it is possible to block these vulnerabilities at the network level by blocking the endpoints `POST /api/database`, `PUT /api/database/:id`, and `POST /api/setup/validateuntil`. Those who use H2 as a file-based database should migrate to SQLite.", "poc": ["https://github.com/Hzoid/NVDBuddy", "https://github.com/kip93/kip93"]}, {"cve": "CVE-2023-28095", "desc": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.", "poc": ["https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-47993", "desc": "A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in FreeImage 3.18.0 allows attackers to cause a denial-of-service.", "poc": ["https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47993", "https://github.com/thelastede/FreeImage-cve-poc"]}, {"cve": "CVE-2023-29739", "desc": "An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component.", "poc": ["https://play.google.com/store/apps/details?id=com.amdroidalarmclock.amdroid"]}, {"cve": "CVE-2023-33195", "desc": "Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.", "poc": ["https://github.com/craftcms/cms/security/advisories/GHSA-qpgm-gjgf-8c2x"]}, {"cve": "CVE-2023-6311", "desc": "A vulnerability was found in SourceCodester Loan Management System 1.0 and classified as critical. This issue affects the function delete_ltype of the file delete_ltype.php of the component Loan Type Page. The manipulation of the argument ltype_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246137 was assigned to this vulnerability.", "poc": ["https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20deleteltype.md", "https://vuldb.com/?id.246137"]}, {"cve": "CVE-2023-1371", "desc": "The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them", "poc": ["https://wpscan.com/vulnerability/ad5c167e-77f7-453c-9443-df6e07705d89"]}, {"cve": "CVE-2023-5450", "desc": "An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process.\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37462", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.", "poc": ["https://github.com/XRSec/AWVS-Update", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26958", "desc": "Phpgurukul Park Ticketing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Admin Name parameter.", "poc": ["https://medium.com/@shiva.infocop/stored-xss-park-ticketing-management-system-phpgurukul-893583dc2e20"]}, {"cve": "CVE-2023-51106", "desc": "A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in function pnm_binary_read_image() of load-pnm.c when fz_colorspace_n returns zero.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28841", "desc": "Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*.Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.An iptables rule designates outgoing VXLAN datagrams with a VNI that corresponds to an encrypted overlay network for IPsec encapsulation.Encrypted overlay networks on affected platforms silently transmit unencrypted data. As a result, `overlay` networks may appear to be functional, passing traffic as expected, but without any of the expected confidentiality or data integrity guarantees.It is possible for an attacker sitting in a trusted position on the network to read all of the application traffic that is moving across the overlay network, resulting in unexpected secrets or user data disclosure. Thus, because many database protocols, internal APIs, etc. are not protected by a second layer of encryption, a user may use Swarm encrypted overlay networks to provide confidentiality, which due to this vulnerability this is no longer guaranteed.Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16.Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to outgoing traffic at the Internet boundary in order to prevent unintentionally leaking unencrypted traffic over the Internet, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster.", "poc": ["https://github.com/wolfi-dev/advisories"]}, {"cve": "CVE-2023-30222", "desc": "An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to retrieve password hashes for all users via eavesdropping.", "poc": ["https://packetstormsecurity.com"]}, {"cve": "CVE-2023-51014", "desc": "TOTOLINK EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanSecDns parameter\u2019 of the setLanConfig interface of the cstecgi .cgi", "poc": ["https://815yang.github.io/2023/12/11/EX1800T/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setLanConfig_lanSecDns/"]}, {"cve": "CVE-2023-47218", "desc": "An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.5.2645 build 20240116 and laterQuTS hero h5.1.5.2647 build 20240118 and laterQuTScloud c5.1.5.2651 and later", "poc": ["https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/passwa11/CVE-2023-47218"]}, {"cve": "CVE-2023-28898", "desc": "The Real-Time Streaming Protocol implementation in the MIB3 infotainment incorrectly handles requests to /logs URI, when the id parameter equals to zero. This issue allows an attacker connected to the in-vehicle Wi-Fi network to cause denial-of-service of the infotainment system, when the certain preconditions are met.Vulnerability discovered on \u0160koda Superb III (3V3) - 2.0 TDI manufactured in 2022.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6932", "desc": "A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation.A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.", "poc": ["http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html"]}, {"cve": "CVE-2023-31979", "desc": "Catdoc v0.95 was discovered to contain a global buffer overflow via the function process_file at /src/reader.c.", "poc": ["https://github.com/petewarden/catdoc/issues/9"]}, {"cve": "CVE-2023-41085", "desc": "When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate.\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22372", "desc": "In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "poc": ["https://github.com/piuppi/Proof-of-Concepts"]}, {"cve": "CVE-2023-44469", "desc": "A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.", "poc": ["https://security.lauritz-holtmann.de/post/sso-security-ssrf/"]}, {"cve": "CVE-2023-51797", "desc": "Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in showwaves_filter_frame", "poc": ["https://ffmpeg.org/", "https://trac.ffmpeg.org/ticket/10756"]}, {"cve": "CVE-2023-27269", "desc": "SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files. \u00a0In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-0949", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.", "poc": ["https://huntr.dev/bounties/ef87be4e-493b-4ee9-9738-44c55b8acc19"]}, {"cve": "CVE-2023-21330", "desc": "In Overlay Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0812", "desc": "The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.", "poc": ["https://wpscan.com/vulnerability/0ed5e1b3-f2a3-4eb1-b8ae-d3a62f600107"]}, {"cve": "CVE-2023-37765", "desc": "GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_dump_vrml_sffield function at /lib/libgpac.so.", "poc": ["https://github.com/gpac/gpac/issues/2515"]}, {"cve": "CVE-2023-39359", "desc": "Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with the cases of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-q4wh-3f9w-836h"]}, {"cve": "CVE-2023-26864", "desc": "SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatchingRedirectionsFromPartscomponent.", "poc": ["https://friends-of-presta.github.io/security-advisories/modules/2023/01/17/smplredirectionsmanager.html"]}, {"cve": "CVE-2023-23907", "desc": "A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1702"]}, {"cve": "CVE-2023-4930", "desc": "The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.", "poc": ["https://wpscan.com/vulnerability/c73b3276-e6f1-4f22-a888-025e5d0504f2"]}, {"cve": "CVE-2023-49465", "desc": "Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function at motion.cc.", "poc": ["https://github.com/strukturag/libde265/issues/435"]}, {"cve": "CVE-2023-46332", "desc": "WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.", "poc": ["https://github.com/WebAssembly/wabt/issues/2311"]}, {"cve": "CVE-2023-29324", "desc": "Windows MSHTML Platform Security Feature Bypass Vulnerability", "poc": ["https://github.com/OLeDouxEt/CVE-2023-29324_Patch_Deploy", "https://github.com/Threekiii/CVE", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-34753", "desc": "bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit.", "poc": ["https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability"]}, {"cve": "CVE-2023-6650", "desc": "A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247343.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35983", "desc": "This issue was addressed with improved data protection. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file system.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-29432", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-0075", "desc": "The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/097acd6f-3291-4cdc-a054-4432b6350411"]}, {"cve": "CVE-2023-2203", "desc": "A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.", "poc": ["https://github.com/em1ga3l/cve-publicationdate-extractor"]}, {"cve": "CVE-2023-38387", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Elastic Email Sender plugin <=\u00a01.2.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41336", "desc": "ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an `EntityType` that is *not* part of the valid choices. The problem has been fixed in `symfony/ux-autocomplete` version 2.11.2.", "poc": ["https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax"]}, {"cve": "CVE-2023-36164", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/TraiLeR2/CVE-2023-36164", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-37808", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/TraiLeR2/Unquoted-Service-Path-in-the-Wondershare-Dr.Fone-13.1.5"]}, {"cve": "CVE-2023-52225", "desc": "Deserialization of Untrusted Data vulnerability in Tagbox Tagbox \u2013 UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox \u2013 UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45003", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin <=\u00a02.2.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-25107", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_gre function with the remote_subnet and the remote_mask variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-46774", "desc": "Vulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49261", "desc": "The \"tokenKey\" value used in user authorization is visible in the HTML source of the login page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36466", "desc": "Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34374", "desc": "Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Rahul Aryan AnsPress plugin <=\u00a04.3.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1489", "desc": "A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical. Affected by this vulnerability is the function 0x9C402088 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation leads to improper access controls. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223375.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1489", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/2023iThome", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-36054", "desc": "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.", "poc": ["https://github.com/adegoodyer/kubernetes-admin-toolkit", "https://github.com/ecperth/check-aws-inspector"]}, {"cve": "CVE-2023-28381", "desc": "An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1779"]}, {"cve": "CVE-2023-1353", "desc": "A vulnerability, which was classified as problematic, was found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0. Affected is an unknown function of the file verification.php. The manipulation of the argument txtvaccinationID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222852.", "poc": ["https://vuldb.com/?id.222852"]}, {"cve": "CVE-2023-52443", "desc": "In the Linux kernel, the following vulnerability has been resolved:apparmor: avoid crash when parsed profile name is emptyWhen processing a packed profile in unpack_profile() described like \"profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}\"a string \":samba-dcerpcd\" is unpacked as a fully-qualified name and thenpassed to aa_splitn_fqname().aa_splitn_fqname() treats \":samba-dcerpcd\" as only containing a namespace.Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Lateraa_alloc_profile() crashes as the new profile name is NULL now.general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014RIP: 0010:strlen+0x1e/0xa0Call Trace: ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 ---[ end trace 0000000000000000 ]---RIP: 0010:strlen+0x1e/0xa0It seems such behaviour of aa_splitn_fqname() is expected and checked inother places where it is called (e.g. aa_remove_profiles). Well, thereis an explicit comment \"a ns name without a following profile is allowed\"inside.AFAICS, nothing can prevent unpacked \"name\" to be in form like\":samba-dcerpcd\" - it is passed from userspace.Deny the whole profile set replacement in such case and inform user withEPROTO and an explaining message.Found by Linux Verification Center (linuxtesting.org).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43517", "desc": "Memory corruption in Automotive Multimedia due to improper access control in HAB.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3970", "desc": "A vulnerability, which was classified as problematic, was found in GZ Scripts Availability Booking Calendar PHP 1.0. This affects an unknown part of the file /index.php?controller=GzUser&action=edit&id=1 of the component Image Handler. The manipulation of the argument img leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235569 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.235569"]}, {"cve": "CVE-2023-32233", "desc": "In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.", "poc": ["http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html", "https://news.ycombinator.com/item?id=35879660", "https://github.com/0xsyr0/OSCP", "https://github.com/ARGOeu-Metrics/secmon-probes", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/EGI-Federation/SVG-advisories", "https://github.com/GhostTroops/TOP", "https://github.com/Liuk3r/CVE-2023-32233", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/PIDAN-HEIDASHUAI/CVE-2023-32233", "https://github.com/RogelioPumajulca/TEST-CVE-2023-32233", "https://github.com/SirElmard/ethical_hacking", "https://github.com/Threekiii/CVE", "https://github.com/djki5s/tools", "https://github.com/hktalent/TOP", "https://github.com/johe123qwe/github-trending", "https://github.com/kgwanjala/oscp-cheatsheet", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/oferchen/POC-CVE-2023-32233", "https://github.com/oscpname/OSCP_cheat", "https://github.com/revanmalang/OSCP", "https://github.com/sirhc505/CVE_TOOLS", "https://github.com/txuswashere/OSCP", "https://github.com/void0red/CVE-2023-32233", "https://github.com/xairy/linux-kernel-exploitation", "https://github.com/xhref/OSCP", "https://github.com/xyxj1024/xyxj1024.github.io"]}, {"cve": "CVE-2023-35056", "desc": "A buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.This buffer overflow is in the next_page parameter in the cgi_handler function.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1761"]}, {"cve": "CVE-2023-6725", "desc": "An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45376", "desc": "In the module \"Carousels Pack - Instagram, Products, Brands, Supplier\" (hicarouselspack) for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct().`", "poc": ["https://security.friendsofpresta.org/modules/2023/10/19/hicarouselspack.html"]}, {"cve": "CVE-2023-0262", "desc": "The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.", "poc": ["https://wpscan.com/vulnerability/5d8c28ac-a46c-45d3-acc9-2cd2e6356ba2"]}, {"cve": "CVE-2023-2606", "desc": "The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/62deb3ed-a7e4-4cdc-a615-cad2ec2e1e8f"]}, {"cve": "CVE-2023-0149", "desc": "The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/6b6f9e42-7f7f-4daa-99c9-14a24a6d76b0"]}, {"cve": "CVE-2023-25002", "desc": "A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.", "poc": ["https://github.com/nokn0wthing/CVE-2023-20052"]}, {"cve": "CVE-2023-4255", "desc": "An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition.", "poc": ["https://github.com/tats/w3m/issues/268", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1687", "desc": "A vulnerability classified as problematic has been found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown function of the file LoginRegistration.php?a=register_user. The manipulation of the argument Fullname leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-224244.", "poc": ["https://vuldb.com/?id.224244"]}, {"cve": "CVE-2023-1758", "desc": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/0854328e-eb00-41a3-9573-8da8f00e369c", "https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-41856", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ClickToTweet.Com Click To Tweet plugin <=\u00a02.0.14 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34192", "desc": "Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.", "poc": ["https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-6654", "desc": "A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.", "poc": ["https://github.com/CTF-Archives/2023-xhlj", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/qfmy1024/CVE-2023-6654", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-33580", "desc": "Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the \"Admin Name\" field on Admin Profile page.", "poc": ["http://packetstormsecurity.com/files/173030/Student-Study-Center-Management-System-1.0-Cross-Site-Scripting.html", "https://www.exploit-db.com/exploits/51528", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sudovivek/My-CVE"]}, {"cve": "CVE-2023-23328", "desc": "A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file.", "poc": ["https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md"]}, {"cve": "CVE-2023-38632", "desc": "async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in tcpsocket.hpp when processing malformed TCP packets.", "poc": ["https://github.com/Halcy0nic/CVE-2023-38632", "https://github.com/Halcy0nic/Trophies", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/skinnyrad/Trophies"]}, {"cve": "CVE-2023-5356", "desc": "Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20773", "desc": "In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07611449; Issue ID: ALPS07441735.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31483", "desc": "tar/TarFileReader.cpp in Cauldron cbang before bastet-v8.1.17 has a directory traversal during extraction that allows the attacker to create or write to files outside the current directory via a crafted tar archive.", "poc": ["https://github.com/CauldronDevelopmentLLC/cbang/issues/115"]}, {"cve": "CVE-2023-47355", "desc": "The com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed broadcast receivers for PowerOff, Reboot, and Recovery (e.g., com.eypcnnapps.quickreboot.widget.PowerOff) that are susceptible to unauthorized broadcasts because of missing input validation.", "poc": ["https://github.com/actuator/com.eypcnnapps.quickreboot/blob/main/CWE-925.md", "https://github.com/actuator/com.eypcnnapps.quickreboot", "https://github.com/actuator/cve", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38182", "desc": "Microsoft Exchange Server Remote Code Execution Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45235", "desc": "EDK2's Network Package is susceptible to a buffer overflow vulnerability whenhandling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.", "poc": ["http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/quarkslab/pixiefail"]}, {"cve": "CVE-2023-26150", "desc": "Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication.\n**Note:**\nThis issue is a result of missing checks for services that require an active session.", "poc": ["https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673435", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40781", "desc": "Buffer Overflow vulnerability in Libming Libming v.0.4.8 allows a remote attacker to cause a denial of service via a crafted .swf file to the makeswf function.", "poc": ["https://github.com/libming/libming/issues/288"]}, {"cve": "CVE-2023-31427", "desc": "Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0, \u201croot\u201d account access is disabled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39612", "desc": "A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.", "poc": ["https://febin0x4e4a.wordpress.com/2023/09/15/xss-in-filebrowser-leads-to-admin-account-takeover-in-filebrowser/", "https://github.com/filebrowser/filebrowser/issues/2570"]}, {"cve": "CVE-2023-2003", "desc": "Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device.", "poc": ["https://www.hackplayers.com/2023/07/vulnerabilidad-vision1210-unitronics.html"]}, {"cve": "CVE-2023-3421", "desc": "Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1751"]}, {"cve": "CVE-2023-6718", "desc": "An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any authentication method, resulting in the alteration or creation of users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1691", "desc": "Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23295", "desc": "Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.", "poc": ["https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetwave-series/"]}, {"cve": "CVE-2023-4441", "desc": "A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /patient/appointment.php. The manipulation of the argument sheduledate leads to sql injection. The attack can be initiated remotely. VDB-237562 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.237562", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43261", "desc": "An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.", "poc": ["http://packetstormsecurity.com/files/176988/Milesight-UR5X-UR32L-UR32-UR35-UR41-Credential-Leakage.html", "https://github.com/win3zz/CVE-2023-43261", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/johe123qwe/github-trending", "https://github.com/komodoooo/Some-things", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/win3zz/CVE-2023-43261"]}, {"cve": "CVE-2023-31567", "desc": "Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3.", "poc": ["https://github.com/podofo/podofo/issues/71"]}, {"cve": "CVE-2023-44001", "desc": "An issue in Ailand clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52313", "desc": "FPE in paddle.argmin and paddle.argmax\u00a0in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-022.md"]}, {"cve": "CVE-2023-0069", "desc": "The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/d9f00bcb-3746-4a9d-a222-4d532e84615f"]}, {"cve": "CVE-2023-27231", "desc": "TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg.", "poc": ["https://github.com/Am1ngl/ttt/tree/main/31"]}, {"cve": "CVE-2023-29099", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Elegant themes Divi theme <=\u00a04.20.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26132", "desc": "Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-DOTTIE-3332763", "https://github.com/ARPSyndicate/cvemon", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-27789", "desc": "An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the cidr2cidr function at the cidr.c:178 endpoint.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Marsman1996/pocs"]}, {"cve": "CVE-2023-4464", "desc": "A vulnerability, which was classified as critical, has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. This issue affects some unknown processing of the component Diagnostic Telnet Mode. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-249257 was assigned to this vulnerability.", "poc": ["https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices", "https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"]}, {"cve": "CVE-2023-39026", "desc": "Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component.", "poc": ["http://packetstormsecurity.com/files/174491/FileMage-Gateway-1.10.9-Local-File-Inclusion.html", "https://raindayzz.com/technicalblog/2023/08/20/FileMage-Vulnerability.html", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/getdrive/PoC"]}, {"cve": "CVE-2023-38201", "desc": "A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46928", "desc": "GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl /afltest/gpac/src/media_tools/isom_tools.c:3293:42.", "poc": ["https://github.com/gpac/gpac/issues/2661"]}, {"cve": "CVE-2023-31248", "desc": "Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace", "poc": ["http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html", "http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html", "https://github.com/20142995/sectool", "https://github.com/Threekiii/CVE", "https://github.com/star-sg/CVE"]}, {"cve": "CVE-2023-35909", "desc": "Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32067", "desc": "c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1288", "desc": "An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-29740", "desc": "An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulating the database.", "poc": ["https://play.google.com/store/apps/details?id=com.amdroidalarmclock.amdroid"]}, {"cve": "CVE-2023-0810", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.", "poc": ["https://huntr.dev/bounties/a48414ea-63d9-453c-b3f3-2c927b71ec68"]}, {"cve": "CVE-2023-21748", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/170946/Windows-Kernel-Key-Replication-Issues.html", "http://packetstormsecurity.com/files/170949/Windows-Kernel-Registry-Virtualization-Incompatibility.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-45208", "desc": "A command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (within range of the repeater) to run shell commands as root during the setup process of the repeater, via a crafted SSID. Also, network names containing single quotes (in the range of the repeater) can result in a denial of service.", "poc": ["https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-006/-d-link-dap-x1860-remote-command-injection"]}, {"cve": "CVE-2023-24698", "desc": "Insufficient parameter validation in the Foswiki::Sandbox component of Foswiki v2.1.7 and below allows attackers to perform a directory traversal via supplying a crafted web request.", "poc": ["https://foswiki.org/Support/SecurityAlert-CVE-2023-24698"]}, {"cve": "CVE-2023-31404", "desc": "Under certain conditions,\u00a0SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could let them access data sources which would otherwise be restricted.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-48031", "desc": "OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This can enable the attacker to execute arbitrary code or establish a reverse shell, leading to unauthorized file writes or control over the victim's station via a crafted file upload operation.", "poc": ["https://nitipoom-jar.github.io/CVE-2023-48031/", "https://github.com/nitipoom-jar/CVE-2023-48031", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-20197", "desc": "A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\nThis vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources.\nFor a description of this vulnerability, see the ClamAV blog .", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-rNwNEEee"]}, {"cve": "CVE-2023-39169", "desc": "The affected devices use publicly available default credentials with administrative privileges.", "poc": ["https://seclists.org/fulldisclosure/2023/Nov/3"]}, {"cve": "CVE-2023-5906", "desc": "The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users. This vulnerability poses a serious security threat because it allows an attacker to gain access to confidential data and files of other users without their permission.", "poc": ["https://wpscan.com/vulnerability/911d495c-3867-4259-a73a-572cd4fccdde"]}, {"cve": "CVE-2023-4206", "desc": "A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.", "poc": ["https://github.com/EGI-Federation/SVG-advisories", "https://github.com/hshivhare67/Kernel_4.1.15_CVE-2023-4206_CVE-2023-4207_CVE-2023-4208", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-23571", "desc": "An access violation vulnerability exists in the eventcore functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to denial of service. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1696"]}, {"cve": "CVE-2023-41561", "desc": "Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter startIp and endIp at url /goform/SetPptpServerCfg.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/sinemsahn/Public-CVE-Analysis"]}, {"cve": "CVE-2023-2977", "desc": "A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.", "poc": ["https://github.com/fullwaywang/QlRules"]}, {"cve": "CVE-2023-32315", "desc": "Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn\u2019t available for a specific release, or isn\u2019t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.", "poc": ["http://packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.html", "https://github.com/0x783kb/Security-operation-book", "https://github.com/20142995/pocsuite3", "https://github.com/20142995/sectool", "https://github.com/5rGJ5aCh5oCq5YW9/CVE-2023-32315exp", "https://github.com/ARPSyndicate/cvemon", "https://github.com/CN016/Openfire-RCE-CVE-2023-32315-", "https://github.com/H4cking2theGate/TraversalHunter", "https://github.com/K3ysTr0K3R/CVE-2023-32315-EXPLOIT", "https://github.com/K3ysTr0K3R/K3ysTr0K3R", "https://github.com/Loginsoft-LLC/Linux-Exploit-Detection", "https://github.com/Loginsoft-Research/Linux-Exploit-Detection", "https://github.com/MzzdToT/HAC_Bored_Writing", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Pari-Malam/CVE-2023-32315", "https://github.com/SrcVme50/Jab", "https://github.com/TLGKien/SploitusCrawl", "https://github.com/ThatNotEasy/CVE-2023-32315", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/Vulhub-Reproduce", "https://github.com/XRSec/AWVS-Update", "https://github.com/aneasystone/github-trending", "https://github.com/bakery312/Vulhub-Reproduce", "https://github.com/bhaveshharmalkar/learn365", "https://github.com/bingtangbanli/VulnerabilityTools", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/florentvinai/Write-ups-JAB-htb", "https://github.com/gibran-abdillah/CVE-2023-32315", "https://github.com/h00die-gr3y/Metasploit", "https://github.com/igniterealtime/openfire-authfiltersanitizer-plugin", "https://github.com/izzz0/CVE-2023-32315-POC", "https://github.com/johe123qwe/github-trending", "https://github.com/luck-ying/Library-POC", "https://github.com/miko550/CVE-2023-32315", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ohnonoyesyes/CVE-2023-32315", "https://github.com/pinguimfu/kinsing-killer", "https://github.com/tangxiaofeng7/CVE-2023-32315-Openfire-Bypass"]}, {"cve": "CVE-2023-46359", "desc": "An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature.", "poc": ["https://github.com/Marco-zcl/POC", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tanjiti/sec_profile", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-"]}, {"cve": "CVE-2023-20593", "desc": "An issue in \u201cZen 2\u201d CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.", "poc": ["http://seclists.org/fulldisclosure/2023/Jul/43", "http://www.openwall.com/lists/oss-security/2023/07/24/3", "https://github.com/EGI-Federation/SVG-advisories", "https://github.com/Ixeoz/AMD-Zenbleed-Rendimiento", "https://github.com/amstelchen/smc_gui", "https://github.com/codexlynx/hardware-attacks-state-of-the-art", "https://github.com/giterlizzi/secdb-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sbaresearch/stop-zenbleed-win", "https://github.com/speed47/spectre-meltdown-checker", "https://github.com/w1redch4d/windowz2-bleed"]}, {"cve": "CVE-2023-35827", "desc": "An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.", "poc": ["https://github.com/shakyaraj9569/Documentation"]}, {"cve": "CVE-2023-35877", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Vadym K. Extra User Details allows Stored XSS.This issue affects Extra User Details: from n/a through 0.5.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-4977", "desc": "Code Injection in GitHub repository librenms/librenms prior to 23.9.0.", "poc": ["https://huntr.dev/bounties/3db8a1a4-ca2d-45df-be18-a959ebf82fbc"]}, {"cve": "CVE-2023-42852", "desc": "A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, tvOS 17.1. Processing web content may lead to arbitrary code execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33959", "desc": "notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.", "poc": ["https://github.com/anhtranquang/deps-with-cve", "https://github.com/anhtranquang/unused-deps-with-cve", "https://github.com/dattq88/PoC-unused-deps-with-cve", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/scan-demo/deps-with-cve", "https://github.com/scan-demo/unused-deps-with-cve", "https://github.com/sec-scan-demo/deps-with-cve", "https://github.com/sec-scan-demo/unused-deps-with-cve"]}, {"cve": "CVE-2023-28446", "desc": "Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). This issue has been patched in version 1.31.2.", "poc": ["https://github.com/denoland/deno/security/advisories/GHSA-vq67-rp93-65qf"]}, {"cve": "CVE-2023-23777", "desc": "An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.18 and below may allow a privileged attacker to execute arbitrary bash commands via crafted cli backup parameters.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47858", "desc": "Mattermost fails to properly verify the permissions needed for viewing archived public channels,\u00a0\u00a0allowing a member of one team to get details about the archived public channels of another team via the\u00a0GET /api/v4/teams//channels/deleted endpoint.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30950", "desc": "The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint", "poc": ["https://palantir.safebase.us/?tcuUid=d839709d-c50f-4a37-8faa-b0c35054418a"]}, {"cve": "CVE-2023-0176", "desc": "The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/a762c25b-5c47-400e-8964-407cf4c94e9f"]}, {"cve": "CVE-2023-45060", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com Interactive World Map plugin <=\u00a03.2.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1164", "desc": "A vulnerability was found in KylinSoft kylin-activation on KylinOS and classified as critical. Affected by this issue is some unknown functionality of the component File Import. The manipulation leads to improper authorization. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.11-23 and 1.30.10-5.p23 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222260.", "poc": ["https://github.com/i900008/vulndb/blob/main/kylin-activation_vuln.md"]}, {"cve": "CVE-2023-26604", "desc": "systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the \"systemctl status\" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.", "poc": ["http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html", "https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/", "https://github.com/FerdiGul/KOUF5", "https://github.com/Pol-Ruiz/CVE-2023-1326", "https://github.com/Wetrel/HackTheBox_Sau", "https://github.com/Zenmovie/CVE-2023-26604", "https://github.com/denis-jdsouza/wazuh-vulnerability-report-maker", "https://github.com/diego-tella/CVE-2023-1326-PoC", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tl87/container-scanner"]}, {"cve": "CVE-2023-31631", "desc": "An issue in the sqlo_preds_contradiction component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1137"]}, {"cve": "CVE-2023-4454", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.", "poc": ["https://huntr.dev/bounties/4ee0ef74-e4d4-46e7-a05c-076bce522299"]}, {"cve": "CVE-2023-52346", "desc": "In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42645", "desc": "In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24807", "desc": "Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Extiri/extiri-web", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-34185", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in John Brien WordPress NextGen GalleryView plugin <=\u00a00.5.5 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-3219", "desc": "The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.", "poc": ["http://packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html", "https://wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fd"]}, {"cve": "CVE-2023-40876", "desc": "DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_add.php via the title parameter.", "poc": ["https://github.com/DiliLearngent/BugReport", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30370", "desc": "In Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerability.", "poc": ["https://github.com/2205794866/Tenda/blob/main/AC15/7.md"]}, {"cve": "CVE-2023-38224", "desc": "Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/markyason/markyason.github.io"]}, {"cve": "CVE-2023-0902", "desc": "A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451.", "poc": ["https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Simple%20Food%20Ordering%20System%20-%20Authenticated%20Reflected%20XSS.md", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-2392", "desc": "A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. Affected is an unknown function of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ManualDate.minutes leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/12", "https://vuldb.com/?id.227670"]}, {"cve": "CVE-2023-6518", "desc": "Plaintext Storage of a Password vulnerability in Mia Technology Inc. M\u0130A-MED allows Read Sensitive Strings Within an Executable.This issue affects M\u0130A-MED: before 1.0.7.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37146", "desc": "TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.", "poc": ["https://github.com/DaDong-G/Vulnerability_info/tree/main/TOTOLINK/lr350/2"]}, {"cve": "CVE-2023-48300", "desc": "The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_opt_out` shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 1.8.1 contains a patch for this issue.", "poc": ["https://github.com/epiphyt/embed-privacy/security/advisories/GHSA-3wv9-4rvf-w37g"]}, {"cve": "CVE-2023-32207", "desc": "A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1826116"]}, {"cve": "CVE-2023-3609", "desc": "A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.", "poc": ["http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html", "http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html", "https://github.com/nidhi7598/linux-4.19.72_CVE-2023-3609"]}, {"cve": "CVE-2023-22612", "desc": "An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. A malicious host OS can invoke an Insyde SMI handler with malformed arguments, resulting in memory corruption in SMM.", "poc": ["https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/"]}, {"cve": "CVE-2023-26120", "desc": "This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update.", "poc": ["https://security.snyk.io/vuln/SNYK-JAVA-COMXUXUELI-3248764"]}, {"cve": "CVE-2023-2255", "desc": "Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used \"floating frames\" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.", "poc": ["https://github.com/Mathieuleto/CVE-2023-2255", "https://github.com/elweth-sec/CVE-2023-2255", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-39181", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24813", "desc": "Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of `image` tags and respects `xlink:href` even if `href` is specified. However, php-svg-lib, which is later used to parse the svg file, parses the href attribute. Since `href` is respected if both `xlink:href` and `href` is specified, it's possible to bypass the protection on the Dompdf side by providing an empty `xlink:href` attribute. An attacker can exploit the vulnerability to call arbitrary URLs with arbitrary protocols if they provide an SVG file to the Dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, which will lead, at the very least, to arbitrary file deletion and might lead to remote code execution, depending on available classes. This vulnerability has been addressed in commit `95009ea98` which has been included in release version 2.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/jujuo0o/CVE-Exploits"]}, {"cve": "CVE-2023-52374", "desc": "Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5536", "desc": "A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to root without requiring a sudo password.", "poc": ["https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1829071"]}, {"cve": "CVE-2023-0058", "desc": "The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/0e677df9-2c49-42f0-a8e2-dbcf85bfc1a2"]}, {"cve": "CVE-2023-3276", "desc": "A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.231626"]}, {"cve": "CVE-2023-4634", "desc": "The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.", "poc": ["https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz", "https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/", "https://github.com/Patrowl/CVE-2023-4634", "https://github.com/lehazare/ProjetCL", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-44767", "desc": "A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content.", "poc": ["https://github.com/sromanhu/RiteCMS-File-Upload--XSS---Filemanager/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-44767_RiteCMS-File-Upload--XSS---Filemanager"]}, {"cve": "CVE-2023-31612", "desc": "An issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1125", "https://github.com/Sedar2024/Sedar"]}, {"cve": "CVE-2023-23635", "desc": "In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.", "poc": ["https://herolab.usd.de/security-advisories/usd-2022-0031/"]}, {"cve": "CVE-2023-47077", "desc": "Adobe InDesign versions 19.0 (and earlier) and 17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49950", "desc": "The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting (XSS) payload and send it to any system or device that sends logs to the SIEM. If an alert is created, the payload will execute upon the alert data being viewed with that template, which can lead to sensitive data disclosure.", "poc": ["https://github.com/shrikeinfosec/cve-2023-49950/blob/main/cve-2023-49950.md", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/shrikeinfosec/cve-2023-49950"]}, {"cve": "CVE-2023-45561", "desc": "An issue in A-WORLD OIRASE BEER_waiting Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6053", "desc": "A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.9. Affected by this issue is some unknown functionality of the file general/system/censor_words/manage/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-244874 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.244874"]}, {"cve": "CVE-2023-2439", "desc": "The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681"]}, {"cve": "CVE-2023-45832", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson WP GoToWebinar plugin <=\u00a014.45 versions.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-25086", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the firewall_handler_set function with the index and dport variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-1624", "desc": "The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders", "poc": ["https://wpscan.com/vulnerability/132b70e5-4368-43b4-81f6-2d01bc09dc8f"]}, {"cve": "CVE-2023-26762", "desc": "Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an arbitrary file upload vulnerability.", "poc": ["https://www.swascan.com/it/security-advisory-sme-up-erp/"]}, {"cve": "CVE-2023-2765", "desc": "A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic. This vulnerability affects unknown code of the file /E-mobile/App/System/File/downfile.php. The manipulation of the argument url leads to absolute path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-229270 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/eckert-lcc/cve/blob/main/Weaver%20oa.md", "https://vuldb.com/?id.229270"]}, {"cve": "CVE-2023-38898", "desc": "** DISPUTED ** An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there are no common scenarios in which an adversary can call _asyncio._swap_current_task but does not already have the ability to call arbitrary functions; and (3) there are no common scenarios in which sensitive information, which is not already accessible to an adversary, becomes accessible through this bug.", "poc": ["https://github.com/toxyl/lscve"]}, {"cve": "CVE-2023-0159", "desc": "The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains.", "poc": ["https://wpscan.com/vulnerability/239ea870-66e5-4754-952e-74d4dd60b809", "https://github.com/im-hanzou/EVCer", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/xu-xiang/awesome-security-vul-llm"]}, {"cve": "CVE-2023-27728", "desc": "Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_dump_is_recursive at src/njs_vmcode.c.", "poc": ["https://github.com/nginx/njs/issues/618"]}, {"cve": "CVE-2023-23902", "desc": "A buffer overflow vulnerability exists in the uhttpd login functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to remote code execution. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1697"]}, {"cve": "CVE-2023-31414", "desc": "Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.", "poc": ["https://www.elastic.co/community/security/", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-4099", "desc": "The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6936", "desc": "In wolfSSL prior to 5.6.6, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS client or network attacker can trigger a buffer over-read on the heap of 5 bytes (WOLFSSL_CALLBACKS is only intended for debugging).", "poc": ["https://github.com/wolfSSL/Arduino-wolfSSL", "https://github.com/wolfSSL/wolfssl"]}, {"cve": "CVE-2023-39269", "desc": "A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM M969NC, RUGGEDCOM RMC30, RUGGEDCOM RMC30NC, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RMC8388NC V4.X, RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RP110, RUGGEDCOM RP110NC, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600FNC, RUGGEDCOM RS1600NC, RUGGEDCOM RS1600T, RUGGEDCOM RS1600TNC, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS400NC, RUGGEDCOM RS401, RUGGEDCOM RS401NC, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416NC, RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416PNC, RUGGEDCOM RS416PNCv2 V4.X, RUGGEDCOM RS416PNCv2 V5.X, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000ANC, RUGGEDCOM RS8000H, RUGGEDCOM RS8000HNC, RUGGEDCOM RS8000NC, RUGGEDCOM RS8000T, RUGGEDCOM RS8000TNC, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GNC, RUGGEDCOM RS900GNC(32M) V4.X, RUGGEDCOM RS900GNC(32M) V5.X, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900GPNC, RUGGEDCOM RS900L, RUGGEDCOM RS900LNC, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900MNC-GETS-C01, RUGGEDCOM RS900MNC-GETS-XX, RUGGEDCOM RS900MNC-STND-XX, RUGGEDCOM RS900MNC-STND-XX-C01, RUGGEDCOM RS900NC, RUGGEDCOM RS900NC(32M) V4.X, RUGGEDCOM RS900NC(32M) V5.X, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910LNC, RUGGEDCOM RS910NC, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920LNC, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930LNC, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS940GNC, RUGGEDCOM RS969, RUGGEDCOM RS969NC, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100NC, RUGGEDCOM RSG2100NC(32M) V4.X, RUGGEDCOM RSG2100NC(32M) V5.X, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2100PNC, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2200NC, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2288NC V4.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300NC V4.X, RUGGEDCOM RSG2300NC V5.X, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2300PNC V4.X, RUGGEDCOM RSG2300PNC V5.X, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG2488NC V4.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSG920PNC V4.X, RUGGEDCOM RSG920PNC V5.X, RUGGEDCOM RSL910, RUGGEDCOM RSL910NC, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. The web server of the affected devices contains a vulnerability that may lead to a denial of service condition.\nAn attacker may cause total loss of availability of the web server, which might recover after the attack is over.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31416", "desc": "Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment.", "poc": ["https://www.elastic.co/community/security"]}, {"cve": "CVE-2023-45542", "desc": "Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a crafted script to the q parameter in the Search function.", "poc": ["https://github.com/ahrixia/CVE-2023-45542", "https://github.com/ahrixia/CVE-2023-45542", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-39676", "desc": "FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.", "poc": ["https://blog.sorcery.ie/posts/fieldpopupnewsletter_xss/"]}, {"cve": "CVE-2023-27135", "desc": "TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/setWanIeCfg.", "poc": ["https://github.com/Am1ngl/ttt/tree/main/29"]}, {"cve": "CVE-2023-29531", "desc": "An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash.*This bug only affects Firefox and\u00a0Thunderbird for macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.", "poc": ["https://github.com/dlehgus1023/dlehgus1023"]}, {"cve": "CVE-2023-5384", "desc": "A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43338", "desc": "Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr(). This vulnerability allows attackers to execute arbitrary code via a crafted input.", "poc": ["https://github.com/cesanta/mjs/issues/250"]}, {"cve": "CVE-2023-28351", "desc": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with the Student application installed is logged to a world-readable directory. A local attacker can trivially extract these cleartext keystrokes, potentially enabling them to obtain PII and/or to compromise personal accounts owned by the victim.", "poc": ["https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/", "https://research.nccgroup.com/?research=Technical%20advisories"]}, {"cve": "CVE-2023-48200", "desc": "Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment description component within /equipment/ component.", "poc": ["https://nitipoom-jar.github.io/CVE-2023-48200/", "https://github.com/nitipoom-jar/CVE-2023-48200", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2653", "desc": "A vulnerability classified as critical was found in SourceCodester Lost and Found Information System 1.0. Affected by this vulnerability is an unknown functionality of the file items/index.php. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228781 was assigned to this vulnerability.", "poc": ["https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Lost-and-Found-Information-System---Multiple-SQL-injections.md", "https://vuldb.com/?id.228781"]}, {"cve": "CVE-2023-22086", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://github.com/X1r0z/X1r0z"]}, {"cve": "CVE-2023-31209", "desc": "Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30969", "desc": "The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.", "poc": ["https://palantir.safebase.us/?tcuUid=afcbc9b2-de62-44b9-b28b-2ebf0684fbf7"]}, {"cve": "CVE-2023-28879", "desc": "In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.", "poc": ["http://www.openwall.com/lists/oss-security/2023/04/12/4", "https://bugs.ghostscript.com/show_bug.cgi?id=706494", "https://github.com/0xsyr0/OSCP", "https://github.com/ARPSyndicate/cvemon", "https://github.com/SirElmard/ethical_hacking", "https://github.com/fardeen-ahmed/Bug-bounty-Writeups", "https://github.com/kgwanjala/oscp-cheatsheet", "https://github.com/oscpname/OSCP_cheat", "https://github.com/revanmalang/OSCP", "https://github.com/txuswashere/OSCP", "https://github.com/xhref/OSCP"]}, {"cve": "CVE-2023-33096", "desc": "Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33563", "desc": "In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41993", "desc": "The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.", "poc": ["https://github.com/0x06060606/CVE-2023-41993", "https://github.com/Ibinou/Ty", "https://github.com/IvanIVGrozny/IvanIVGrozny.github.io", "https://github.com/J3Ss0u/CVE-2023-41993", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hrtowii/cve-2023-41993-test", "https://github.com/jafshare/GithubTrending", "https://github.com/johe123qwe/github-trending", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/po6ix/POC-for-CVE-2023-41993", "https://github.com/sampsonv/github-trending"]}, {"cve": "CVE-2023-1623", "desc": "The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack.", "poc": ["https://wpscan.com/vulnerability/a04d3808-f4fc-4d77-a1bd-be623cd7053e"]}, {"cve": "CVE-2023-28191", "desc": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to bypass Privacy preferences.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-49404", "desc": "Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet.", "poc": ["https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_setAdvancedSetList/w30e_setAdvancedSetList.md"]}, {"cve": "CVE-2023-3820", "desc": "SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.", "poc": ["https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db"]}, {"cve": "CVE-2023-2438", "desc": "The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'userpro_save_userdata' function. This makes it possible for unauthenticated attackers to update the user meta and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681"]}, {"cve": "CVE-2023-0544", "desc": "The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/8ef9585f-67d7-4651-977a-fcad113882bd"]}, {"cve": "CVE-2023-30373", "desc": "In Tenda AC15 V15.03.05.19, the function \"xian_pppoe_user\" contains a stack-based buffer overflow vulnerability.", "poc": ["https://github.com/2205794866/Tenda/blob/main/AC15/8.md"]}, {"cve": "CVE-2023-28466", "desc": "do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).", "poc": ["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962"]}, {"cve": "CVE-2023-24518", "desc": "A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against. This issue affects Pandora FMS version 767 and earlier versions on all platforms.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33760", "desc": "SpliceCom Maximiser Soft PBX v1.5 and before was discovered to utilize a default SSL certificate. This issue can allow attackers to eavesdrop on communications via a man-in-the-middle attack.", "poc": ["https://github.com/twignet/splicecom", "https://github.com/twignet/splicecom"]}, {"cve": "CVE-2023-2629", "desc": "Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.", "poc": ["https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01"]}, {"cve": "CVE-2023-4221", "desc": "Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.", "poc": ["https://starlabs.sg/advisories/23/23-4221"]}, {"cve": "CVE-2023-2451", "desc": "A vulnerability was found in SourceCodester Online DJ Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/bookings/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227795.", "poc": ["https://vuldb.com/?id.227795"]}, {"cve": "CVE-2023-49127", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4121", "desc": "A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235968. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/torres14852/cve/blob/main/upload.md", "https://github.com/izj007/wechat", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-52265", "desc": "IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.", "poc": ["https://github.com/wbowm15/jubilant-enigma/blob/main/writeup.md"]}, {"cve": "CVE-2023-30330", "desc": "SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defaultframe/2.0/defaultframe_filter.php.", "poc": ["https://github.com/Filiplain/LFI-to-RCE-SE-Suite-2.0", "https://www.exploit-db.com/exploits/51404", "https://github.com/Filiplain/LFI-to-RCE-SE-Suite-2.0"]}, {"cve": "CVE-2023-47861", "desc": "A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1884", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1884"]}, {"cve": "CVE-2023-41704", "desc": "Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/177130/OX-App-Suite-7.10.6-Cross-Site-Scirpting-Denial-Of-Service.html"]}, {"cve": "CVE-2023-31608", "desc": "An issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1123", "https://github.com/Sedar2024/Sedar"]}, {"cve": "CVE-2023-28102", "desc": "discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the `discordrb` library and will likely not be total system access. This issue has been addressed in code, but a new release of the `discordrb` gem has not been uploaded to rubygems. This issue is also tracked as `GHSL-2022-094`.", "poc": ["https://securitylab.github.com/advisories/GHSL-2022-094_discordrb/"]}, {"cve": "CVE-2023-42636", "desc": "In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49090", "desc": "CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.", "poc": ["https://github.com/a-zara-n/a-zara-n"]}, {"cve": "CVE-2023-2892", "desc": "The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_bulk_delete_product function. This makes it possible for unauthenticated attackers to bulk delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-5522", "desc": "Mattermost Mobile fails to limit\u00a0the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and\u00a0freeze the mobile app of users when viewing that particular channel.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41628", "desc": "An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messaging procedure between the E2Node and E2Term components.", "poc": ["https://jira.o-ran-sc.org/browse/RIC-1002"]}, {"cve": "CVE-2023-20268", "desc": "A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resources on an affected device.\nThis vulnerability is due to insufficient management of resources when handling certain types of traffic. An attacker could exploit this vulnerability by sending a series of specific wireless packets to an affected device. A successful exploit could allow the attacker to consume resources on an affected device. A sustained attack could lead to the disruption of the Control and Provisioning of Wireless Access Points (CAPWAP) tunnel and intermittent loss of wireless client traffic.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4136", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.", "poc": ["http://packetstormsecurity.com/files/174304/CrafterCMS-4.0.2-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-52046", "desc": "Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the \"Execute cron job as\" tab Input field.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40464", "desc": "Several versions ofALEOS, including ALEOS 4.16.0, use a hardcodedSSL certificate andprivate key. An attacker with access to these itemscould potentiallyperform a man in the middle attack between theACEManager clientand ACEManager server.", "poc": ["https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs"]}, {"cve": "CVE-2023-48388", "desc": "Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43996", "desc": "An issue in Q co ltd mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37627", "desc": "Code-projects Online Restaurant Management System 1.0 is vulnerable to SQL Injection. Through SQL injection, an attacker can bypass the admin panel and view order records, add items, delete items etc.", "poc": ["https://gist.github.com/1337kid/d3e7702bd19cc9355a6b3f153eb2fe8e"]}, {"cve": "CVE-2023-37755", "desc": "i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).", "poc": ["https://github.com/leekenghwa/CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6898", "desc": "A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248256.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44954", "desc": "Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings functions.", "poc": ["https://github.com/Ciber-Mike/BigTree_CMS-Stored_XSS-Developer_Settings/blob/main/README.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25109", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_gre function with the local_ip variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-52075", "desc": "ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, ReVanced API lacks error caching causing rate limit to be triggered thus increasing server load. This causes a denial of service for all users using the API. It is recommended to implement proper error caching.", "poc": ["https://github.com/ReVanced/revanced-api/security/advisories/GHSA-852x-grxp-8p3q"]}, {"cve": "CVE-2023-45075", "desc": "A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-38999", "desc": "A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.", "poc": ["https://logicaltrust.net/blog/2023/08/opnsense.html"]}, {"cve": "CVE-2023-5721", "desc": "It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39147", "desc": "An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.", "poc": ["http://packetstormsecurity.com/files/173878/Uvdesk-1.1.3-Shell-Upload.html"]}, {"cve": "CVE-2023-35636", "desc": "Microsoft Outlook Information Disclosure Vulnerability", "poc": ["https://github.com/duy-31/CVE-2023-35636", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/padey/Sublime-Detection-Rules", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-4886", "desc": "A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33595", "desc": "CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.", "poc": ["https://github.com/python/cpython/issues/103824", "https://github.com/toxyl/lscve"]}, {"cve": "CVE-2023-25347", "desc": "A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the \"Title\" Input Field in EventEditor.php.", "poc": ["https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25347", "https://github.com/10splayaSec/CVE-Disclosures", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-33486", "desc": "TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attacker to execute arbitrary commands through the \"hostName\" parameter.", "poc": ["https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/3"]}, {"cve": "CVE-2023-22725", "desc": "GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6.", "poc": ["https://github.com/Contrast-Security-OSS/Burptrast", "https://github.com/demomm/burptrast"]}, {"cve": "CVE-2023-0559", "desc": "The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/e5549261-66e2-4a5e-8781-bc555b629ccc"]}, {"cve": "CVE-2023-27576", "desc": "An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one to perform an account takeover of the user with super-admin permission. Specifically, for a request with updatepassword=1, a modified request (manipulating both the ID parameter and the associated username) can bypass the intended email confirmation requirement. For example, the attacker can start from an updatepassword=1 request with their own ID number, and change the ID number to 1 (representing the super admin account) and change the username to admin2. In the first step, the attacker changes the super admin's email address to one under the attacker's control. In the second step, the attacker performs a password reset for the super admin account. The new password allows login as the super admin, i.e., a successful account takeover.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-0631", "desc": "The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.", "poc": ["https://wpscan.com/vulnerability/19ef92fd-b493-4488-91f0-e6ba51362f79"]}, {"cve": "CVE-2023-38390", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Anshul Labs Mobile Address Bar Changer plugin <=\u00a03.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32259", "desc": "Insufficient Granularity of Access Control vulnerability in OpenText\u2122 Service Management Automation X (SMAX), OpenText\u2122 Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11; and Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-1671", "desc": "A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.", "poc": ["http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html", "https://github.com/0xdolan/cve_poc", "https://github.com/H4lo/awesome-IoT-security-article", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/W01fh4cker/CVE-2023-1671-POC", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/behnamvanda/CVE-2023-1671", "https://github.com/c4ln/CVE-2023-1671-POC", "https://github.com/csffs/cve-2023-1671", "https://github.com/getdrive/PoC", "https://github.com/iluaster/getdrive_PoC", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ohnonoyesyes/CVE-2023-1671"]}, {"cve": "CVE-2023-51608", "desc": "Kofax Power PDF J2K File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of J2K files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21833.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26450", "desc": "The \"OX Count\" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26774", "desc": "An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of the admin/reports endpoint.", "poc": ["https://packetstormsecurity.com/files/171692/Sales-Tracker-Management-System-1.0-Insecure-Direct-Object-Reference.html"]}, {"cve": "CVE-2023-0863", "desc": "Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symbiosis, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): from 1.0;0 through 1.5.5; Terra AC wallbox (UL32A) : from 1.0;0 through 1.6.5; Terra AC wallbox (CE) (Terra AC MID): from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC Juno CE: from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC PTB : from 1.0;0 through 1.5.25; Terra AC wallbox (CE) Symbiosis: from 1.0;0 through 1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5.", "poc": ["https://github.com/neutrinoguy/awesome-ics-writeups"]}, {"cve": "CVE-2023-0504", "desc": "The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/b427841d-a3ad-4e3a-8964-baad90a9aedb"]}, {"cve": "CVE-2023-22000", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-49122", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37070", "desc": "Code Projects Hospital Information System 1.0 is vulnerable to Cross Site Scripting (XSS)", "poc": ["https://github.com/InfoSecWarrior/Offensive-Payloads/blob/main/Cross-Site-Scripting-XSS-Payloads.txt"]}, {"cve": "CVE-2023-6501", "desc": "The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/dd19189b-de04-44b6-8ac9-0c32399a8976/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3631", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Medart Health Services Medart Notification Panel allows SQL Injection.This issue affects Medart Notification Panel: through 20231123.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25234", "desc": "Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInterface.", "poc": ["https://github.com/Funcy33/Vluninfo_Repo/tree/main/CNVDs/113_1", "https://github.com/ARPSyndicate/cvemon", "https://github.com/FzBacon/CVE-2023-25234_Tenda_AC6_stack_overflow", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-43761", "desc": "Certain WithSecure products allow Denial of Service (infinite loop). This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2110", "desc": "Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via \"app://local/\". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian.", "poc": ["https://starlabs.sg/advisories/23/23-2110/"]}, {"cve": "CVE-2023-2578", "desc": "The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/4dad1c0d-bcf9-4486-bd8e-387ac8e6c892"]}, {"cve": "CVE-2023-2632", "desc": "Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.", "poc": ["https://github.com/jenkinsci/codedx-plugin"]}, {"cve": "CVE-2023-4381", "desc": "Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.", "poc": ["https://huntr.dev/bounties/666c2617-e3e9-4955-9c97-2f8ed5262cc3"]}, {"cve": "CVE-2023-24532", "desc": "The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/MrE-Fog/cryptofuzz", "https://github.com/guidovranken/cryptofuzz", "https://github.com/karimhabush/cyberowl", "https://github.com/nao1215/golling"]}, {"cve": "CVE-2023-3732", "desc": "Out of bounds memory access in Mojo in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/174223/Chrome-IPCZ-FragmentDescriptors-Missing-Validation.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51006", "desc": "An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors.", "poc": ["https://github.com/firmianay/security-issues"]}, {"cve": "CVE-2023-2655", "desc": "The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/b3f2d38f-8eeb-45e9-bb58-2957e416e1cd/"]}, {"cve": "CVE-2023-6723", "desc": "An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforamationfileupload function, due to the lack of proper file type validation controls, resulting in a full system compromise.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24653", "desc": "Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under the Change Password function.", "poc": ["https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip"]}, {"cve": "CVE-2023-33288", "desc": "An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.9"]}, {"cve": "CVE-2023-1584", "desc": "A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6293", "desc": "Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.", "poc": ["https://huntr.com/bounties/36a7ecbf-4d3d-462e-86a3-cda7b1ec64e2"]}, {"cve": "CVE-2023-40798", "desc": "In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability.", "poc": ["https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/formSetIPv6status-formGetWanParameter"]}, {"cve": "CVE-2023-30549", "desc": "Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.1.0 and installations that include apptainer-suid < 1.1.8 on older operating systems where that CVE has not been patched. That includes Red Hat Enterprise Linux 7, Debian 10 buster (unless the linux-5.10 package is installed), Ubuntu 18.04 bionic and Ubuntu 20.04 focal. Use-after-free flaws in the kernel can be used to attack the kernel for denial of service and potentially for privilege escalation.Apptainer 1.1.8 includes a patch that by default disables mounting of extfs filesystem types in setuid-root mode, while continuing to allow mounting of extfs filesystems in non-setuid \"rootless\" mode using fuse2fs.Some workarounds are possible. Either do not install apptainer-suid (for versions 1.1.0 through 1.1.7) or set `allow setuid = no` in apptainer.conf. This requires having unprivileged user namespaces enabled and except for apptainer 1.1.x versions will disallow mounting of sif files, extfs files, and squashfs files in addition to other, less significant impacts. (Encrypted sif files are also not supported unprivileged in apptainer 1.1.x.). Alternatively, use the `limit containers` options in apptainer.conf/singularity.conf to limit sif files to trusted users, groups, and/or paths, and set `allow container extfs = no` to disallow mounting of extfs overlay files. The latter option by itself does not disallow mounting of extfs overlay partitions inside SIF files, so that's why the former options are also needed.", "poc": ["https://github.com/EGI-Federation/SVG-advisories", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23857", "desc": "Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services across systems. On a successful exploitation, the attacker can read and modify some sensitive information but can also be used to lock up any element or operation of the system making that it unresponsive or unavailable.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-40542", "desc": "When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0072", "desc": "The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/bb2b876f-7216-4f31-9d1f-a45405c545ce"]}, {"cve": "CVE-2023-2322", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/f7228f3f-3bef-46fe-b0e3-56c432048a67"]}, {"cve": "CVE-2023-34837", "desc": "A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sahiloj/CVE-2023-34837"]}, {"cve": "CVE-2023-32890", "desc": "In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01183647; Issue ID: MOLY01183647 (MSV-963).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24279", "desc": "A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.", "poc": ["https://www.edoardoottavianelli.it/CVE-2023-24279", "https://www.youtube.com/watch?v=1mSXzzwcGMM", "https://github.com/ARPSyndicate/cvemon", "https://github.com/edoardottt/master-degree-thesis", "https://github.com/edoardottt/offensive-onos", "https://github.com/edoardottt/offensive-onos-apps"]}, {"cve": "CVE-2023-25049", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.4 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/yaudahbanh/CVE-Archive"]}, {"cve": "CVE-2023-6860", "desc": "The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44271", "desc": "An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30869", "desc": "Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation.\u00a0This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-0905", "desc": "A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221454 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Employee%20Task%20Management%20System%20-%20Broken%20Authentication.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/rozzario/Employee-Task-Management-System-v1.0---Broken-Authentication"]}, {"cve": "CVE-2023-28897", "desc": "The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware.Vulnerability discovered on \u0160koda Superb III (3V3) - 2.0 TDI manufactured in 2022.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36347", "desc": "A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.", "poc": ["https://www.youtube.com/watch?v=7qaIeE2cyO4", "https://yuyudhn.github.io/pos-codekop-vulnerability/"]}, {"cve": "CVE-2023-40953", "desc": "icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF).", "poc": ["https://gist.github.com/ChubbyZ/e1e5c1858c389334dcf581a19c741308"]}, {"cve": "CVE-2023-2605", "desc": "The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.", "poc": ["http://packetstormsecurity.com/files/173734/WordPress-WP-Brutal-AI-Cross-Site-Scripting.html", "https://wpscan.com/vulnerability/372cb940-71ba-4d19-b35a-ab15f8c2fdeb"]}, {"cve": "CVE-2023-4091", "desc": "A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module \"acl_xattr\" is configured with \"acl_xattr:ignore system acls = yes\". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50254", "desc": "Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.", "poc": ["https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-q9jr-726g-9495", "https://github.com/febinrev/deepin-linux_reader_RCE-exploit", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2429", "desc": "Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.", "poc": ["https://huntr.dev/bounties/20d3a0b3-2693-4bf1-b196-10741201a540"]}, {"cve": "CVE-2023-48394", "desc": "Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A remote attacker with regular user privilege can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25117", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the local_virtual_ip and the local_virtual_mask variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-47470", "desc": "Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a denial of service (DoS) via the ref_pic_list_struct function in libavcodec/evc_ps.c", "poc": ["https://github.com/FFmpeg/FFmpeg/commit/4565747056a11356210ed8edcecb920105e40b60", "https://patchwork.ffmpeg.org/project/ffmpeg/patch/20230915131147.5945-2-michael@niedermayer.cc/"]}, {"cve": "CVE-2023-36942", "desc": "A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the website title field.", "poc": ["https://packetstormsecurity.com"]}, {"cve": "CVE-2023-45064", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <=\u00a00.3.1 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-36168", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/TraiLeR2/CVE-2023-36168", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-46442", "desc": "An infinite loop in the retrieveActiveBody function of Soot before v4.4.1 under Java 8 allows attackers to cause a Denial of Service (DoS).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0877", "desc": "Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.", "poc": ["https://huntr.dev/bounties/b29cf038-06f1-4fb0-9437-08f2991f92a8", "https://github.com/ARPSyndicate/cvemon", "https://github.com/blakduk/Advisories"]}, {"cve": "CVE-2023-43762", "desc": "Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend). This affects WithSecure Policy Manager 15 and Policy Manager Proxy 15.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46491", "desc": "ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.", "poc": ["https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-49462", "desc": "libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc.", "poc": ["https://github.com/strukturag/libheif/issues/1043"]}, {"cve": "CVE-2023-52160", "desc": "The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.", "poc": ["https://github.com/Helica-core/eap_pwn", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-37238", "desc": "Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitation of this vulnerability may affect some wireless projection features.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25368", "desc": "Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Incorrect Access Control. An unauthenticated attacker can overwrite firmnware.", "poc": ["https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25368.md", "https://github.com/BretMcDanel/CVE"]}, {"cve": "CVE-2023-47452", "desc": "An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory.", "poc": ["https://github.com/xieqiang11/poc-1/tree/main"]}, {"cve": "CVE-2023-2877", "desc": "The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.", "poc": ["https://wpscan.com/vulnerability/33765da5-c56e-42c1-83dd-fcaad976b402", "https://github.com/RandomRobbieBF/CVE-2023-2877", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-46687", "desc": "In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32313", "desc": "vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.", "poc": ["https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550", "https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v"]}, {"cve": "CVE-2023-36210", "desc": "MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keyword parameter.", "poc": ["https://www.exploit-db.com/exploits/51499", "https://github.com/capture0x/My-CVE"]}, {"cve": "CVE-2023-46004", "desc": "Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function.", "poc": ["https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/Arbitrary-File-Upload-Vulnerability.md"]}, {"cve": "CVE-2023-38328", "desc": "An issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability affects the setup panel of under setup/manageheader.php, which allows authenticated remote attackers with administrator credentials to read a cleartext database password.", "poc": ["https://www.gruppotim.it/it/footer/red-team.html"]}, {"cve": "CVE-2023-32364", "desc": "A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.5. A sandboxed process may be able to circumvent sandbox restrictions.", "poc": ["https://github.com/gergelykalman/CVE-2023-32364-macos-app-sandbox-escape", "https://github.com/houjingyi233/macOS-iOS-system-security", "https://github.com/jp-cpe/retrieve-cvss-scores", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31415", "desc": "Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.", "poc": ["https://www.elastic.co/community/security/"]}, {"cve": "CVE-2023-6341", "desc": "Catalis (previously Icon Software) CMS360 allows a remote, unauthenticated attacker to view sensitive court documents by modifying document and other identifiers in URLs. The impact varies based on the intention and configuration of a specific CMS360 installation.", "poc": ["https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/", "https://github.com/qwell/disorder-in-the-court"]}, {"cve": "CVE-2023-50857", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45047", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in LeadSquared, Inc LeadSquared Suite plugin <=\u00a00.7.4 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21933", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-30577", "desc": "AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than CVE-2022-37705.", "poc": ["https://github.com/zmanda/amanda/security/advisories/GHSA-crrw-v393-h5q3", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33466", "desc": "Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).", "poc": ["https://github.com/H4lo/awesome-IoT-security-article", "https://github.com/ShielderSec/poc", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/v3gahax/CVE-2023-33466"]}, {"cve": "CVE-2023-38863", "desc": "An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt.", "poc": ["https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject4"]}, {"cve": "CVE-2023-2087", "desc": "The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to change plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/izj007/wechat", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-27985", "desc": "emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-5847", "desc": "Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileges on Windows and Linux hosts.", "poc": ["https://www.tenable.com/security/tns-2023-37"]}, {"cve": "CVE-2023-43875", "desc": "Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail.", "poc": ["https://github.com/sromanhu/CVE-2023-43875-Subrion-CMS-Reflected-XSS---Installation/blob/main/README.md", "https://github.com/sromanhu/Subrion-CMS-Reflected-XSS---Installation/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43875-Subrion-CMS-Reflected-XSS---Installation"]}, {"cve": "CVE-2023-1373", "desc": "The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting", "poc": ["https://wpscan.com/vulnerability/fa38f3e6-e04c-467c-969b-0f6736087589"]}, {"cve": "CVE-2023-29528", "desc": "XWiki Commons are technical libraries common to several other top level XWiki projects. The \"restricted\" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this \"restricted\" mode for security is vulnerable to JavaScript injection (\"cross-site scripting\"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version including the fix.", "poc": ["https://jira.xwiki.org/browse/XWIKI-20348"]}, {"cve": "CVE-2023-5823", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <=\u00a02.2.11 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4442", "desc": "A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been rated as critical. This issue affects some unknown processing of the file \\vm\\patient\\booking-complete.php. The manipulation of the argument userid/apponum/scheduleid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237563.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45838", "desc": "Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `aufs` package.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844"]}, {"cve": "CVE-2023-29726", "desc": "The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty data into the application's database. When the application starts, it loads the data from the database into memory. Once the attacker injects too much data, the application triggers an OOM error and crashes, resulting in a persistent denial of service.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29726/CVE%20detail.md"]}, {"cve": "CVE-2023-40214", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Vathemes Business Pro theme <= 1.10.4 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41580", "desc": "Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.", "poc": ["https://github.com/ehtec/phpipam-exploit", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1872", "desc": "A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation.The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered.We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.", "poc": ["http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html"]}, {"cve": "CVE-2023-45245", "desc": "Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 36119.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43765", "desc": "Certain WithSecure products allow Denial of Service in the aeelf component. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1494", "desc": "A vulnerability classified as critical has been found in IBOS 4.5.5. Affected is an unknown function of the file ApiController.php. The manipulation of the argument emailids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223380.", "poc": ["https://gitee.com/cui-yiwei/cve-number/blob/master/images/IBOS%20oa%20v4.5.5.md/1.md"]}, {"cve": "CVE-2023-39741", "desc": "lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.", "poc": ["https://gist.github.com/huanglei3/ec9090096aa92445cf0a8baa8e929084", "https://github.com/ckolivas/lrzip/issues/246", "https://github.com/huanglei3/lrzip_poc/tree/main/lrzip_heap_overflow"]}, {"cve": "CVE-2023-33317", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Returns and Warranty Requests plugin <=\u00a02.1.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27783", "desc": "An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugins.c.", "poc": ["https://github.com/appneta/tcpreplay/issues/780", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Marsman1996/pocs"]}, {"cve": "CVE-2023-52032", "desc": "TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via the \"main\" function.", "poc": ["https://815yang.github.io/2023/12/24/cve6/EX1200T_V4.1.2cu.5232_B20210713_downloadFlile/"]}, {"cve": "CVE-2023-48123", "desc": "An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file.", "poc": ["https://github.com/NHPT/CVE-2023-48123", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2100", "desc": "A vulnerability classified as problematic was found in SourceCodester Vehicle Service Management System 1.0. This vulnerability affects unknown code of the file /admin/report/index.php. The manipulation of the argument date_end leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226108.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-30703", "desc": "Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21849", "desc": "Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications DBA accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-21917", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-24028", "desc": "In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.", "poc": ["https://github.com/sixgroup-security/CVE"]}, {"cve": "CVE-2023-35157", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.", "poc": ["https://jira.xwiki.org/browse/XWIKI-20339"]}, {"cve": "CVE-2023-1478", "desc": "The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path traversal vulnerability in the page cache module.", "poc": ["https://wpscan.com/vulnerability/512a9ba4-01c0-4614-a991-efdc7fe51abe", "https://github.com/ARPSyndicate/cvemon", "https://github.com/afine-com/research"]}, {"cve": "CVE-2023-1461", "desc": "A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection. The attack can be initiated remotely. VDB-223306 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-21853", "desc": "Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Synchronization). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-6875", "desc": "The POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover.", "poc": ["http://packetstormsecurity.com/files/176525/WordPress-POST-SMTP-Mailer-2.8.7-Authorization-Bypass-Cross-Site-Scripting.html", "https://github.com/UlyssesSaicha/CVE-2023-6875", "https://github.com/gbrsh/CVE-2023-6875", "https://github.com/hatlesswizard/CVE-2023-6875", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5421", "desc": "An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25751", "desc": "Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.", "poc": ["https://github.com/googleprojectzero/fuzzilli", "https://github.com/zhangjiahui-buaa/MasterThesis"]}, {"cve": "CVE-2023-2928", "desc": "A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file uploads/dede/article_allowurl_edit.php. The manipulation of the argument allurls leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230083.", "poc": ["https://vuldb.com/?id.230083", "https://github.com/CN016/DedeCMS-getshell-CVE-2023-2928-", "https://github.com/Threekiii/Awesome-POC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5476", "desc": "Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39171", "desc": "SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.", "poc": ["https://seclists.org/fulldisclosure/2023/Nov/2"]}, {"cve": "CVE-2023-0399", "desc": "The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/702d7bbe-93cc-4bc2-b41d-cb66e08c99a7"]}, {"cve": "CVE-2023-20124", "desc": "A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device. Cisco has not released software updates that address this vulnerability.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/fxc233/iot-vul"]}, {"cve": "CVE-2023-28352", "desc": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery system, an attacker-controlled artificial Student Console can connect to and attack a Teacher Console even after Enhanced Security Mode has been enabled.", "poc": ["https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/", "https://research.nccgroup.com/?research=Technical%20advisories"]}, {"cve": "CVE-2023-37794", "desc": "WAYOS FBM-291W 19.09.11V was discovered to contain a command injection vulnerability via the component /upgrade_filter.asp.", "poc": ["https://github.com/PwnYouLin/IOT_vul/tree/main/wayos/1", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32351", "desc": "A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to gain elevated privileges.", "poc": ["https://github.com/ycdxsb/ycdxsb"]}, {"cve": "CVE-2023-45643", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <=\u00a01.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26750", "desc": "** DISPUTED ** SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework.", "poc": ["https://github.com/yiisoft/yii2/issues/19755", "https://github.com/yiisoft/yii2/issues/19755#issuecomment-1426155955", "https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505390813", "https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505560351"]}, {"cve": "CVE-2023-37809", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/TraiLeR2/Unquoted-Service-Path-in-the-Wondershare-Dr.Fone-13.1.5"]}, {"cve": "CVE-2023-44229", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny Carousel Horizontal Slider plugin <=\u00a08.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22477", "desc": "Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`. This issue was patched in #940. As a workaround, users can disable subscriptions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/alopresto/epss_api_demo", "https://github.com/alopresto6m/epss_api_demo"]}, {"cve": "CVE-2023-2591", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.", "poc": ["https://huntr.dev/bounties/705f79f4-f5e3-41d7-82a5-f00441cd984b", "https://github.com/mnqazi/CVE-2023-2591", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5458", "desc": "The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.", "poc": ["https://wpscan.com/vulnerability/47d15f1c-b9ca-494d-be8f-63c30e92f9b8"]}, {"cve": "CVE-2023-21295", "desc": "In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3986", "desc": "A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=user/list. The manipulation of the argument First Name/Last Name/Username leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235607.", "poc": ["https://github.com/draco1725/POC/blob/main/Exploit/Simple%20Online%20Men's%20Salon%20Management%20System/Stored%20XSS"]}, {"cve": "CVE-2023-27415", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themeqx LetterPress plugin <=\u00a01.1.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32235", "desc": "Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.", "poc": ["https://github.com/VEEXH/Ghost-Path-Traversal-CVE-2023-32235-", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6398", "desc": "A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1,NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6720", "desc": "An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on the server, due to the lack of proper sanitisation of field elements, allowing the attacker to trigger the malicious payload when the application loads.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0679", "desc": "A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file removeUser.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220220.", "poc": ["https://vuldb.com/?id.220220"]}, {"cve": "CVE-2023-24039", "desc": "** UNSUPPORTED WHEN ASSIGNED ** A stack-based buffer overflow in ParseColors in libXm in Common Desktop Environment 1.6 can be exploited by local low-privileged users via the dtprintinfo setuid binary to escalate their privileges to root on Solaris 10 systems. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/hnsecurity/vulns/blob/main/HNS-2022-01-dtprintinfo.txt", "https://security.humanativaspa.it/nothing-new-under-the-sun/", "https://github.com/0xdea/advisories", "https://github.com/0xdea/exploits", "https://github.com/ARPSyndicate/cvemon", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hnsecurity/vulns"]}, {"cve": "CVE-2023-34043", "desc": "VMware Aria Operations contains a local privilege escalation vulnerability.\u00a0A malicious actor with administrative access to the local system can escalate privileges to 'root'.", "poc": ["https://github.com/thiscodecc/thiscodecc"]}, {"cve": "CVE-2023-35155", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). For instance, the following URL execute an `alter` on the browser: `/xwiki/bin/view/Main/?viewer=share&send=1&target=&target=%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Crenniepak%40intigriti.me%3E&includeDocument=inline&message=I+wanted+to+share+this+page+with+you.`, where `` is the URL of your XWiki installation. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8.", "poc": ["https://jira.xwiki.org/browse/XWIKI-20370"]}, {"cve": "CVE-2023-4571", "desc": "In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute (ANSI) escape codes into Splunk ITSI log files that, when a vulnerable terminal application reads them, can run malicious code in the vulnerable application. This attack requires a user to use a terminal application that translates ANSI escape codes to read the malicious log file locally in the vulnerable terminal. The vulnerability also requires additional user interaction to succeed. The vulnerability does not directly affect Splunk ITSI. The indirect impact on Splunk ITSI can vary significantly depending on the permissions in the vulnerable terminal application, as well as where and how the user reads the malicious log file. For example, users can copy the malicious file from Splunk ITSI and read it on their local machine.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0364", "desc": "The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/e56759ae-7530-467a-b9ba-e9a404afb872"]}, {"cve": "CVE-2023-4646", "desc": "The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/c34f8dcc-3be6-44ad-91a4-7c3a0ce2f9d7"]}, {"cve": "CVE-2023-37766", "desc": "GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_isom_remove_user_data function at /lib/libgpac.so.", "poc": ["https://github.com/gpac/gpac/issues/2516"]}, {"cve": "CVE-2023-35873", "desc": "The\u00a0Runtime Workbench (RWB) of SAP NetWeaver Process Integration\u00a0- version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to\u00a0sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-23547", "desc": "A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1695"]}, {"cve": "CVE-2023-39472", "desc": "Inductive Automation Ignition SimpleXMLReader XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability.The specific flaw exists within the SimpleXMLReader class. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the SYSTEM.. Was ZDI-CAN-17571.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47094", "desc": "A Stored Cross-Site Scripting (XSS) vulnerability in the Account Plans tab of System Settings in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Plan name field while editing Account plan details.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2579", "desc": "The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin", "https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe", "https://github.com/0xn4d/poc-cve-xss-inventory-press-plugin", "https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-28201", "desc": "This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4. A remote user may be able to cause unexpected app termination or arbitrary code execution.", "poc": ["https://github.com/dlehgus1023/dlehgus1023"]}, {"cve": "CVE-2023-2035", "desc": "A vulnerability has been found in Campcodes Video Sharing Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file signup.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225913 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.225913"]}, {"cve": "CVE-2023-20158", "desc": "Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sg-web-multi-S9g4Nkgv"]}, {"cve": "CVE-2023-1500", "desc": "A vulnerability, which was classified as problematic, has been found in code-projects Simple Art Gallery 1.0. Affected by this issue is some unknown functionality of the file adminHome.php. The manipulation of the argument about_info leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223400.", "poc": ["https://github.com/Decemberus/BugHub"]}, {"cve": "CVE-2023-36370", "desc": "An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/Sedar2024/Sedar"]}, {"cve": "CVE-2023-48184", "desc": "QuickJS before 7414e5f has a quickjs.h JS_FreeValueRT use-after-free because of incorrect garbage collection of async functions with closures.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31726", "desc": "AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information.", "poc": ["https://github.com/J6451/CVE-2023-31726", "https://github.com/J6451/CVE-2023-31726", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4956", "desc": "A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected that the config-editor page is vulnerable to clickjacking. This flaw allows an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42753", "desc": "An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.", "poc": ["http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html", "https://seclists.org/oss-sec/2023/q3/216", "https://www.openwall.com/lists/oss-security/2023/09/22/10", "https://github.com/EGI-Federation/SVG-advisories"]}, {"cve": "CVE-2023-32267", "desc": "A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2734", "desc": "The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-4145", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.", "poc": ["https://huntr.dev/bounties/ce852777-2994-40b4-bb4e-c4d10023eeb0", "https://github.com/miguelc49/CVE-2023-4145-1", "https://github.com/miguelc49/CVE-2023-4145-2", "https://github.com/miguelc49/CVE-2023-4145-3", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-44326", "desc": "Adobe Dimension versions 3.4.9 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36351", "desc": "An issue in Viatom Health ViHealth for Android v.2.74.58 and before allows a remote attacker to execute arbitrary code via the com.viatom.baselib.mvvm.webWebViewActivity component.", "poc": ["https://github.com/actuator/cve"]}, {"cve": "CVE-2023-0003", "desc": "A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.", "poc": ["https://github.com/jeremymonk21/Vulnerability-Management-and-SIEM-Implementation-Project"]}, {"cve": "CVE-2023-38175", "desc": "Microsoft Windows Defender Elevation of Privilege Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21742", "desc": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ohnonoyesyes/CVE-2023-21742"]}, {"cve": "CVE-2023-33900", "desc": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4388", "desc": "The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/4086b62c-c527-4721-af63-7f2687c98648"]}, {"cve": "CVE-2023-46916", "desc": "Maxima Max Pro Power 1.0 486A devices allow BLE traffic replay. An attacker can use GATT characteristic handle 0x0012 to perform potentially disruptive actions such as starting a Heart Rate monitor.", "poc": ["http://packetstormsecurity.com/files/175660"]}, {"cve": "CVE-2023-49964", "desc": "An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.", "poc": ["https://github.com/mbadanoiu/CVE-2023-49964", "https://github.com/mbadanoiu/CVE-2023-49964", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-51407", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Rocket Elements Split Test For Elementor.This issue affects Split Test For Elementor: from n/a through 1.6.9.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6268", "desc": "The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/15b9ab48-c038-4f2e-b823-1e374baae985"]}, {"cve": "CVE-2023-40534", "desc": "When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45152", "desc": "Engelsystem is a shift planning system for chaos events. A Blind SSRF in the \"Import schedule\" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.", "poc": ["https://github.com/engelsystem/engelsystem/security/advisories/GHSA-jj9g-75wf-6ppf", "https://github.com/sev-hack/sev-hack"]}, {"cve": "CVE-2023-0604", "desc": "The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/4492b5ad-c339-47f5-9003-a9c5f23efdd9"]}, {"cve": "CVE-2023-50017", "desc": "Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup", "poc": ["https://github.com/849200701/cms/blob/main/CSRF%20exists%20in%20the%20backup%20and%20restore%20location.md"]}, {"cve": "CVE-2023-51791", "desc": "Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias_map.", "poc": ["https://ffmpeg.org/", "https://trac.ffmpeg.org/ticket/10738"]}, {"cve": "CVE-2023-24364", "desc": "Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under the Admin Panel.", "poc": ["https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip"]}, {"cve": "CVE-2023-41844", "desc": "A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.4 allows attacker to execute unauthorized code or commands via crafted HTTP requests in capture traffic endpoint.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0244", "desc": "A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \\App\\Manage\\Controller\\KefuController.class.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218152.", "poc": ["https://github.com/yeyinshi/tuzicms/issues/13", "https://vuldb.com/?id.218152"]}, {"cve": "CVE-2023-6623", "desc": "The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.", "poc": ["https://wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3/", "https://wpscan.com/vulnerability/633c28e0-0c9e-4e68-9424-55c32789b41f"]}, {"cve": "CVE-2023-35856", "desc": "A buffer overflow in Nintendo Mario Kart Wii RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code on a client's machine via a crafted packet.", "poc": ["https://github.com/MikeIsAStar/Mario-Kart-Wii-Remote-Code-Execution"]}, {"cve": "CVE-2023-2771", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Online Exam System 1.0. This issue affects some unknown processing of the file /jurusanmatkul/data. The manipulation of the argument columns[1][data] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229277 was assigned to this vulnerability.", "poc": ["https://github.com/tht1997/CVE_2023/blob/main/online_exam/kelasdosen.md", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-0170", "desc": "The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/19ee5e33-acc8-40c5-8f54-c9cb0fa491f0"]}, {"cve": "CVE-2023-43470", "desc": "SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component.", "poc": ["https://github.com/ae6e361b/Online-Voting-System"]}, {"cve": "CVE-2023-7026", "desc": "A vulnerability was found in Lightxun IPTV Gateway up to 20231208. It has been rated as problematic. This issue affects some unknown processing of the file /ZHGXTV/index.php/admin/index/web_upload_template.html. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248579.", "poc": ["https://github.com/willchen0011/cve/blob/main/upload2.md"]}, {"cve": "CVE-2023-49074", "desc": "A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1982", "desc": "The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/51987966-8007-4e12-bc2e-997b92054739"]}, {"cve": "CVE-2023-1589", "desc": "A vulnerability has been found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This vulnerability affects the function exec of the file admin/operations/approve_delete.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223654 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-29543", "desc": "An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.", "poc": ["https://github.com/googleprojectzero/fuzzilli", "https://github.com/zhangjiahui-buaa/MasterThesis"]}, {"cve": "CVE-2023-23934", "desc": "Werkzeug is a comprehensive WSGI web application library. Browsers may allow \"nameless\" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/HotDB-Community/HotDB-Engine", "https://github.com/SenhorDosSonhos1/projeto-voluntario-lacrei"]}, {"cve": "CVE-2023-49874", "desc": "Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a\u00a0guest to update the tasks of a private playbook run if they know the run ID.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40857", "desc": "Buffer Overflow vulnerability in VirusTotal yara v.4.3.2 allows a remote attacker to execute arbtirary code via the yr_execute_cod function in the exe.c component.", "poc": ["https://github.com/VirusTotal/yara/issues/1945"]}, {"cve": "CVE-2023-38770", "desc": "SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-0166", "desc": "The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/f5d43062-4ef3-4dd1-b916-0127f0016f5c"]}, {"cve": "CVE-2023-22018", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.46 and Prior to 7.0.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-39289", "desc": "A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A successful exploit could allow an attacker to access system information.", "poc": ["https://github.com/SYNgularity1/mitel-exploits"]}, {"cve": "CVE-2023-38296", "desc": "Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances they are leaked by a high-privilege process and can be obtained indirectly. The software build fingerprints for each confirmed vulnerable device are as follows: TCL 30Z (TCL/4188R/Jetta_ATT:12/SP1A.210812.016/LV8E:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU5P:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU61:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU66:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU68:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6P:user/release-keys, and TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6X:user/release-keys) and TCL A3X (TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAAZ:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB3:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB7:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABA:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABM:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABP:user/release-keys, and TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABS:user/release-keys). This malicious app reads from the \"persist.sys.tctPowerIccid\" system property to indirectly obtain the ICCID.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1974", "desc": "Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.", "poc": ["https://huntr.dev/bounties/852781c6-9cc8-4d25-9336-bf3cb8ee3439"]}, {"cve": "CVE-2023-20110", "desc": "A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to read sensitive data on the underlying database.", "poc": ["https://github.com/CVEDB/awesome-cve-repo", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/redfr0g/CVE-2023-20110"]}, {"cve": "CVE-2023-22376", "desc": "** UNSUPPORTED WHEN ASSIGNED ** Reflected cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to inject arbitrary script to inject an arbitrary script. NOTE: This vulnerability only affects products that are no longer supported by the developer.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26987", "desc": "An issue discovered in Konga 0.14.9 allows remote attackers to manipulate user accounts regardless of privilege via crafted POST request.", "poc": ["https://docs.google.com/document/d/14DYoZfKN__As8gBXMFae7wChKJXpmbuUdMn2Gf803Lw", "https://docs.google.com/document/d/14DYoZfKN__As8gBXMFae7wChKJXpmbuUdMn2Gf803Lw/edit"]}, {"cve": "CVE-2023-45480", "desc": "Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the src parameter in the function sub_47D878.", "poc": ["https://github.com/l3m0nade/IOTvul/blob/master/sub_47D878.md"]}, {"cve": "CVE-2023-3917", "desc": "Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/417896"]}, {"cve": "CVE-2023-0321", "desc": "Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.", "poc": ["https://www.hackplayers.com/2023/01/cve-2023-0321-info-sensible-campbell.html"]}, {"cve": "CVE-2023-44218", "desc": "A flaw within the SonicWall NetExtender Pre-Logon feature enables an unauthorized user to gain access to the host Windows operating system with 'SYSTEM' level privileges, leading to a local privilege escalation (LPE) vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5376", "desc": "An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service.\u00a0This issue affects JetNet devices older than firmware version 2024/01.", "poc": ["http://packetstormsecurity.com/files/176550/Korenix-JetNet-Series-Unauthenticated-Access.html", "http://seclists.org/fulldisclosure/2024/Jan/11", "https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/"]}, {"cve": "CVE-2023-22630", "desc": "IzyBat Orange casiers before 20221102_1 allows SQL Injection via a getCasier.php?taille= URI.", "poc": ["https://github.com/orangecertcc/security-research/security/advisories/GHSA-j94f-5cg6-6j9j"]}, {"cve": "CVE-2023-0828", "desc": "Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora FMS v767 version and prior versions on all platforms.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2099", "desc": "A vulnerability classified as problematic has been found in SourceCodester Vehicle Service Management System 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226107.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-39965", "desc": "1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may cause a large amount of information leakage. Version 1.5.0 has a patch for this issue.", "poc": ["https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-85cf-gj29-f555"]}, {"cve": "CVE-2023-0238", "desc": "Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on a victim's device to exploit a peculiarity in an Android function, wherein under certain conditions, the malicious app could dictate the task behaviour of the WARP app.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51486", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27016", "desc": "Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the R7WebsSecurityHandler function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC10/3/3.md"]}, {"cve": "CVE-2023-38823", "desc": "Buffer Overflow vulnerability in Tenda Ac19 v.1.0, AC18, AC9 v.1.0, AC6 v.2.0 and v.1.0 allows a remote attacker to execute arbitrary code via the formSetCfm function in bin/httpd.", "poc": ["https://github.com/nhtri2003gmail/CVE_report/blob/master/CVE-2023-38823.md"]}, {"cve": "CVE-2023-1057", "desc": "A vulnerability was found in SourceCodester Doctors Appointment System 1.0. It has been rated as critical. Affected by this issue is the function edoc of the file login.php. The manipulation of the argument usermail leads to sql injection. VDB-221822 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/10cksYiqiyinHangzhouTechnology/10cksYiqiyinHangzhouTechnology", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-30854", "desc": "AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.", "poc": ["https://github.com/jmrcsnchz/CVE-2023-30854", "https://github.com/jmrcsnchz/CVE-2023-32073", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6808", "desc": "The Booking for Appointments and Events Calendar \u2013 Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41048", "desc": "plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in versions 5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone 6.0.7). There are no known workarounds.", "poc": ["https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-21455", "desc": "Improper authorization implementation in Exynos baseband prior to SMR Mar-2023 Release 1 allows incorrect handling of unencrypted message.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-33566", "desc": "** DISPUTED ** An unauthorized node injection vulnerability has been identified in ROS2 Foxy Fitzroy versions where ROS_VERSION is 2 and ROS_PYTHON_VERSION is 3. This vulnerability could allow a malicious user to inject malicious ROS2 nodes into the system remotely. Once injected, these nodes could disrupt the normal operations of the system or cause other potentially harmful behavior. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/16yashpatel/CVE-2023-33566", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2023-33566"]}, {"cve": "CVE-2023-0520", "desc": "The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin, furthermore lack of csrf protection means an attacker can trick a logged in admin to perform the attack by submitting a hidden form.", "poc": ["https://wpscan.com/vulnerability/be4f7ff9-af79-477b-9f47-e40e25a3558e"]}, {"cve": "CVE-2023-3044", "desc": "An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code.This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate.", "poc": ["https://github.com/baker221/poc-xpdf", "https://github.com/baker221/poc-xpdf"]}, {"cve": "CVE-2023-36858", "desc": "An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured server list.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "poc": ["https://github.com/piuppi/Proof-of-Concepts"]}, {"cve": "CVE-2023-0380", "desc": "The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/3256e090-1131-459d-ade5-f052cd5d189f"]}, {"cve": "CVE-2023-52043", "desc": "An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Passwords (WPA-PSK) allowing an attacker to gain unauthorized network access via weak authentication controls.", "poc": ["https://exploots.github.io/posts/2024/01/18/d-link-covr-1102-vulnerability.html"]}, {"cve": "CVE-2023-46582", "desc": "SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.php component.", "poc": ["https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46582-Code-Projects-Inventory-Management-1.0-SQL-Injection-Vulnerability.md", "https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0"]}, {"cve": "CVE-2023-33659", "desc": "A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nmq_subinfo_decode() in the file mqtt_parser.c. An attacker could exploit this vulnerability to cause a denial of service attack.", "poc": ["https://github.com/emqx/nanomq/issues/1154"]}, {"cve": "CVE-2023-21967", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-2150", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Task Reminder System 1.0. This issue affects some unknown processing of the file Master.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226271.", "poc": ["https://youtu.be/o46oHLvY2-E"]}, {"cve": "CVE-2023-36459", "desc": "Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25171", "desc": "Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.", "poc": ["https://huntr.dev/bounties/3b712cb6-3fa3-4f71-8562-7a7016c6262e"]}, {"cve": "CVE-2023-3737", "desc": "Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49382", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.", "poc": ["https://github.com/cui2shark/cms/blob/main/CSRF%20exists%20at%20the%20deletion%20point%20of%20the%20custom%20table.md"]}, {"cve": "CVE-2023-35971", "desc": "A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to\u00a0conduct a stored cross-site scripting (XSS) attack against a\u00a0user of the interface. A successful exploit could\u00a0allow an attacker to execute arbitrary script code in a\u00a0victim's browser in the context of the affected interface.", "poc": ["https://github.com/123ojp/123ojp"]}, {"cve": "CVE-2023-32020", "desc": "Windows DNS Spoofing Vulnerability", "poc": ["https://github.com/em1ga3l/cve-msrc-extractor"]}, {"cve": "CVE-2023-4183", "desc": "A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file edit_update.php of the component Password Handler. The manipulation of the argument user_id leads to improper access controls. The attack can be initiated remotely. VDB-236218 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.236218"]}, {"cve": "CVE-2023-36846", "desc": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrityfor a certain\u00a0part of the\u00a0file system, which may allow chaining to other vulnerabilities.This issue affects Juniper Networks Junos OS on SRX Series: * All versions prior to 20.4R3-S8; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2-S1, 22.4R3.", "poc": ["http://packetstormsecurity.com/files/174397/Juniper-JunOS-SRX-EX-Remote-Code-Execution.html", "https://github.com/Chocapikk/CVE-2023-36846", "https://github.com/Dreamy-elfland/CVE-2023-36846", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/devmehedi101/bugbounty-CVE-Report", "https://github.com/iveresk/CVE-2023-36845-6-", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/r3dcl1ff/CVE-2023-36844_Juniper_RCE", "https://github.com/securi3ytalent/bugbounty-CVE-Report", "https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844"]}, {"cve": "CVE-2023-34235", "desc": "Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to another table they want to query, the query changes from `password` to `t1.password`. `password` is protected by filtering protections but `t1.password` is not protected. This can lead to filtering attacks on everything related to the object again, including admin passwords and reset-tokens. Version 4.10.8 fixes this issue.", "poc": ["https://github.com/strapi/strapi/releases/tag/v4.10.8", "https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f"]}, {"cve": "CVE-2023-32666", "desc": "On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1493", "desc": "A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been rated as problematic. This issue affects the function 0x220019 in the library MaxProctetor64.sys of the component IoControlCode Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223379.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1493", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-33534", "desc": "A Cross-Site Request Forgery (CSRF) in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G_3.11.6 allows attackers to takeover user accounts via sending a crafted POST request to /goform/goform_set_cmd_process.", "poc": ["https://rodelllemit.medium.com/cve-2023-33534-account-takeover-through-csrf-vulnerability-461de6f1b696", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34916", "desc": "Fuge CMS v1.0 contains an Open Redirect vulnerability via /front/ProcessAct.java.", "poc": ["https://github.com/fuge/cms/issues/4"]}, {"cve": "CVE-2023-21925", "desc": "Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Health Sciences InForm. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Health Sciences InForm. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-2967", "desc": "The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/9afec4aa-1210-4c40-b566-64e37acf2b64"]}, {"cve": "CVE-2023-41692", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hennessey Digital Attorney theme <=\u00a03 theme.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24799", "desc": "D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_48AF78 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/D-link/blob/main/Dir878/1/1.md"]}, {"cve": "CVE-2023-1004", "desc": "A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-221737 was assigned to this vulnerability.", "poc": ["https://github.com/marktext/marktext/issues/3575", "https://github.com/ARPSyndicate/cvemon", "https://github.com/liyansong2018/CVE"]}, {"cve": "CVE-2023-28501", "desc": "Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a heap-based buffer overflow in the unirpcd daemon that, if successfully exploited, can lead to remote code execution as the root user.", "poc": ["https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed/"]}, {"cve": "CVE-2023-29827", "desc": "** DISPUTED ** ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.", "poc": ["https://github.com/mde/ejs/issues/720"]}, {"cve": "CVE-2023-2872", "desc": "A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0. This affects the function 0x220088 in the library fusbhub.sys of the component IoControlCode Handler. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229851. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2872", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-39615", "desc": "** DISPUTED ** Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.", "poc": ["https://gitlab.gnome.org/GNOME/libxml2/-/issues/535", "https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2023-22051", "desc": "Vulnerability in the Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: GraalVM Compiler). Supported versions that are affected are Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-45770", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fastwpspeed Fast WP Speed plugin <=\u00a01.0.0 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-44020", "desc": "Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.", "poc": ["https://github.com/aixiao0621/Tenda/blob/main/AC10U/9/0.md", "https://github.com/aixiao0621/Tenda"]}, {"cve": "CVE-2023-38836", "desc": "File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.", "poc": ["http://packetstormsecurity.com/files/175026/BoidCMS-2.0.0-Shell-Upload.html", "https://github.com/1337kid/CVE-2023-38836", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2789", "desc": "A vulnerability was found in GNU cflow 1.7. It has been rated as problematic. This issue affects the function func_body/parse_variable_declaration of the file parser.c. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier VDB-229373 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/DaisyPo/fuzzing-vulncollect/blob/main/cflow/stack-overflow/parser.c/README.md", "https://github.com/DaisyPo/fuzzing-vulncollect/files/11343936/poc-file.zip", "https://vuldb.com/?id.229373"]}, {"cve": "CVE-2023-29159", "desc": "Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.", "poc": ["https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px", "https://github.com/andersonloyem/magui"]}, {"cve": "CVE-2023-28321", "desc": "An improper certificate validation vulnerability exists in curl b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00RSP: 0018:ffffc900043473d0 EFLAGS: 00010202RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070RBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffffR10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046FS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace:udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120skb_mac_gso_segment+0x290/0x610 net/core/gso.c:53__skb_gso_segment+0x339/0x710 net/core/gso.c:124skb_gso_segment include/net/gso.h:83 [inline]validate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626__dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338dev_queue_xmit include/linux/netdevice.h:3134 [inline]packet_xmit+0x257/0x380 net/packet/af_packet.c:276packet_snd net/packet/af_packet.c:3087 [inline]packet_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119sock_sendmsg_nosec net/socket.c:730 [inline]__sock_sendmsg+0xd5/0x180 net/socket.c:745__sys_sendto+0x255/0x340 net/socket.c:2190__do_sys_sendto net/socket.c:2202 [inline]__se_sys_sendto net/socket.c:2198 [inline]__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198do_syscall_x64 arch/x86/entry/common.c:52 [inline]do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83entry_SYSCALL_64_after_hwframe+0x63/0x6bRIP: 0033:0x7f8692032aa9Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007fff8d685418 EFLAGS: 00000246 ORIG_RAX: 000000000000002cRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9RDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003RBP: 00000000000f4240 R08: 0000000020000540 R09: 0000000000000014R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480R13: 0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003 Modules linked in:---[ end trace 0000000000000000 ]---RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00RSP: 0018:ffffc900043473d0 EFLAGS: 00010202RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070RBP: ffffc90004347578 R0---truncated---", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32782", "desc": "A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35080", "desc": "A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to various security risks, including the escalation of privileges, denial of service, or information disclosure.", "poc": ["https://github.com/HopHouse/Ivanti-Pulse_VPN-Client_Exploit-CVE-2023-35080_Privilege-escalation", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-49954", "desc": "The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address.", "poc": ["https://github.com/CVE-2023-49954/CVE-2023-49954.github.io", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-33148", "desc": "Microsoft Office Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/173591/Microsoft-Office-365-18.2305.1222.0-Remote-Code-Execution.html"]}, {"cve": "CVE-2023-52605", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41557", "desc": "Tenda AC7 V1.0 V15.03.06.44 and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter entrys and mitInterface at url /goform/addressNat.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/sinemsahn/Public-CVE-Analysis"]}, {"cve": "CVE-2023-5916", "desc": "A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-244305 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2582", "desc": "A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built with Strikingly. The vulnerability exists because of Strikingly JavaScript library parsing the URL fragment allows access to the __proto__ or constructor properties and the Object prototype. By leveraging an embedded gadget like jQuery, an attacker who convinces a victim to visit a specially crafted link could achieve arbitrary javascript execution in the context of the user's browser.", "poc": ["https://www.tenable.com/security/research/tra-2023-18"]}, {"cve": "CVE-2023-47641", "desc": "aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-Length(CL) and Transfer-Encoding(TE) header values are present it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation. A possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. The impact of this vulnerability is that it is possible to bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is present an Open Redirect an attacker could combine it to redirect random users to another website and log the request. This vulnerability has been addressed in release 3.8.0 of aiohttp. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j"]}, {"cve": "CVE-2023-23956", "desc": "A user can supply malicious HTML and JavaScript code that will be executed in the client browser", "poc": ["http://packetstormsecurity.com/files/173038/Symantec-SiteMinder-WebAgent-12.52-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-40814", "desc": "OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.", "poc": ["https://www.esecforte.com/cve-2023-40814-html-injection-accounts/"]}, {"cve": "CVE-2023-31754", "desc": "Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Admin panel.", "poc": ["https://labs.withsecure.com/advisories/optimizely-admin-panel-dom-xss"]}, {"cve": "CVE-2023-40295", "desc": "libboron in Boron 2.0.8 has a heap-based buffer overflow in ur_strInitUtf8 at string.c.", "poc": ["https://github.com/Halcy0nic/CVE-2023-40294-and-CVE-2023-40295", "https://github.com/Halcy0nic/Trophies", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/skinnyrad/Trophies"]}, {"cve": "CVE-2023-51449", "desc": "Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.", "poc": ["https://github.com/nvn1729/advisories"]}, {"cve": "CVE-2023-42387", "desc": "An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function in install.php.", "poc": ["https://github.com/ranhn/TDSQL"]}, {"cve": "CVE-2023-4768", "desc": "A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.pdf.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37361", "desc": "REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization.", "poc": ["https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=32305"]}, {"cve": "CVE-2023-1977", "desc": "The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.", "poc": ["https://wpscan.com/vulnerability/842f3b1f-395a-4ea2-b7df-a36f70e8c790"]}, {"cve": "CVE-2023-45746", "desc": "Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35633", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/176451/Microsoft-Windows-Registry-Predefined-Keys-Privilege-Escalation.html", "https://github.com/myseq/ms_patch_tuesday"]}, {"cve": "CVE-2023-37856", "desc": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem through a configuration dialog within the embedded Qt browser .", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50982", "desc": "Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload_action and edit_action in Admin_SmileysController do not check the file extension. This leads to remote code execution with the privileges of the www-data user. The fixed versions are 5.3.4, 5.2.6, 5.1.7, and 5.0.9.", "poc": ["https://rehmeinfosec.de/labor/cve-2023-50982", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46673", "desc": "It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.", "poc": ["https://www.elastic.co/community/security", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/muneebaashiq/MBProjects"]}, {"cve": "CVE-2023-3980", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.", "poc": ["https://huntr.dev/bounties/6eb3cb9a-5c78-451f-ae76-0b1e62fe5e54"]}, {"cve": "CVE-2023-1586", "desc": "Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the restore process leading to arbitrary file creation. The issue was fixed with Avast and AVG Antivirus version 22.11", "poc": ["https://support.norton.com/sp/static/external/tools/security-advisories.html"]}, {"cve": "CVE-2023-26938", "desc": "** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2019-9587. Reason: This record is a reservation duplicate of CVE-2019-9587. Notes: All CVE users should reference CVE-2019-9587 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.", "poc": ["https://github.com/huanglei3/xpdf_heapoverflow/edit/main/Stack_backtracking_readblock"]}, {"cve": "CVE-2023-5891", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.", "poc": ["https://huntr.com/bounties/ce4956e4-9ef5-4e0e-bfb2-481ec5cfb0a5"]}, {"cve": "CVE-2023-24069", "desc": "** DISPUTED ** Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file deletion, an attacker can still recover the file if it was previously replied to in a conversation. (Local filesystem access is needed by the attacker.) NOTE: the vendor disputes the relevance of this finding because the product is not intended to protect against adversaries with this degree of local access.", "poc": ["https://johnjhacking.com/blog/cve-2023-24068-cve-2023-24069/", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2023-2235", "desc": "A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation.The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but\u00a0remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability.We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2.", "poc": ["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fd0815f632c24878e325821943edccc7fde947a2"]}, {"cve": "CVE-2023-41425", "desc": "Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.", "poc": ["https://gist.github.com/prodigiousMind/fc69a79629c4ba9ee88a7ad526043413", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/prodigiousMind/CVE-2023-41425"]}, {"cve": "CVE-2023-49006", "desc": "Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file.", "poc": ["https://github.com/Hebing123/cve/issues/5", "https://huntr.com/bounties/ca6d669f-fd82-4188-aae2-69e08740d982/"]}, {"cve": "CVE-2023-47076", "desc": "Adobe InDesign versions 19.0 (and earlier) and 17.4.2 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49688", "desc": "Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.\u00a0The 'txtUser' parameter of the login.php resource\u00a0does not validate the characters received and they\u00a0are sent unfiltered to the database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30135", "desc": "Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC18/8/8.md"]}, {"cve": "CVE-2023-51701", "desc": "fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in '@fastify/reply-from` version 9.6.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24522", "desc": "Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-27295", "desc": "Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited.", "poc": ["https://www.tenable.com/security/research/tra-2023-8"]}, {"cve": "CVE-2023-52441", "desc": "In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix out of bounds in init_smb2_rsp_hdr()If client send smb2 negotiate request and then send smb1 negotiaterequest, init_smb2_rsp_hdr is called for smb1 negotiate request sinceneed_neg is set to false. This patch ignore smb1 packets after ->need_negis set to false.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1641", "desc": "A vulnerability, which was classified as problematic, has been found in IObit Malware Fighter 9.4.0.776. This issue affects the function 0x222018 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-224021 was assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1641", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-36745", "desc": "Microsoft Exchange Server Remote Code Execution Vulnerability", "poc": ["https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/GhostTroops/TOP", "https://github.com/N1k0la-T/CVE-2023-36745", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/hktalent/TOP", "https://github.com/johe123qwe/github-trending", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sampsonv/github-trending"]}, {"cve": "CVE-2023-38043", "desc": "A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to a denial of service (DoS) condition on the user machine and, in some cases, resulting in a full compromise of the system.", "poc": ["https://northwave-cybersecurity.com/vulnerability-notice/arbitrary-kernel-function-call-in-ivanti-secure-access-client"]}, {"cve": "CVE-2023-41265", "desc": "An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/praetorian-inc/zeroqlik-detect", "https://github.com/whitfieldsdad/cisa_kev"]}, {"cve": "CVE-2023-0791", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-3610", "desc": "A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered.We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.", "poc": ["https://github.com/EGI-Federation/SVG-advisories"]}, {"cve": "CVE-2023-39110", "desc": "rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.", "poc": ["https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_%20ajaxGetFileByPath.md", "https://github.com/zer0yu/CVE_Request"]}, {"cve": "CVE-2023-40656", "desc": "A reflected XSS vulnerability was discovered in the Quickform component for Joomla.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28627", "desc": "pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/pymedusa/Medusa/security/advisories/GHSA-6589-x6f5-cgg9"]}, {"cve": "CVE-2023-0331", "desc": "The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.", "poc": ["https://wpscan.com/vulnerability/1b4dbaf3-1364-4103-9a7b-b5a1355c685b"]}, {"cve": "CVE-2023-2603", "desc": "A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.", "poc": ["https://github.com/kholia/chisel-examples"]}, {"cve": "CVE-2023-39966", "desc": "1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.", "poc": ["https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-hf7j-xj3w-87g4"]}, {"cve": "CVE-2023-5078", "desc": "A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-37973", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in David Pokorny Replace Word plugin <=\u00a02.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21981", "desc": "Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-45230", "desc": "EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.", "poc": ["http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/quarkslab/pixiefail"]}, {"cve": "CVE-2023-50311", "desc": "IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. IBM X-Force ID: 273612.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38571", "desc": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to bypass Privacy preferences.", "poc": ["https://github.com/Siguza/ios-resources", "https://github.com/gergelykalman/CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV", "https://github.com/houjingyi233/macOS-iOS-system-security", "https://github.com/jp-cpe/retrieve-cvss-scores", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-42647", "desc": "In Ifaa service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49068", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1.Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47171", "desc": "An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1869"]}, {"cve": "CVE-2023-43573", "desc": "A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-5181", "desc": "The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/564ad2b0-6ba6-4415-98d7-8d41bc1c3d44"]}, {"cve": "CVE-2023-47471", "desc": "Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_header function in the slice.cc component.", "poc": ["https://github.com/strukturag/libde265/issues/426"]}, {"cve": "CVE-2023-29571", "desc": "Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c. This vulnerability can lead to a Denial of Service (DoS).", "poc": ["https://github.com/cesanta/mjs/issues/241", "https://github.com/z1r00/fuzz_vuln/blob/main/mjs/SEGV/mjs_gc/readme.md", "https://github.com/z1r00/fuzz_vuln"]}, {"cve": "CVE-2023-33469", "desc": "In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 can be exploited to achieve local code execution at the root level.", "poc": ["https://github.com/Sharpe-nl/CVEs"]}, {"cve": "CVE-2023-50363", "desc": "An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.6.2722 build 20240402 and laterQuTS hero h5.1.6.2734 build 20240414 and later", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40843", "desc": "Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function \"sub_73004.\"", "poc": ["https://github.com/XYIYM/Digging/blob/main/Tenda/AC6/bof/8/8.md"]}, {"cve": "CVE-2023-43241", "desc": "D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity.", "poc": ["https://github.com/peris-navince/founded-0-days/blob/main/Dlink/823G/SetWLanRadioSecurity/1.md"]}, {"cve": "CVE-2023-32707", "desc": "In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the \u2018edit_user\u2019 capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.", "poc": ["http://packetstormsecurity.com/files/174602/Splunk-Enterprise-Account-Takeover.html", "http://packetstormsecurity.com/files/175386/Splunk-edit_user-Capability-Privilege-Escalation.html", "https://github.com/9xN/CVE-2023-32707", "https://github.com/LoanVitor/Splunk-9.0.5---admin-account-take-over", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/redwaysecurity/CVEs"]}, {"cve": "CVE-2023-45253", "desc": "An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privileges via RollingFileAppender.DeleteFile method performed by the log4net library.", "poc": ["https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253/"]}, {"cve": "CVE-2023-31701", "desc": "TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceRemove.", "poc": ["https://github.com/FirmRec/IoT-Vulns/blob/main/tp-link/postPlcJson/report.md"]}, {"cve": "CVE-2023-1414", "desc": "The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours", "poc": ["https://wpscan.com/vulnerability/d61d4be7-9251-4c62-8fb7-8a456aa6969e"]}, {"cve": "CVE-2023-22603", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/13579and2468/Wei-fuzz"]}, {"cve": "CVE-2023-22604", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/13579and2468/Wei-fuzz"]}, {"cve": "CVE-2023-38622", "desc": "Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `len` array.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6064", "desc": "The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur.", "poc": ["https://wpscan.com/vulnerability/423c8881-628b-4380-9677-65b3f5165efe"]}, {"cve": "CVE-2023-45797", "desc": "A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27482", "desc": "homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected. The issue has been mitigated and closed in Supervisor version 2023.03.1, which has been rolled out to all affected installations via the auto-update feature of the Supervisor. This rollout has been completed at the time of publication of this advisory. Home Assistant Core 2023.3.0 included mitigation for this vulnerability. Upgrading to at least that version is thus advised. In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.", "poc": ["https://github.com/elttam/publications/blob/master/writeups/home-assistant/supervisor-authentication-bypass-advisory.md", "https://www.elttam.com/blog/pwnassistant/", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-1598", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.", "poc": ["https://github.com/morpheuslord/CVE-llm_dataset"]}, {"cve": "CVE-2023-6329", "desc": "An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a \"passwordCustom\" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentication and act as an administrative user.", "poc": ["https://tenable.com/security/research/tra-2023-36"]}, {"cve": "CVE-2023-41266", "desc": "A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/praetorian-inc/zeroqlik-detect", "https://github.com/whitfieldsdad/cisa_kev"]}, {"cve": "CVE-2023-31704", "desc": "Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the administrator's role.", "poc": ["https://github.com/d34dun1c02n/CVE-2023-31704", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-34366", "desc": "A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause memory corruption, resulting in arbitrary code execution. Victim would need to open a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1758", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1758"]}, {"cve": "CVE-2023-38585", "desc": "Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34736", "desc": "Guantang Equipment Management System version 4.12 is vulnerable to Arbitrary File Upload.", "poc": ["https://github.com/prismbreak/vulnerabilities/issues/5"]}, {"cve": "CVE-2023-28106", "desc": "Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.", "poc": ["https://huntr.dev/bounties/fa77d780-9b23-404b-8c44-12108881d11a"]}, {"cve": "CVE-2023-4534", "desc": "A vulnerability, which was classified as problematic, was found in NeoMind Fusion Platform up to 20230731. Affected is an unknown function of the file /fusion/portal/action/Link. The manipulation of the argument link leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238026 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.238026"]}, {"cve": "CVE-2023-3243", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hashand utilize it to create new sessions. The hash is also a poorly salted MD5hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X.\u00a0Recommended fix: Upgrade to a supported product suchas AlertonACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded.", "poc": ["https://www.honeywell.com/us/en/product-security", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1492", "desc": "A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been declared as problematic. This vulnerability affects the function 0x220019 in the library MaxProc64.sys of the component IoControlCode Handler. The manipulation of the argument SystemBuffer leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-223378 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1492", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-21392", "desc": "In Bluetooth, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege when connecting to a Bluetooth device with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38997", "desc": "A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands as root via a crafted ZIP archive.", "poc": ["https://logicaltrust.net/blog/2023/08/opnsense.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49493", "desc": "DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php.", "poc": ["https://github.com/Hebing123/cve/issues/2"]}, {"cve": "CVE-2023-46665", "desc": "Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain unauthorized access to the affected device with administrative privileges.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"]}, {"cve": "CVE-2023-45827", "desc": "Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.", "poc": ["https://github.com/clickbar/dot-diver/security/advisories/GHSA-9w5f-mw3p-pj47", "https://github.com/d3ng03/PP-Auto-Detector", "https://github.com/rscbug/prototype_pollution"]}, {"cve": "CVE-2023-41128", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design WP Roadmap \u2013 Product Feedback Board allows Stored XSS.This issue affects WP Roadmap \u2013 Product Feedback Board: from n/a through 1.0.8.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-3511", "desc": "An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge requests to private projects they're not a member of.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/416961"]}, {"cve": "CVE-2023-28250", "desc": "Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability", "poc": ["https://github.com/BenjiTrapp/cisa-known-vuln-scraper", "https://github.com/BenjiTrapp/cve-prio-marble"]}, {"cve": "CVE-2023-4636", "desc": "The WordPress File Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.", "poc": ["https://github.com/ThatNotEasy/CVE-2023-4636", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-49432", "desc": "Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'deviceList' parameter at /goform/setMacFilterCfg.", "poc": ["https://github.com/ef4tless/vuln/blob/master/iot/AX9/setMacFilterCfg.md"]}, {"cve": "CVE-2023-24625", "desc": "Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference (IDOR) attack.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-37172", "desc": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.", "poc": ["https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_3", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6345", "desc": "Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Threekiii/CVE", "https://github.com/wh1ant/vulnjs", "https://github.com/whitfieldsdad/cisa_kev"]}, {"cve": "CVE-2023-36559", "desc": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24824", "desc": "cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.", "poc": ["https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh"]}, {"cve": "CVE-2023-35191", "desc": "Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of service via network access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33042", "desc": "Transient DOS in Modem after RRC Setup message is received.", "poc": ["https://github.com/AEPP294/5ghoul-5g-nr-attacks", "https://github.com/asset-group/5ghoul-5g-nr-attacks"]}, {"cve": "CVE-2023-49286", "desc": "Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/MegaManSec/Squid-Security-Audit"]}, {"cve": "CVE-2023-39477", "desc": "Inductive Automation Ignition ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Inductive Automation Ignition. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20499.", "poc": ["https://github.com/claroty/opcua-exploit-framework"]}, {"cve": "CVE-2023-51369", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in SysBasics Customize My Account for WooCommerce.This issue affects Customize My Account for WooCommerce: from n/a through 1.8.3.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44854", "desc": "Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the c_set_rslog_decode function in the acu_web file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24402", "desc": "Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Veribo, Roland Murg WP Booking System \u2013 Booking Calendar plugin <= 2.0.18 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/yaudahbanh/CVE-Archive"]}, {"cve": "CVE-2023-33629", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/r1UjggZfh", "https://github.com/20142995/sectool"]}, {"cve": "CVE-2023-3221", "desc": "User enumeration vulnerability in Password Recovery plugin 1.2 version for Roundcube, which could allow a remote attacker to create a test script against the password recovery function to enumerate all users in the database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33313", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <=\u00a01.2.9 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-5484", "desc": "Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29409", "desc": "Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.", "poc": ["https://github.com/mateusz834/CVE-2023-29409", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-43118", "desc": "Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API.", "poc": ["https://github.com/RhinoSecurityLabs/CVEs"]}, {"cve": "CVE-2023-41127", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Evergreen Content Poster Evergreen Content Poster \u2013 Auto Post and Schedule Your Best Content to Social Media allows Stored XSS.This issue affects Evergreen Content Poster \u2013 Auto Post and Schedule Your Best Content to Social Media: from n/a through 1.3.6.1.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-32360", "desc": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to access recently printed documents.", "poc": ["https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-1885", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-2575", "desc": "Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a\u00a0Stack-based Buffer Overflow vulnerability, which can be triggered by authenticated\u00a0users via a crafted POST request.", "poc": ["http://packetstormsecurity.com/files/172307/Advantech-EKI-15XX-Series-Command-Injection-Buffer-Overflow.html", "http://seclists.org/fulldisclosure/2023/May/4", "https://cyberdanube.com/en/multiple-vulnerabilities-in-advantech-eki-15xx-series/"]}, {"cve": "CVE-2023-21825", "desc": "Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Supplier Management). Supported versions that are affected are 12.2.6-12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-20026", "desc": "A vulnerability in the web-based management interface of Cisco Small Business Routers RV042 Series could allow an authenticated, remote attacker to inject arbitrary commands on an affected device.\nThis vulnerability is due to improper validation of user input fields within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device with root-level privileges. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5"]}, {"cve": "CVE-2023-1800", "desc": "A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file /group1/uploa of the component File Upload Handler. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224768.", "poc": ["https://github.com/0day404/vulnerability-poc", "https://github.com/ARPSyndicate/cvemon", "https://github.com/KayCHENvip/vulnerability-poc", "https://github.com/Threekiii/Awesome-POC", "https://github.com/d4n-sec/d4n-sec.github.io"]}, {"cve": "CVE-2023-21746", "desc": "Windows NTLM Elevation of Privilege Vulnerability", "poc": ["https://github.com/0xsyr0/OSCP", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Etoile1024/Pentest-Common-Knowledge", "https://github.com/MarikalAbhijeet/Localpotatoexploit", "https://github.com/Muhammad-Ali007/LocalPotato_CVE-2023-21746", "https://github.com/SirElmard/ethical_hacking", "https://github.com/blu3ming/LocalPotato", "https://github.com/chudamax/LocalPotatoExamples", "https://github.com/decoder-it/LocalPotato", "https://github.com/kgwanjala/oscp-cheatsheet", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/oscpname/OSCP_cheat", "https://github.com/revanmalang/OSCP", "https://github.com/txuswashere/OSCP", "https://github.com/xhref/OSCP"]}, {"cve": "CVE-2023-29766", "desc": "An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29766/CVE%20detailed.md"]}, {"cve": "CVE-2023-40875", "desc": "DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_edit.php via the votename and votenote parameters.", "poc": ["https://github.com/DiliLearngent/BugReport", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26599", "desc": "XSS vulnerability in TripleSign in Tripleplay Platform releases prior to Caveman 3.4.0 allows attackers to inject client-side code to run as an authenticated user via a crafted link.", "poc": ["https://github.com/sT0wn-nl/CVEs"]}, {"cve": "CVE-2023-40114", "desc": "In multiple functions of MtpFfsHandle.cpp , there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-50000", "desc": "Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode.", "poc": ["https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_resetMesh/w30e_resetMesh.md"]}, {"cve": "CVE-2023-52485", "desc": "In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Wake DMCUB before sending a command[Why]We can hang in place trying to send commands when the DMCUB isn'tpowered on.[How]For functions that execute within a DC context or DC lock we canwrap the direct calls to dm_execute_dmub_cmd/list with code thatexits idle power optimizations and reallows once we're done withthe command submission on success.For DM direct submissions the DM will need to manage the enter/exitsequencing manually.We cannot invoke a DMCUB command directly within the DM executionhelper or we can deadlock.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3979", "desc": "An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request\u2019s source branch.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/419972"]}, {"cve": "CVE-2023-0734", "desc": "Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.", "poc": ["https://huntr.dev/bounties/a296324c-6925-4f5f-a729-39b0d73d5b8b"]}, {"cve": "CVE-2023-30702", "desc": "Stack overflow vulnerability in SSHDCPAPP TA prior to "SAMSUNG ELECTONICS, CO, LTD. - System Hardware Update - 7/13/2023" in Windows Update for Galaxy book Go, Galaxy book Go 5G, Galaxy book2 Go and Galaxy book2 Pro 360 allows local attacker to execute arbitrary code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20016", "desc": "A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an unauthenticated attacker with access to a backup file to decrypt sensitive information stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method used for the backup function. An attacker could exploit this vulnerability by leveraging a static key used for the backup configuration feature. A successful exploit could allow the attacker to decrypt sensitive information that is stored in full state and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and other credentials.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/oddrune/cisco-ucs-decrypt"]}, {"cve": "CVE-2023-33090", "desc": "Transient DOS while processing channel information for speaker protection v2 module in ADSP.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4256", "desc": "Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw enables a local attacker to initiate a Denial of Service (DoS) attack.", "poc": ["https://github.com/appneta/tcpreplay/issues/813", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23489", "desc": "The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.", "poc": ["https://www.tenable.com/security/research/tra-2023-2", "https://github.com/ARPSyndicate/cvemon", "https://github.com/ARPSyndicate/kenzer-templates", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-25344", "desc": "An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous function.", "poc": ["https://github.com/node-swig/swig-templates/issues/89", "https://www.gem-love.com/2023/02/01/Swig%E6%A8%A1%E6%9D%BF%E5%BC%95%E6%93%8E0day%E6%8C%96%E6%8E%98-%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E5%92%8C%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/"]}, {"cve": "CVE-2023-0736", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.", "poc": ["https://huntr.dev/bounties/7e6f9614-6a96-4295-83f0-06a240be844e"]}, {"cve": "CVE-2023-4376", "desc": "The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/13910e52-5302-4252-8bee-49dd1f0e180a"]}, {"cve": "CVE-2023-31448", "desc": "A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the HL7 sensor into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2863", "desc": "A vulnerability has been found in Simple Design Daily Journal 1.012.GP.B on Android and classified as problematic. Affected by this vulnerability is an unknown functionality of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229819.", "poc": ["https://www.youtube.com/watch?v=V0u9C5RVSic"]}, {"cve": "CVE-2023-26991", "desc": "SWFTools v0.9.2 was discovered to contain a stack-use-after-scope in the swf_ReadSWF2 function in lib/rfxswf.c.", "poc": ["https://github.com/matthiaskramm/swftools/issues/196"]}, {"cve": "CVE-2023-34840", "desc": "angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.", "poc": ["https://github.com/Xh4H/CVE-2023-34840", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1387", "desc": "Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the \"url_login\" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.", "poc": ["https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j"]}, {"cve": "CVE-2023-4813", "desc": "A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.", "poc": ["https://github.com/adegoodyer/kubernetes-admin-toolkit", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-38543", "desc": "A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to a denial of service (DoS) condition on the user machine.", "poc": ["https://northwave-cybersecurity.com/vulnerability-notice/denial-of-service-in-ivanti-secure-access-client-driver"]}, {"cve": "CVE-2023-2663", "desc": "In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a stack overflow.", "poc": ["https://forum.xpdfreader.com/viewtopic.php?t=42421"]}, {"cve": "CVE-2023-4254", "desc": "The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/0dfffe48-e60d-4bab-b194-8a63554246c3", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27362", "desc": "3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of 3CX. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-20026.", "poc": ["https://github.com/chnzzh/OpenSSL-CVE-lib"]}, {"cve": "CVE-2023-52427", "desc": "** DISPUTED ** In OpenDDS through 3.27, there is a segmentation fault for a DataWriter with a large value of resource_limits.max_samples. NOTE: the vendor's position is that the product is not designed to handle a max_samples value that is too large for the amount of memory on the system.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33883", "desc": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0040", "desc": "Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.", "poc": ["https://github.com/dellalibera/dellalibera"]}, {"cve": "CVE-2023-7053", "desc": "A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/signup.php. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248740.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42501", "desc": "Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations.This issue affects Apache Superset: before 2.1.2.Users should upgrade to version or above 2.1.2 and run `superset init` to reconstruct the Gamma role or remove `can_read` permission from the mentioned resources.", "poc": ["https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-1405", "desc": "The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present.", "poc": ["https://wpscan.com/vulnerability/8c727a31-ff65-4472-8191-b1becc08192a/"]}, {"cve": "CVE-2023-44228", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Onclick show popup plugin <=\u00a08.1 versions.", "poc": ["https://github.com/dcm2406/CVE-Lab", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5561", "desc": "WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack", "poc": ["https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/", "https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441", "https://github.com/JeppW/wpextract", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/pog007/CVE-2023-5561-PoC"]}, {"cve": "CVE-2023-6440", "desc": "A vulnerability was found in SourceCodester Book Borrower System 1.0 and classified as problematic. This issue affects some unknown processing of the file endpoint/add-book.php. The manipulation of the argument Book Title/Book Author leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246443.", "poc": ["https://github.com/lscjl/lsi.webray.com.cn/blob/main/CVE-project/Book%20Borrower%20System%20Cross%20site%20scripting.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39707", "desc": "A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add Expense parameter under the Expense section.", "poc": ["https://github.com/Arajawat007/CVE-2023-39707", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-48882", "desc": "A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Document Properties field at /login.php m=admin&c=Index&a=changeTableVal&_ajax=1&lang=cn.", "poc": ["https://github.com/DiliLearngent/BugReport"]}, {"cve": "CVE-2023-0059", "desc": "The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/5e26c485-9a5a-44a3-95b3-6c063a1c321c"]}, {"cve": "CVE-2023-6105", "desc": "An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.", "poc": ["https://www.tenable.com/security/research/tra-2023-35"]}, {"cve": "CVE-2023-6547", "desc": "Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if the user was once a member of the team, got permissions to the playbook and was then removed from the team.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28329", "desc": "Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/cli-ish/cli-ish", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6768", "desc": "Authentication bypass vulnerability in Amazing Little Poll affecting versions 1.3 and 1.4. This vulnerability could allow an unauthenticated user to access the admin panel without providing any credentials by simply accessing the \"lp_admin.php?adminstep=\" parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38911", "desc": "A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields.", "poc": ["https://github.com/desencrypt/CVE/blob/main/CVE-2023-38911/Readme.md"]}, {"cve": "CVE-2023-40729", "desc": "A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unencrypted communication without HTTPS. An attacker who managed to gain machine-in-the-middle position could manipulate, or steal confidential information.", "poc": ["https://github.com/Hritikpatel/InsecureTrust_Bank", "https://github.com/Hritikpatel/SecureTrust_Bank", "https://github.com/futehc/tust5"]}, {"cve": "CVE-2023-5258", "desc": "A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /resource/addgood.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240867.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45706", "desc": "An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/kaje11/CVEs"]}, {"cve": "CVE-2023-4300", "desc": "The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution.", "poc": ["https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42"]}, {"cve": "CVE-2023-31689", "desc": "In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute scripts to trigger command execution.", "poc": ["https://github.com/vedees/wcms/issues/15"]}, {"cve": "CVE-2023-5350", "desc": "SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.", "poc": ["https://huntr.dev/bounties/c56563cb-b74e-4174-a09a-cd07689d6736", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2612", "desc": "Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).", "poc": ["http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html", "https://ubuntu.com/security/CVE-2023-2612", "https://ubuntu.com/security/notices/USN-6127-1", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-24047", "desc": "An Insecure Credential Management issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via use of weak hashing algorithm.", "poc": ["https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/"]}, {"cve": "CVE-2023-33220", "desc": "During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes to check. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27150", "desc": "openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.", "poc": ["https://www.esecforte.com/cve-2023-27150-cross-site-scripting-xss/"]}, {"cve": "CVE-2023-1640", "desc": "A vulnerability classified as problematic was found in IObit Malware Fighter 9.4.0.776. This vulnerability affects the function 0x222010 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224020.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1640", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-21094", "desc": "In sanitize of LayerState.cpp, there is a possible way to take over the screen display and swap the display content due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-248031255", "poc": ["https://github.com/Trinadh465/frameworks_native_AOSP-10_r33_CVE-2023-21094", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4198", "desc": "Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data", "poc": ["https://starlabs.sg/advisories/23/23-4198"]}, {"cve": "CVE-2023-38590", "desc": "A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A remote user may be able to cause unexpected system termination or corrupt kernel memory.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-7033", "desc": "Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a remote attacker to cause a temporary Denial of Service condition for a certain period of time in Ethernet communication of the products by performing TCP SYN Flood attack.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0273", "desc": "The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/5cafbba6-478f-4f5d-a2d4-60c6a22f2f1e"]}, {"cve": "CVE-2023-25265", "desc": "Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the file system.", "poc": ["https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html"]}, {"cve": "CVE-2023-39214", "desc": "Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2152", "desc": "A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226273 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.226273"]}, {"cve": "CVE-2023-33886", "desc": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7084", "desc": "The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks", "poc": ["https://wpscan.com/vulnerability/5e51e239-919b-4e74-a7ee-195f3817f907/"]}, {"cve": "CVE-2023-50477", "desc": "An issue was discovered in nos client version 0.6.6, allows remote attackers to escalate privileges via getRPCEndpoint.js.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33099", "desc": "Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4264", "desc": "Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.", "poc": ["http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html", "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rgx6-3w4j-gf5j", "https://github.com/0xdea/advisories", "https://github.com/hnsecurity/vulns"]}, {"cve": "CVE-2023-24763", "desc": "In the module \"Xen Forum\" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0.", "poc": ["https://friends-of-presta.github.io/security-advisories/modules/2023/03/06/xenforum.html"]}, {"cve": "CVE-2023-29912", "desc": "H3C Magic R200 R200V100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/S1TusiR1n"]}, {"cve": "CVE-2023-38335", "desc": "Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries \"always private\" - this is supposed to be an irreversible operation. However, due to implementation issues, \"always private\" Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an \"irreversible operation\".", "poc": ["http://packetstormsecurity.com/files/173695/Omnis-Studio-10.22.00-Library-Setting-Bypass.html", "http://seclists.org/fulldisclosure/2023/Jul/41", "http://seclists.org/fulldisclosure/2023/Jul/43", "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-005.txt"]}, {"cve": "CVE-2023-2906", "desc": "Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack.", "poc": ["https://gitlab.com/wireshark/wireshark/-/issues/19229", "https://takeonme.org/cves/CVE-2023-2906.html"]}, {"cve": "CVE-2023-52373", "desc": "Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1454", "desc": "A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.", "poc": ["https://github.com/0day404/vulnerability-poc", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Awrrays/FrameVul", "https://github.com/BugFor-Pings/CVE-2023-1454", "https://github.com/CKevens/CVE-2023-1454-EXP", "https://github.com/KayCHENvip/vulnerability-poc", "https://github.com/MzzdToT/CVE-2023-1454", "https://github.com/MzzdToT/HAC_Bored_Writing", "https://github.com/Sweelg/CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln", "https://github.com/Threekiii/Awesome-POC", "https://github.com/cjybao/CVE-2023-1454", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/gobysec/CVE-2023-1454", "https://github.com/izj007/wechat", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/padbergpete47/CVE-2023-1454", "https://github.com/shad0w0sec/CVE-2023-1454-EXP", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-37684", "desc": "Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Search Report Details of the Admin portal.", "poc": ["https://github.com/rt122001/CVES/blob/main/CVE-2023-37684.txt", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27607", "desc": "Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-38472", "desc": "A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.", "poc": ["https://github.com/adegoodyer/kubernetes-admin-toolkit"]}, {"cve": "CVE-2023-5160", "desc": "Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing\u00a0a member to get the full name of another user even if the Show Full Name option was disabled", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32124", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Publish Confirm Message plugin <=\u00a01.3.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35075", "desc": "Mattermost fails to use\u00a0 innerText /\u00a0textContent\u00a0when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33988", "desc": "In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are not implemented, allowing an unauthenticated attacker to attempt reflected cross-site scripting, which could result in disclosure or modification of information.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-7028", "desc": "An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.", "poc": ["https://github.com/0xsyr0/OSCP", "https://github.com/Azathothas/Stars", "https://github.com/CVE-Reversing/CVE-Reversing", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/Esonhugh/gitlab_honeypot", "https://github.com/GhostTroops/TOP", "https://github.com/JohnAOSC/SuperFav", "https://github.com/Marco-zcl/POC", "https://github.com/Miraitowa70/POC-notes", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/Ostorlab/KEV", "https://github.com/RandomRobbieBF/CVE-2023-7028", "https://github.com/Shimon03/CVE-2023-7028-Account-Take-Over-Gitlab", "https://github.com/TheRedDevil1/CVE-2023-7028", "https://github.com/Trackflaw/CVE-2023-7028-Docker", "https://github.com/V1lu0/CVE-2023-7028", "https://github.com/Vozec/CVE-2023-7028", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/c0ff33py/TryHackMe_Learning_Plan", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/duy-31/CVE-2023-7028", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hackeremmen/gitlab-exploit", "https://github.com/izj007/wechat", "https://github.com/johe123qwe/github-trending", "https://github.com/josephalan42/CTFs-Infosec-Witeups", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/mochammadrafi/CVE-2023-7028", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sampsonv/github-trending", "https://github.com/tanjiti/sec_profile", "https://github.com/thanhlam-attt/CVE-2023-7028", "https://github.com/thesakibrahman/THM-Free-Room", "https://github.com/toxyl/lscve", "https://github.com/txuswashere/OSCP", "https://github.com/whoami13apt/files2", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/wy876/wiki", "https://github.com/xingchennb/POC-", "https://github.com/yoryio/CVE-2023-7028", "https://github.com/zengzzzzz/golang-trending-archive", "https://github.com/zhaoxiaoha/github-trending"]}, {"cve": "CVE-2023-27986", "desc": "emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-47095", "desc": "A Stored Cross-Site Scripting (XSS) vulnerability in the Custom fields of Edit Virtual Server under System Customization in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Batch Label field while details of Virtual Server.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27537", "desc": "A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate \"handles\". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.", "poc": ["https://github.com/ctflearner/Learn365", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26935", "desc": "** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2019-9587. Reason: This record is a reservation duplicate of CVE-2019-9587. Notes: All CVE users should reference CVE-2019-9587 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.", "poc": ["https://github.com/huanglei3/xpdf_heapoverflow"]}, {"cve": "CVE-2023-42487", "desc": "Soundminer \u2013 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49313", "desc": "A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unauthorized code can be injected into the product's processes, potentially leading to remote control and unauthorized access to sensitive user data.", "poc": ["https://github.com/louiselalanne/CVE-2023-49313", "https://github.com/louiselalanne/CVE-2023-49313", "https://github.com/louiselalanne/louiselalanne", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-24132", "desc": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey3_5g parameter at /goform/WifiBasicSet.", "poc": ["https://oxnan.com/posts/WifiBasic_wepkey3_5g_DoS"]}, {"cve": "CVE-2023-3696", "desc": "Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.", "poc": ["https://huntr.dev/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-24329", "desc": "An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.", "poc": ["https://github.com/python/cpython/issues/102153", "https://github.com/ARPSyndicate/cvemon", "https://github.com/GitHubForSnap/matrix-commander-gael", "https://github.com/H4R335HR/CVE-2023-24329-PoC", "https://github.com/JawadPy/CVE-2023-24329-Exploit", "https://github.com/NathanielAPawluk/sec-buddy", "https://github.com/Pandante-Central/CVE-2023-24329-codeql-test", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38350", "desc": "PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52615", "desc": "In the Linux kernel, the following vulnerability has been resolved:hwrng: core - Fix page fault dead lock on mmap-ed hwrngThere is a dead-lock in the hwrng device read path. This triggerswhen the user reads from /dev/hwrng into memory also mmap-ed from/dev/hwrng. The resulting page fault triggers a recursive readwhich then dead-locks.Fix this by using a stack buffer when calling copy_to_user.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-52267", "desc": "ehttp 1.0.6 before 17405b9 has a simple_log.cpp _log out-of-bounds-read during error logging for long strings.", "poc": ["https://github.com/hongliuliao/ehttp/commit/17405b975948abc216f6a085d2d027ec1cfd5766", "https://github.com/hongliuliao/ehttp/issues/38", "https://github.com/Halcy0nic/Trophies", "https://github.com/skinnyrad/Trophies"]}, {"cve": "CVE-2023-38633", "desc": "A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.", "poc": ["http://seclists.org/fulldisclosure/2023/Jul/43", "https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/", "https://github.com/20142995/sectool", "https://github.com/Loginsoft-LLC/Linux-Exploit-Detection", "https://github.com/Loginsoft-Research/Linux-Exploit-Detection", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/Vulhub-Reproduce", "https://github.com/bakery312/Vulhub-Reproduce"]}, {"cve": "CVE-2023-49191", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored XSS.This issue affects GDPR Cookie Consent by Supsystic: from n/a through 2.1.2.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-48827", "desc": "Time Slots Booking Calendar 4.0 is vulnerable to Multiple HTML Injection issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.", "poc": ["http://packetstormsecurity.com/files/176036", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50428", "desc": "** DISPUTED ** In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it \"not a bug.\"", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48003", "desc": "An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the '=5.4\u00a0leads to unsafecode paths being incorrectly marked as safe, resulting in\u00a0arbitrary read/write inkernel memory, lateral privilege escalation, and container escape.", "poc": ["https://github.com/Dikens88/hopp", "https://github.com/Snoopy-Sec/Localroot-ALL-CVE", "https://github.com/google/buzzer", "https://github.com/google/security-research", "https://github.com/shannonmullins/hopp"]}, {"cve": "CVE-2023-52338", "desc": "A link following vulnerability in the Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations.\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29003", "desc": "SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. While the implementation does a sufficient job in mitigating common CSRF attacks, prior to version 1.15.1, the protection can be bypassed by simply specifying a different `Content-Type` header value. If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users\u2019 accounts. SvelteKit 1.15.1 updates the `is_form_content_type` function call in the CSRF protection logic to include `text/plain`. As additional hardening of the CSRF protection mechanism against potential method overrides, SvelteKit 1.15.1 is now performing validation on `PUT`, `PATCH` and `DELETE` methods as well. This latter hardening is only needed to protect users who have put in some sort of `?_method= override` feature themselves in their `handle` hook, so that the request that resolve sees could be `PUT`/`PATCH`/`DELETE` when the browser issues a `POST` request.", "poc": ["https://github.com/Extiri/extiri-web"]}, {"cve": "CVE-2023-3203", "desc": "The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This makes it possible for unauthenticated attackers to update limit the number of product per category to use cache data in home screen via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-6721", "desc": "An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function, resulting in interaction between the attacker and the server's file system.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/speedyfriend67/Experiments"]}, {"cve": "CVE-2023-26139", "desc": "Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like \u201c__proto__\u201d.", "poc": ["https://gist.github.com/lelecolacola123/cc0d1e73780127aea9482c05f2ff3252", "https://security.snyk.io/vuln/SNYK-JS-UNDERSCOREKEYPATH-5416714"]}, {"cve": "CVE-2023-40481", "desc": "7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of SQFS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18589.", "poc": ["https://github.com/immortalp0ny/mypocs"]}, {"cve": "CVE-2023-28322", "desc": "An information disclosure vulnerability exists in curl > 8;` which calls the `system` command with the operand `cmdline`. `cmdline` contains multiple user controlled, unsanitized values. As a result an attacker with network access to the hosted print server can exploit this vulnerability to inject system commands which are executed in the context of the running server. This issue has been addressed in commit `8f2740357` and is expected to be bundled in the next release. Users are advised to upgrade when possible and to restrict access to network printers in the meantime.", "poc": ["https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-gpxc-v2m8-fr3x", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-23326", "desc": "A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an administrator's session cookie and hijacking their session.", "poc": ["https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md"]}, {"cve": "CVE-2023-42405", "desc": "SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalService.list(), and switchService.list().", "poc": ["https://github.com/fit2cloud/rackshift/issues/79"]}, {"cve": "CVE-2023-2095", "desc": "A vulnerability was found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226103.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-4672", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software ECOP allows Reflected XSS.This issue affects ECOP: before 32255.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5886", "desc": "The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.", "poc": ["https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3"]}, {"cve": "CVE-2023-20943", "desc": "In clearApplicationUserData of ActivityManagerService.java, there is a possible way to remove system files due to a path traversal error. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-240267890", "poc": ["https://github.com/Trinadh465/frameworks_base_CVE-2023-20943", "https://github.com/hshivhare67/platform_frameworks_base_AOSP10_r33_CVE-2023-20943", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-45185", "desc": "IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Due to improper authority checks the attacker could perform operations on the PC under the user's authority. IBM X-Force ID: 268273.", "poc": ["https://github.com/DojoSecurity/DojoSecurity", "https://github.com/afine-com/CVE-2023-45185", "https://github.com/afine-com/research", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-52447", "desc": "In the Linux kernel, the following vulnerability has been resolved:bpf: Defer the free of inner map when necessaryWhen updating or deleting an inner map in map array or map htab, the mapmay still be accessed by non-sleepable program or sleepable program.However bpf_map_fd_put_ptr() decreases the ref-counter of the inner mapdirectly through bpf_map_put(), if the ref-counter is the last one(which is true for most cases), the inner map will be freed byops->map_free() in a kworker. But for now, most .map_free() callbacksdon't use synchronize_rcu() or its variants to wait for the elapse of aRCU grace period, so after the invocation of ops->map_free completes,the bpf program which is accessing the inner map may incuruse-after-free problem.Fix the free of inner map by invoking bpf_map_free_deferred() after bothone RCU grace period and one tasks trace RCU grace period if the innermap has been removed from the outer map before. The deferment isaccomplished by using call_rcu() or call_rcu_tasks_trace() whenreleasing the last ref-counter of bpf map. The newly-added rcu_headfield in bpf_map shares the same storage space with work field toreduce the size of bpf_map.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33742", "desc": "TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Cleartext Storage of Sensitive Information: RSA private key in Update.exe.", "poc": ["http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html"]}, {"cve": "CVE-2023-1789", "desc": "Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.", "poc": ["https://huntr.dev/bounties/2c3489f7-6b84-48f8-9368-9cea67cf373d"]}, {"cve": "CVE-2023-36900", "desc": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "poc": ["https://github.com/RomanRybachek/CVE-2023-36900", "https://github.com/RomanRybachek/RomanRybachek", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-37596", "desc": "Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.", "poc": ["https://github.com/sahiloj/CVE-2023-37596/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sahiloj/CVE-2023-37596"]}, {"cve": "CVE-2023-50262", "desc": "Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One of the validations is that the SVG document does not reference itself. However, prior to version 2.0.4, a recursive chained using two or more SVG documents is not correctly validated. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself.php-svg-lib, when run in isolation, does not support SVG references for `image` elements. However, when used in combination with Dompdf, php-svg-lib will process SVG images referenced by an `image` element. Dompdf currently includes validation to prevent self-referential `image` references, but a chained reference is not checked. A malicious actor may thus trigger infinite recursion by chaining references between two or more SVG images.When Dompdf parses a malicious payload, it will crash due after exceeding the allowed execution time or memory usage. An attacker sending multiple request to a system can potentially cause resource exhaustion to the point that the system is unable to handle incoming request.Version 2.0.4 contains a fix for this issue.", "poc": ["https://github.com/dompdf/dompdf/security/advisories/GHSA-3qx2-6f78-w2j2"]}, {"cve": "CVE-2023-37739", "desc": "i-doit Pro v25 and below was discovered to be vulnerable to path traversal.", "poc": ["https://github.com/leekenghwa/CVE-2023-37739---Path-Traversal-in-i-doit-Pro-25-and-below", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3992", "desc": "The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/c43b669f-0377-4402-833c-817b75001888"]}, {"cve": "CVE-2023-21996", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-0097", "desc": "The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/19379f08-d667-4b1e-a774-0f4a17ad7bff"]}, {"cve": "CVE-2023-36919", "desc": "In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in information disclosure.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-30187", "desc": "An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.", "poc": ["https://github.com/merrychap/POC-onlyoffice"]}, {"cve": "CVE-2023-37893", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chop-Chop Coming Soon Chop Chop plugin <=\u00a02.2.4 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6750", "desc": "The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.", "poc": ["https://wpscan.com/vulnerability/fad9eefe-4552-4d20-a1fd-bb2e172ec8d7", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48724", "desc": "A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted HTTP POST request can lead to denial of service of the device's web interface. An attacker can send an unauthenticated HTTP POST request to trigger this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24609", "desc": "Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate.", "poc": ["https://www.telekom.com/en/company/data-privacy-and-security/news/advisories-504842", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26111", "desc": "All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.", "poc": ["https://gist.github.com/lirantal/c80b28e7bee148dc287339cb483e42bc", "https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-3149928", "https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3149927"]}, {"cve": "CVE-2023-1178", "desc": "An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/381815"]}, {"cve": "CVE-2023-46218", "desc": "This flaw allows a malicious HTTP server to set \"super cookies\" in curl thatare then passed back to more origins than what is otherwise allowed orpossible. This allows a site to set cookies that then would get sent todifferent and unrelated sites and domains.It could do this by exploiting a mixed case flaw in curl's function thatverifies a given cookie domain against the Public Suffix List (PSL). Forexample a cookie could be set with `domain=co.UK` when the URL used a lowercase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.", "poc": ["https://github.com/bartvoet/assignment-ehb-security-review-adamlenez", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26923", "desc": "Musescore 3.0 to 4.0.1 has a stack buffer overflow vulnerability that occurs when reading misconfigured midi files. If attacker can additional information, attacker can execute arbitrary code.", "poc": ["https://github.com/musescore/MuseScore/issues/16346", "https://github.com/ARPSyndicate/cvemon", "https://github.com/kunshim/kunshim"]}, {"cve": "CVE-2023-34838", "desc": "A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Description parameter.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sahiloj/CVE-2023-34838"]}, {"cve": "CVE-2023-0312", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.", "poc": ["https://huntr.dev/bounties/f50ec8d1-cd60-4c2d-9ab8-3711870d83b9"]}, {"cve": "CVE-2023-39964", "desc": "1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the `api/v1/file.go` file, there is a function called `LoadFromFile`, which directly reads the file by obtaining the requested path `parameter[path]`. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability. Version 1.5.0 has a patch for this issue.", "poc": ["https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-pv7q-v9mv-9mh5"]}, {"cve": "CVE-2023-0111", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.", "poc": ["https://huntr.dev/bounties/70da256c-977a-487e-8a6a-9ae22caedbe3"]}, {"cve": "CVE-2023-6397", "desc": "A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the \u201cAnti-Malware\u201d feature enabled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4066", "desc": "A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33977", "desc": "Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy. This issue has been addressed in version 12.4. Users are advised to upgrade. Users unable to upgrade who are serving Kiwi TCMS behind a reverse proxy should make sure that additional header values are still passed to the client browser. If they aren't redefining them inside the proxy configuration.", "poc": ["https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96/", "https://github.com/mnqazi/CVE-2023-33977", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-33934", "desc": "Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46595", "desc": "Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor\u00a0allows an attacker\u00a0to obtain victim\u2019s domain credentials and Net-NTLM hash which can lead\u00a0to relay domain attacks. Fixed in\u00a0A32.20 (b570 or above), A32.50 (b390 or above)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23303", "desc": "The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.", "poc": ["https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23303.md"]}, {"cve": "CVE-2023-6276", "desc": "A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/ct/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-246105 was assigned to this vulnerability.", "poc": ["https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-26447", "desc": "The \"upsell\" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30482", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in VillaTheme WPBulky plugin <=\u00a01.0.10 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33887", "desc": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6308", "desc": "A vulnerability, which was classified as critical, has been found in Xiamen Four-Faith Video Surveillance Management System 2016/2017. Affected by this issue is some unknown functionality of the component Apache Struts. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-246134 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/gatsby2003/Struts2-046/blob/main/Xiamen%20Four-Faith%20Communication%20Technology%20Co.,%20Ltd.%20video%20surveillance%20management%20system%20has%20a%20command%20execution%20vulnerability.md"]}, {"cve": "CVE-2023-1120", "desc": "The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/c2defd30-7e4c-4a28-8a68-282429061f3f"]}, {"cve": "CVE-2023-27522", "desc": "HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.Special characters in the origin response header can truncate/split the response forwarded to the client.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/xonoxitron/cpe2cve"]}, {"cve": "CVE-2023-46381", "desc": "LOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3 devices lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/ URI. An unauthenticated attacker can edit any project (or create a new project) and control its GUI.", "poc": ["http://packetstormsecurity.com/files/175646/LOYTEC-Electronics-Insecure-Transit-Insecure-Permissions-Unauthenticated-Access.html"]}, {"cve": "CVE-2023-4780", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-0590. Reason: This candidate is a duplicate of CVE-2024-0590. Notes: All CVE users should reference CVE-2024-0590 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3725", "desc": "Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem", "poc": ["http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html", "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2g3m-p6c7-8rr3", "https://github.com/0xdea/advisories", "https://github.com/hnsecurity/vulns"]}, {"cve": "CVE-2023-38292", "desc": "Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmenuproxy (versionCode='2', versionName='v11.0.1.0.0201.0') that allows local third-party apps to programmatically perform a factory reset due to inadequate access control. No permissions or special privileges are necessary to exploit the vulnerability in the com.tct.gcs.hiddenmenuproxy app. No user interaction is required beyond installing and running a third-party app. The software build fingerprints for each confirmed vulnerable build are as follows: TCL/5087Z_BO/Doha_TMO:11/RP1A.200720.011/PB7I-0:user/release-keys and TCL/5087Z_BO/Doha_TMO:11/RP1A.200720.011/PB83-0:user/release-keys. This malicious app sends a broadcast intent to the exported com.tct.gcs.hiddenmenuproxy/.rtn.FactoryResetReceiver receiver component, which initiates a programmatic factory reset.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27229", "desc": "TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWanIeCfg.", "poc": ["https://github.com/Am1ngl/ttt/tree/main/30"]}, {"cve": "CVE-2023-22602", "desc": "When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Threekiii/CVE", "https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9"]}, {"cve": "CVE-2023-27704", "desc": "Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service (ReDoS).", "poc": ["https://github.com/happy0717/CVE-2023-27704", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5286", "desc": "A vulnerability, which was classified as problematic, has been found in SourceCodester Expense Tracker App v1. Affected by this issue is some unknown functionality of the file add_category.php of the component Category Handler. The manipulation of the argument category_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240914 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/xcodeOn1/XSS-Stored-Expense-Tracker-App"]}, {"cve": "CVE-2023-6890", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17.", "poc": ["https://huntr.com/bounties/2cf11678-8793-4fa1-b21a-f135564a105d", "https://github.com/ahmedvienna/CVEs-and-Vulnerabilities", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5764", "desc": "A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36456", "desc": "authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy are susceptible to this. Possible spoofing of IP addresses in logs, downstream applications proxied by (built in) outpost, IP bypassing in custom flows if used.This poses a possible security risk when someone has flows or policies that check the user's IP address, e.g. when they want to ignore the user's 2 factor authentication when the user is connected to the company network. A second security risk is that the IP addresses in the logfiles and user sessions are not reliable anymore. Anybody can spoof this address and one cannot verify that the user has logged in from the IP address that is in their account's log. A third risk is that this header is passed on to the proxied application behind an outpost. The application may do any kind of verification, logging, blocking or rate limiting based on the IP address, and this IP address can be overridden by anybody that want to.Versions 2023.4.3 and 2023.5.5 contain a patch for this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0803", "desc": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/501", "https://github.com/ARPSyndicate/cvemon", "https://github.com/peng-hui/CarpetFuzz", "https://github.com/waugustus/CarpetFuzz", "https://github.com/waugustus/waugustus"]}, {"cve": "CVE-2023-45918", "desc": "ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c.", "poc": ["https://github.com/GrigGM/05-virt-04-docker-hw", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-33221", "desc": "When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying internally the data received. This allows a heap based buffer overflow that could lead to a potential Remote Code Execution on the targeted device. This is especially problematic if you use Default DESFire key.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43830", "desc": "A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum deposit', 'Maximum deposit' and/or 'Maximum balance'.", "poc": ["https://github.com/al3zx/xss_financial_subrion_4.2.1"]}, {"cve": "CVE-2023-31461", "desc": "Attackers can exploit an open API listener on SteelSeries GG 36.0.0 to create a sub-application that will be executed automatically from a controlled location, because of a path traversal vulnerability.", "poc": ["https://github.com/tomerpeled92/CVE"]}, {"cve": "CVE-2023-51674", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager \u2013 Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager \u2013 Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50011", "desc": "PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.", "poc": ["https://packetstormsecurity.com/files/175924/PopojiCMS-2.0.1-Remote-Command-Execution.html", "https://github.com/capture0x/My-CVE"]}, {"cve": "CVE-2023-37069", "desc": "Code-Projects Online Hospital Management System V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate the SQL queries executed by the application. The application fails to properly validate user-supplied input in the login id and password fields during the login process, enabling an attacker to inject malicious SQL code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35905", "desc": "IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 259384.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/kosmosec/CVE-numbers"]}, {"cve": "CVE-2023-23737", "desc": "Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP Broken Links Checker Extension plugin <=\u00a04.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27564", "desc": "The n8n package 0.218.0 for Node.js allows Information Disclosure.", "poc": ["https://github.com/david-botelho-mariano/exploit-CVE-2023-27564", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-49716", "desc": "In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4827", "desc": "The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.", "poc": ["https://wpscan.com/vulnerability/d4daf0e1-8018-448a-964c-427a355e005f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48381", "desc": "Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22807", "desc": "LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol.", "poc": ["https://github.com/goheea/goheea"]}, {"cve": "CVE-2023-4054", "desc": "When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1840777"]}, {"cve": "CVE-2023-37456", "desc": "The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS < 115.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1795496"]}, {"cve": "CVE-2023-4116", "desc": "A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/173937/PHPJabbers-Taxi-Booking-2.0-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-2948", "desc": "Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.", "poc": ["https://huntr.dev/bounties/2393e4d9-9e9f-455f-bf50-f20f77b0a64d"]}, {"cve": "CVE-2023-3223", "desc": "A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3853", "desc": "A vulnerability was found in phpscriptpoint BloodBank 1.1. It has been rated as problematic. This issue affects some unknown processing of the file page.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235205 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.235205", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49816", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Innovative Solutions Fix My Feed RSS Repair.This issue affects Fix My Feed RSS Repair: from n/a through 1.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45146", "desc": "XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism. When such a configuration is used, attackers may be able to connect to the server and provide malicious serialized objects that, once deserialized, force it to execute arbitrary code. This can be abused to take control of the machine the server is running by way of remote code execution. This issue has not been fixed.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-052_XXL-RPC/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50959", "desc": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Content Management system when configured to use a system account. IBM X-Force ID: 275938.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48783", "desc": "An\u00a0Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other organization endpoints via crafted GET requests.", "poc": ["https://github.com/vulsio/go-cve-dictionary"]}, {"cve": "CVE-2023-31247", "desc": "A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1746"]}, {"cve": "CVE-2023-3450", "desc": "A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. This issue affects some unknown processing of the component Network Diagnostic Page. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232547. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/caopengyan/CVE-2023-3450", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yuanjinyuyuyu/CVE-2023-3450"]}, {"cve": "CVE-2023-23492", "desc": "The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action.", "poc": ["https://www.tenable.com/security/research/tra-2023-3", "https://github.com/ARPSyndicate/cvemon", "https://github.com/ARPSyndicate/kenzer-templates", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-29088", "desc": "An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP Session-Expires header.", "poc": ["http://packetstormsecurity.com/files/172289/Shannon-Baseband-SIP-Session-Expires-Header-Stack-Buffer-Overflow.html"]}, {"cve": "CVE-2023-33635", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/UpdateMacClone"]}, {"cve": "CVE-2023-28968", "desc": "An Improperly Controlled Sequential Memory Allocation vulnerability in the Juniper Networks Deep Packet Inspection-Decoder (JDPI-Decoder) Application Signature component of Junos OS's AppID service on SRX Series devices will stop the JDPI-Decoder from identifying dynamic application traffic, allowing an unauthenticated network-based attacker to send traffic to the target device using the JDPI-Decoder, designed to inspect dynamic application traffic and take action upon this traffic, to instead begin to not take action and to pass the traffic through. An example session can be seen by running the following command and evaluating the output. user@device# run show security flow session source-prefix extensive Session ID: , Status: Normal, State: Active Policy name: Dynamic application: junos:UNKNOWN, <<<<< LOOK HERE Please note, the JDPI-Decoder and the AppID SigPack are both affected and both must be upgraded along with the operating system to address the matter. By default, none of this is auto-enabled for automatic updates. This issue affects: Juniper Networks any version of the JDPI-Decoder Engine prior to version 5.7.0-47 with the JDPI-Decoder enabled using any version of the AppID SigPack prior to version 1.550.2-31 (SigPack 3533) on Junos OS on SRX Series: All versions prior to 19.1R3-S10; 19.2 versions prior to 19.2R3-S7; 19.3 versions prior to 19.3R3-S8; 19.4 versions prior to 19.4R3-S11; 20.1 version 20.1R1 and later versions prior to 20.2R3-S7; 20.3 version 20.3R1 and later versions prior to 20.4R3-S6; 21.1 versions prior to 21.1R3-S5; 21.2 versions prior to 21.2R3-S4; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S3; 22.1 versions prior to 22.1R3-S1; 22.2 versions prior to 22.2R2-S1, 22.2R3; 22.3 versions prior to 22.3R1-S2, 22.3R2;", "poc": ["https://www.juniper.net/documentation/us/en/software/jdpi/release-notes/jdpi-decoder-release-notes-october-2022/jdpi-decoder-release-notes-october-2022.pdf"]}, {"cve": "CVE-2023-4683", "desc": "NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.", "poc": ["https://huntr.dev/bounties/7852e4d2-af4e-4421-a39e-db23e0549922", "https://github.com/Songg45/CVE-2023-4683-Test", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3254", "desc": "The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0389", "desc": "The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/090a3922-febc-4294-82d2-d8339d461893/"]}, {"cve": "CVE-2023-38866", "desc": "COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and display_name.", "poc": ["https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject2"]}, {"cve": "CVE-2023-29189", "desc": "SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-21284", "desc": "In multiple functions of DevicePolicyManager.java, there is a possible way to prevent enabling the Find my Device feature due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Trinadh465/frameworks_base_AOSP10_r33_CVE-2023-21284", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31223", "desc": "Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.", "poc": ["https://excellium-services.com/cert-xlm-advisory/cve-2023-31223/"]}, {"cve": "CVE-2023-40659", "desc": "A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33719", "desc": "mp4v2 v2.1.3 was discovered to contain a memory leak via MP4SdpAtom::Read() at atom_sdp.cpp", "poc": ["https://github.com/enzo1982/mp4v2/issues/37"]}, {"cve": "CVE-2023-4932", "desc": "SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions\u00a09.4_M7 and\u00a09.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.", "poc": ["https://github.com/DojoSecurity/DojoSecurity", "https://github.com/afine-com/research", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5363", "desc": "Issue summary: A bug has been identified in the processing of key andinitialisation vector (IV) lengths. This can lead to potential truncationor overruns during the initialisation of some symmetric ciphers.Impact summary: A truncation in the IV can result in non-uniqueness,which could result in loss of confidentiality for some cipher modes.When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() orEVP_CipherInit_ex2() the provided OSSL_PARAM array is processed afterthe key and IV have been established. Any alterations to the key length,via the \"keylen\" parameter or the IV length, via the \"ivlen\" parameter,within the OSSL_PARAM array will not take effect as intended, potentiallycausing truncation or overreading of these values. The following ciphersand cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.For the CCM, GCM and OCB cipher modes, truncation of the IV can result inloss of confidentiality. For example, when following NIST's SP 800-38Dsection 8.2.1 guidance for constructing a deterministic IV for AES inGCM mode, truncation of the counter portion could lead to IV reuse.Both truncations and overruns of the key and overruns of the IV willproduce incorrect results and could, in some cases, trigger a memoryexception. However, these issues are not currently assessed as securitycritical.Changing the key and/or IV lengths is not considered to be a common operationand the vulnerable API was recently introduced. Furthermore it is likely thatapplication developers will have spotted this problem during testing sincedecryption would fail unless both peers in the communication were similarlyvulnerable. For these reasons we expect the probability of an application beingvulnerable to this to be quite low. However if an application is vulnerable thenthis issue is considered very serious. For these reasons we have assessed thisissue as Moderate severity overall.The OpenSSL SSL/TLS implementation is not affected by this issue.The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this becausethe issue lies outside of the FIPS provider boundary.OpenSSL 3.1 and 3.0 are vulnerable to this issue.", "poc": ["https://github.com/adegoodyer/kubernetes-admin-toolkit", "https://github.com/alex-grandson/docker-python-example", "https://github.com/bartvoet/assignment-ehb-security-review-adamlenez", "https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/malinkamedok/devops_sandbox", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-6915", "desc": "A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7110", "desc": "A vulnerability, which was classified as critical, has been found in code-projects Library Management System 2.0. This issue affects some unknown processing of the file login.php. The manipulation of the argument student leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249005 was assigned to this vulnerability.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/Library-Management-System/Library-Management-System_SQL_Injection-2.md", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-6996", "desc": "The Display custom fields in the frontend \u2013 Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin's vg_display_data shortcode in all versions up to, and including, 1.2.1 due to insufficient input validation and restriction on access to that shortcode. This makes it possible for authenticated attackers with contributor-level and above permissions to call arbitrary functions and execute code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40477", "desc": "RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC", "https://github.com/winkler-winsen/Scan_WinRAR"]}, {"cve": "CVE-2023-33553", "desc": "An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginStatus cookie.", "poc": ["https://github.com/0xfml/poc/blob/main/PLANET/WDRT-1800AX.md"]}, {"cve": "CVE-2023-44853", "desc": "\\An issue was discovered in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_219C4 function in the acu_web file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4834", "desc": "In Red Lion Europe\u00a0mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an\u00a0improperly implemented access validation allows an authenticated, low privileged\u00a0attacker to gain read access to limited, non-critical device information in his account he should not have access to.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24656", "desc": "Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the subject parameter under the Create Ticket function.", "poc": ["https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip"]}, {"cve": "CVE-2023-24345", "desc": "D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetWanDhcpplus.", "poc": ["https://github.com/1160300418/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/03"]}, {"cve": "CVE-2023-37682", "desc": "Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-jms/deductScores.php.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3617", "desc": "A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin_class.php of the component Login Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233565 was assigned to this vulnerability.", "poc": ["https://github.com/movonow/demo/blob/main/kruxton.md"]}, {"cve": "CVE-2023-5853", "desc": "Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28667", "desc": "The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present.", "poc": ["https://www.tenable.com/security/research/tra-2023-7", "https://github.com/ARPSyndicate/cvemon", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-33677", "desc": "Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at \"?page=items/view&id=*\".", "poc": ["https://github.com/ASR511-OO7/CVE-2023-33677", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-21338", "desc": "In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4150", "desc": "The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks", "poc": ["https://wpscan.com/vulnerability/381ef15b-aafe-4ef4-a0bc-867d891f7f44", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45141", "desc": "Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.", "poc": ["https://github.com/sixcolors/fiber-csrf-cve-test"]}, {"cve": "CVE-2023-5947", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-7247. Reason: This candidate is a duplicate of CVE-2023-7247. Notes: All CVE users should reference CVE-2023-7247 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30744", "desc": "In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming and directory API to instantiate an object which has methods which can be called without further authorization and authentication. \u00a0A subsequent call to one of these methods can read or change the state of existing services without any effect on availability.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-46730", "desc": "Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.php endpoint. The /api/upload.php endpoint does not filter URLs which allows a malicious user to cause the server to make resource requests to untrusted domains. Note that protocols like file:// can also be used to access the server disk. The request result (on success) can then be retrieved using /api/download.php. This issue has been addressed in versions 6.8.15, 6.7.54, and 6.6.177. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/Intermesh/groupoffice/security/advisories/GHSA-vw6c-h82w-mvfv"]}, {"cve": "CVE-2023-25741", "desc": "When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility problems as well as this security concern, so the behavior was disabled until further review. This vulnerability affects Firefox < 110.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1813376", "https://github.com/dlehgus1023/dlehgus1023"]}, {"cve": "CVE-2023-1451", "desc": "A vulnerability was found in MP4v2 2.1.2. It has been classified as problematic. Affected is the function mp4v2::impl::MP4Track::GetSampleFileOffset of the file mp4track.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223296.", "poc": ["https://github.com/RichTrouble/mp4v2_mp4track_poc", "https://github.com/RichTrouble/mp4v2_mp4track_poc/blob/main/id_000000%2Csig_08%2Csrc_001076%2Ctime_147809374%2Cexecs_155756872%2Cop_havoc%2Crep_8", "https://github.com/10cks/10cks", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-46480", "desc": "An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function.", "poc": ["https://github.com/shahzaibak96/CVE-2023-46480", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/shahzaibak96/CVE-2023-46480"]}, {"cve": "CVE-2023-43250", "desc": "XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There is a User Mode Write AV via a crafted image file. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.", "poc": ["http://packetstormsecurity.com/files/175145/XNSoft-Nconvert-7.136-Buffer-Overflow-Denial-Of-Service.html", "http://seclists.org/fulldisclosure/2023/Oct/15", "https://github.com/mrtouch93/exploits"]}, {"cve": "CVE-2023-24232", "desc": "A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.", "poc": ["https://medium.com/@0x2bit/inventory-management-system-multiple-stored-xss-vulnerability-b296365065b"]}, {"cve": "CVE-2023-43481", "desc": "An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript code via the com.tcl.browser.portal.browse.activity.BrowsePageActivity component.", "poc": ["https://github.com/actuator/com.tcl.browser/blob/main/CWE-94.md", "https://github.com/actuator/com.tcl.browser", "https://github.com/actuator/cve", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-23000", "desc": "In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17"]}, {"cve": "CVE-2023-1008", "desc": "A vulnerability was found in Twister Antivirus 8.17. It has been rated as problematic. This issue affects the function 0x801120E4 in the library filmfd.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-221741 was assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1008", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-21226", "desc": "In SAEMM_RetrieveTaiList of SAEMM_ContextManagement.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-240728187References: N/A", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45880", "desc": "GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot.", "poc": ["https://herolab.usd.de/security-advisories/usd-2023-0022/"]}, {"cve": "CVE-2023-2752", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.", "poc": ["https://huntr.dev/bounties/efdf5b24-6d30-4d57-a5b0-13b253ba3ea4", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5106", "desc": "An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6870", "desc": "Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. *This issue only affects Android versions of Firefox and Firefox Focus.* This vulnerability affects Firefox < 121.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1823316"]}, {"cve": "CVE-2023-48382", "desc": "Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47184", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Proper Fraction LLC. Admin Bar & Dashboard Access Control plugin <=\u00a01.2.8 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rach1tarora/CVE-2023-47184", "https://github.com/rach1tarora/rach1tarora"]}, {"cve": "CVE-2023-43352", "desc": "An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component.", "poc": ["https://github.com/sromanhu/CMSmadesimple-SSTI--Content", "https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content"]}, {"cve": "CVE-2023-21675", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/170852/Windows-Kernel-Registry-Virtualization-Memory-Corruption.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-2630", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/e1001870-b8d8-4921-8b9c-bbdfb1a1491e"]}, {"cve": "CVE-2023-1826", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file php-ocls\\admin\\system_info\\index.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The identifier VDB-224841 was assigned to this vulnerability.", "poc": ["http://packetstormsecurity.com/files/171790/Online-Computer-And-Laptop-Store-1.0-Shell-Upload.html"]}, {"cve": "CVE-2023-4826", "desc": "The SocialDriver WordPress theme before version 2024 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties resulting in a cross-site scripting (XSS) attack.", "poc": ["https://wpscan.com/vulnerability/99ec0add-8f4d-4d68-91aa-80b1631a53bf/"]}, {"cve": "CVE-2023-51520", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugins WP Booking Calendar allows Stored XSS.This issue affects WP Booking Calendar: from n/a before 9.7.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52460", "desc": "In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Fix NULL pointer dereference at hibernateDuring hibernate sequence the source context might not have a clk_mgr.So don't use it to look for DML2 support.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50736", "desc": "A memory corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31722", "desc": "There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).", "poc": ["https://github.com/deezombiedude612/rca-tool"]}, {"cve": "CVE-2023-34210", "desc": "SQL Injection in create customer group function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to execute arbitrary SQL commands via the ctl00$ContentPlaceHolder1$txtCustSQL parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1283", "desc": "Code Injection in GitHub repository builderio/qwik prior to 0.21.0.", "poc": ["https://huntr.dev/bounties/63f1ff91-48f3-4886-a179-103f1ddd8ff8"]}, {"cve": "CVE-2023-0372", "desc": "The EmbedStories WordPress plugin before 0.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/9cf90ad8-4aa4-466c-a33e-4f2706815765"]}, {"cve": "CVE-2023-46914", "desc": "SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via ics_export.php.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49468", "desc": "Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit function at slice.cc.", "poc": ["https://github.com/strukturag/libde265/issues/432"]}, {"cve": "CVE-2023-40462", "desc": "The ACEManagercomponent of ALEOS 4.16 and earlier does notperform inputsanitization during authentication, which couldpotentially resultin a Denial of Service (DoS) condition forACEManager withoutimpairing other router functions. ACEManagerrecovers from theDoS condition by restarting within ten seconds ofbecomingunavailable.", "poc": ["https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs"]}, {"cve": "CVE-2023-22081", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0418", "desc": "The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/821751bb-feaf-45b8-91a9-e173cb0c05fc"]}, {"cve": "CVE-2023-3684", "desc": "A vulnerability was found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /change-language/de_DE of the component Base64 Encoding Handler. The manipulation of the argument redirectTo leads to open redirect. The attack may be launched remotely. VDB-234230 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3239", "desc": "A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46840", "desc": "Incorrect placement of a preprocessor directive in source code resultsin logic that doesn't operate as intended when support for HVM guests iscompiled out of Xen.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-37150", "desc": "Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in \"/admin/index.php?page=categories\" Category item.", "poc": ["https://www.chtsecurity.com/news/57fd2fe6-11d9-421d-9087-88b4d5090452"]}, {"cve": "CVE-2023-25749", "desc": "Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. Firefox will now confirm with users that they want to launch an external application before doing so.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1810705"]}, {"cve": "CVE-2023-6035", "desc": "The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape \"data\" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.", "poc": ["https://wpscan.com/vulnerability/44f5a29a-05f9-40d2-80f2-6fb2bda60d79"]}, {"cve": "CVE-2023-2449", "desc": "The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_process_form). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-2448 and CVE-2023-2446, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.", "poc": ["http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html", "https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681"]}, {"cve": "CVE-2023-0669", "desc": "Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.", "poc": ["http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html", "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis", "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html", "https://github.com/0xf4n9x/CVE-2023-0669", "https://github.com/ARPSyndicate/cvemon", "https://github.com/ARPSyndicate/kenzer-templates", "https://github.com/Avento/CVE-2023-0669", "https://github.com/CVEDB/PoC-List", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/H4lo/awesome-IoT-security-article", "https://github.com/Loginsoft-LLC/Linux-Exploit-Detection", "https://github.com/Loginsoft-Research/Linux-Exploit-Detection", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/aneasystone/github-trending", "https://github.com/cataiovita/CVE-2023-0669", "https://github.com/cataliniovita/CVE-2023-0669", "https://github.com/hktalent/TOP", "https://github.com/k0mi-tg/CVE-POC", "https://github.com/manas3c/CVE-POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile", "https://github.com/trhacknon/CVE-2023-0669", "https://github.com/trhacknon/CVE-2023-0669-bis", "https://github.com/whoforget/CVE-POC", "https://github.com/yosef0x01/CVE-2023-0669-Analysis", "https://github.com/youwizard/CVE-POC"]}, {"cve": "CVE-2023-3131", "desc": "The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.", "poc": ["https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c"]}, {"cve": "CVE-2023-1831", "desc": "Mattermost fails to redact from audit logs\u00a0the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-21512", "desc": "Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access permission.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20159", "desc": "Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sg-web-multi-S9g4Nkgv", "https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-27754", "desc": "vox2mesh 1.0 has stack-overflow in main.cpp, this is stack-overflow caused by incorrect use of memcpy() funciton. The flow allows an attacker to cause a denial of service (abort) via a crafted file.", "poc": ["https://github.com/10cksYiqiyinHangzhouTechnology/vox2mesh_poc", "https://github.com/10cks/10cks", "https://github.com/10cksYiqiyinHangzhouTechnology/10cksYiqiyinHangzhouTechnology", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-41290", "desc": "A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.We have already fixed the vulnerability in the following version:QuFirewall 2.4.1 ( 2024/02/01 ) and later", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34600", "desc": "Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection.", "poc": ["https://github.com/costacoco/Adiscon", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5675", "desc": "A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49372", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.", "poc": ["https://github.com/li-yu320/cms/blob/main/There%20is%20a%20CSRF%20present%20at%20the%20new%20location%20of%20the%20rotation%20image.md"]}, {"cve": "CVE-2023-21843", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/gdams/openjdk-cve-parser"]}, {"cve": "CVE-2023-4089", "desc": "On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45198", "desc": "ftpd before \"NetBSD-ftpd 20230930\" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30058", "desc": "novel-plus 3.6.2 is vulnerable to SQL Injection.", "poc": ["https://github.com/Rabb1tQ/HillstoneCVEs"]}, {"cve": "CVE-2023-6033", "desc": "Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43343", "desc": "Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Files - Description parameter in the Pages Menu component.", "poc": ["https://github.com/sromanhu/CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files", "https://github.com/sromanhu/Quick-CMS-Stored-XSS---Pages-Files", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files"]}, {"cve": "CVE-2023-22655", "desc": "Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37599", "desc": "An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sahiloj/CVE-2023-37599"]}, {"cve": "CVE-2023-26102", "desc": "All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype", "poc": ["https://github.com/timdown/rangy/issues/478", "https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702"]}, {"cve": "CVE-2023-23315", "desc": "The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.", "poc": ["https://friends-of-presta.github.io/security-advisories/modules/2023/03/01/stripejs.html"]}, {"cve": "CVE-2023-44694", "desc": "D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php.", "poc": ["https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_rce_%20mailrecvview.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34330", "desc": "AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.", "poc": ["https://github.com/chnzzh/Redfish-CVE-lib"]}, {"cve": "CVE-2023-40202", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Hannes Etzelstorfer // codemiq WP HTML Mail plugin <=\u00a03.4.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2600", "desc": "The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/8e1d65c3-14e4-482f-ae9e-323e847a8613"]}, {"cve": "CVE-2023-46675", "desc": "An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users, Elastic Security package policy objects which can contain private keys, bearer token, and sessions of 3rd-party integrations and finally Authorization headers, client secrets, local file paths, and stack traces. The issue may occur in any Kibana instance running an affected version that could potentially receive an unexpected error when communicating to Elasticsearch causing it to include sensitive data into Kibana error logs. It could also occur under specific circumstances when debug level logging is enabled in Kibana. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38969", "desc": "Cross Site Scripting vulnerabiltiy in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the title parameter in the new book and edit book function.", "poc": ["https://panda002.hashnode.dev/badaso-version-297-has-an-xss-vulnerability-in-add-books"]}, {"cve": "CVE-2023-29454", "desc": "Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4548", "desc": "A vulnerability classified as critical has been found in SPA-Cart eCommerce CMS 1.9.0.3. This affects an unknown part of the file /search of the component GET Parameter Handler. The manipulation of the argument filter[brandid] leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-238059.", "poc": ["http://packetstormsecurity.com/files/174344/SPA-Cart-eCommerce-CMS-1.9.0.3-SQL-Injection.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3191", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.", "poc": ["https://huntr.dev/bounties/19fed157-128d-4bfb-a30e-eadf748cbd1a"]}, {"cve": "CVE-2023-6354", "desc": "Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the PDFViewer.aspx 'filename' parameter.", "poc": ["https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/", "https://github.com/qwell/disorder-in-the-court"]}, {"cve": "CVE-2023-32521", "desc": "A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files.", "poc": ["https://www.tenable.com/security/research/tra-2023-17"]}, {"cve": "CVE-2023-36250", "desc": "CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.", "poc": ["https://github.com/BrunoTeixeira1996/CVE-2023-36250/blob/main/README.md", "https://github.com/BrunoTeixeira1996/CVE-2023-36250", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-39699", "desc": "IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.", "poc": ["https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion"]}, {"cve": "CVE-2023-1717", "desc": "Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim\u2019s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.", "poc": ["https://starlabs.sg/advisories/23/23-1717/"]}, {"cve": "CVE-2023-51810", "desc": "SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain sensitive information via a crafted request to the search parameter in the Users module.", "poc": ["https://github.com/Pastea/CVE-2023-51810", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-45058", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Short URL plugin <=\u00a01.6.8 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21974", "desc": "Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Team Calendar Plugin: 18.2-22.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Application Express Team Calendar Plugin. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express Team Calendar Plugin, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Application Express Team Calendar Plugin. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-1490", "desc": "A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical. Affected by this issue is the function 0x220020 in the library SDActMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223376.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1490", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-40604", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jes Madsen Cookies by JM plugin <=\u00a01.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27497", "desc": "Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-27643", "desc": "An issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button in Queue and Select Folders button in Library", "poc": ["https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27643/CVE%20detail.md"]}, {"cve": "CVE-2023-27905", "desc": "Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Rajchowdhury420/Secure-or-Break-Jenkins", "https://github.com/gquere/pwn_jenkins", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-41818", "desc": "An improper use of the SD card for sensitive data vulnerability was reported in the Motorola Device Help application that could allow a local attacker to read system logs.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46007", "desc": "Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_staff.php.", "poc": ["https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/SQL-Injection-Vulnerability-3.md"]}, {"cve": "CVE-2023-33118", "desc": "Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6950", "desc": "** DISPUTED ** An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a malicious packet containing a malformed path provided to the FTP SIZE command that leads to a denial-of-service attack of the FTP service itself.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4736", "desc": "Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.", "poc": ["https://huntr.dev/bounties/e1ce0995-4df4-4dec-9cd7-3136ac3e8e71"]}, {"cve": "CVE-2023-4592", "desc": "A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie session details of an authenticated user, resulting in a session hijacking.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1157", "desc": "A vulnerability, which was classified as problematic, was found in finixbit elf-parser. Affected is the function elf_parser::Elf_parser::get_segments of the file elf_parser.cpp. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-222222 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/10cksYiqiyinHangzhouTechnology/elf-parser_segments_poc", "https://github.com/10cks/10cks", "https://github.com/10cksYiqiyinHangzhouTechnology/10cksYiqiyinHangzhouTechnology", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-25707", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <=\u00a01.5.12 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/yaudahbanh/CVE-Archive"]}, {"cve": "CVE-2023-24160", "desc": "TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.", "poc": ["https://github.com/iceyjchen/VulnerabilityProjectRecords/blob/main/setPasswordCfg_admuser/setPasswordCfg_admuser.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/iceyjchen/VulnerabilityProjectRecords"]}, {"cve": "CVE-2023-5573", "desc": "Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.", "poc": ["https://huntr.dev/bounties/46a2bb2c-712a-4008-a147-b862e3af7d72"]}, {"cve": "CVE-2023-49695", "desc": "OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and earlier allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command by sending a specially crafted request to the product.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31664", "desc": "A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter.", "poc": ["https://github.com/adilkhan7/CVE-2023-31664", "https://github.com/adilkhan7/CVE-2023-31664", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-48011", "desc": "GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments.c.", "poc": ["https://github.com/gpac/gpac/issues/2611"]}, {"cve": "CVE-2023-24019", "desc": "A stack-based buffer overflow vulnerability exists in the urvpn_client http_connection_readcb functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1718"]}, {"cve": "CVE-2023-6873", "desc": "Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 121.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29210", "desc": "XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the user parameter of the macro that provide the notification filters. These macros are used in the user profiles and thus installed by default in XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.", "poc": ["https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9mj-v5mf-m82x"]}, {"cve": "CVE-2023-37895", "desc": "Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component \"commons-beanutils\", which contains a class that can be used for remote code execution over RMI.Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore.In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases.How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone.The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like \"netstat\" can be used to check.RMI-over-HTTP in Jackrabbit by default uses the path \"/rmi\". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control.Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:\u00a0 \u00a0 \u00a0 \u00a0\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 RMI \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 org.apache.jackrabbit.servlet.remote.RemoteBindingServlet \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 RMI \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 /rmi \u00a0 \u00a0 \u00a0 \u00a0 Find the bootstrap.properties file (in $REPOSITORY_HOME), and set\u00a0 \u00a0 \u00a0 \u00a0 rmi.enabled=false\u00a0 \u00a0 and also remove\u00a0 \u00a0 \u00a0 \u00a0 rmi.host\u00a0 \u00a0 \u00a0 \u00a0 rmi.port\u00a0 \u00a0 \u00a0 \u00a0 rmi.url-pattern\u00a0If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained.", "poc": ["http://seclists.org/fulldisclosure/2023/Jul/43", "https://github.com/Y4tacker/JavaSec"]}, {"cve": "CVE-2023-48198", "desc": "A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to obtain a victim's cookies.", "poc": ["https://nitipoom-jar.github.io/CVE-2023-48198", "https://github.com/nitipoom-jar/CVE-2023-48198", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-29108", "desc": "The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-48106", "desc": "Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_resolve function in the mz_os.c file.", "poc": ["https://github.com/zlib-ng/minizip-ng/issues/740"]}, {"cve": "CVE-2023-51372", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HashBar \u2013 WordPress Notification Bar allows Stored XSS.This issue affects HashBar \u2013 WordPress Notification Bar: from n/a through 1.4.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46351", "desc": "In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The methods `mib::getManufacturersByCategory()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25729", "desc": "Permission prompts for opening external schemes were only shown for /templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.", "poc": ["https://jira.xwiki.org/browse/XWIKI-20340"]}, {"cve": "CVE-2023-49355", "desc": "decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the \" []-1.2e-1111111111\" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation.", "poc": ["https://github.com/linzc21/bug-reports/blob/main/reports/jq/1.7-37-g88f01a7/heap-buffer-overflow/CVE-2023-49355.md"]}, {"cve": "CVE-2023-26459", "desc": "Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which will trigger the application server to send a request to an arbitrary URL which can reveal, modify or make unavailable non-sensitive information, leading to low impact on Confidentiality, Integrity and Availability.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-27807", "desc": "H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.", "poc": ["https://hackmd.io/@0dayResearch/Delstlist"]}, {"cve": "CVE-2023-6681", "desc": "A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46192", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <=\u00a01.2.3 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-25826", "desc": "Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.", "poc": ["http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html", "https://github.com/ErikWynter/opentsdb_key_cmd_injection", "https://github.com/Loginsoft-LLC/Linux-Exploit-Detection", "https://github.com/Loginsoft-Research/Linux-Exploit-Detection", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/Vulhub-Reproduce", "https://github.com/getdrive/PoC"]}, {"cve": "CVE-2023-7137", "desc": "A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the component HTTP POST Request Handler. The manipulation of the argument uemail leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249140.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/Client_Details_System/Client_Details_System-SQL_Injection_1.md", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-49969", "desc": "Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=edit_customer.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49969", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5858", "desc": "Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40105", "desc": "In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-47108", "desc": "OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.", "poc": ["https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw"]}, {"cve": "CVE-2023-50356", "desc": "SSL connections to some LDAP servers are vulnerable to a man-in-the-middle attack due to improper certificate validation in AREAL Topkapi Vision (Server). This allows a remote unauthenticated attacker to gather sensitive information and prevent valid users from login.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7155", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester Free and Open Source Inventory Management System 1.0. This affects an unknown part of the file /ample/app/action/edit_product.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249177 was assigned to this vulnerability.", "poc": ["https://medium.com/@heishou/inventory-management-system-sql-injection-f6d67247c7ae"]}, {"cve": "CVE-2023-6118", "desc": "Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal.This issue affects IP Camera: before b1130.1.0.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33264", "desc": "In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.", "poc": ["https://github.com/PeterXMR/Demo", "https://github.com/miguelc49/CVE-2023-33264-1", "https://github.com/miguelc49/CVE-2023-33264-2", "https://github.com/miguelc49/CVE-2023-33264-3", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-22957", "desc": "An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive information, e.g., the device root password.", "poc": ["http://packetstormsecurity.com/files/174215/AudioCodes-VoIP-Phones-Hardcoded-Key.html", "http://seclists.org/fulldisclosure/2023/Aug/15", "https://syss.de", "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-052.txt"]}, {"cve": "CVE-2023-37307", "desc": "In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.", "poc": ["http://packetstormsecurity.com/files/176975/MISP-2.4.171-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-26396", "desc": "Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-50880", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects BuddyPress: from n/a through 11.3.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44061", "desc": "File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit profile component.", "poc": ["https://github.com/soundarkutty/File-upload-Restriction-bypass/blob/main/poc.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/soundarkutty/CVE-2023-44061"]}, {"cve": "CVE-2023-36560", "desc": "ASP.NET Security Feature Bypass Vulnerability", "poc": ["https://github.com/w181496/Web-CTF-Cheatsheet"]}, {"cve": "CVE-2023-44270", "desc": "An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/seal-community/patches", "https://github.com/xavierloeraflores/github-url-converter"]}, {"cve": "CVE-2023-51707", "desc": "MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1131", "desc": "A vulnerability has been found in SourceCodester Computer Parts Sales and Inventory System 1.0 and classified as problematic. This vulnerability affects unknown code of the file customer.php. The manipulation of the argument FIRST_NAME/LAST_NAME/PHONE_NUMBER leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222106 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.222106", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Zero-Yi7/Zero-Yi7"]}, {"cve": "CVE-2023-49713", "desc": "Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45758", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi Amministrazione Trasparente plugin <=\u00a08.0.2 versions.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-5368", "desc": "On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated data from the underlying disk device, rather than zero bytes.This may permit a user with write access to files on a msdosfs filesystem to read unintended data (e.g. from a previously deleted file).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26441", "desc": "Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access to the database and a local or restricted network would be able to read arbitrary local file system resources that are accessible by the services system user account. We have improved path validation and make sure that any access is contained to the defined root directory. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4289", "desc": "The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/38c337c6-048f-4009-aef8-29c18afa6fdc"]}, {"cve": "CVE-2023-38351", "desc": "MiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers to achieve remote code execution through a man in the middle attack.", "poc": ["https://0dr3f.github.io/cve/"]}, {"cve": "CVE-2023-5312", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-43226. Reason: This candidate is a reservation duplicate of CVE-2023-43226. Notes: All CVE users should reference CVE-2023-43226 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49948", "desc": "Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL.", "poc": ["https://github.com/codeb0ss/CVE-2023-49948-PoC"]}, {"cve": "CVE-2023-2249", "desc": "The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of the data being supplied to the function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to retrieve the contents of files like wp-config.php hosted on the system, perform a deserialization attack and possibly achieve remote code execution, and make requests to internal services.", "poc": ["https://github.com/ixiacom/CVE-2023-2249", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3769", "desc": "Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to gain knowledge about specially crafted packets that would create a DoS condition through the MMS protocol when initiating communication, achieving a complete system reboot of the device and its services.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41673", "desc": "An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49556", "desc": "Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expr_delete_term function in the libyasm/expr.c component.", "poc": ["https://github.com/yasm/yasm/issues/250"]}, {"cve": "CVE-2023-4549", "desc": "The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.", "poc": ["https://wpscan.com/vulnerability/8aebead0-0eab-4d4e-8ceb-8fea0760374f", "https://github.com/b0marek/CVE-2023-4549", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-35121", "desc": "Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow authenticated user to potentially enable escalation of privilege via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28773", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kolja Nolte Secondary Title plugin <=\u00a02.0.9.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31548", "desc": "A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.", "poc": ["https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-31548", "https://github.com/10splayaSec/CVE-Disclosures"]}, {"cve": "CVE-2023-47455", "desc": "Tenda AX1806 V1.0.0.1 contains a heap overflow vulnerability in setSchedWifi function, in which the src and v12 are directly obtained from http request parameter schedStartTime and schedEndTime without checking their size.", "poc": ["https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1806/setSchedWifi.md"]}, {"cve": "CVE-2023-48104", "desc": "Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.", "poc": ["https://github.com/E1tex/CVE-2023-48104", "https://habr.com/ru/articles/804863/", "https://github.com/E1tex/CVE-2023-48104", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3320", "desc": "The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation in the ~/admin/views/admin.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["http://packetstormsecurity.com/files/173048/WordPress-WP-Sticky-Social-1.0.1-CSRF-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-51394", "desc": "High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5609", "desc": "The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/aac4bcc8-b826-4165-aed3-f422dd178692"]}, {"cve": "CVE-2023-3307", "desc": "A vulnerability was found in miniCal 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /booking/show_bookings/. The manipulation of the argument search_query leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231803. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/ctflearner/Vulnerability/blob/main/MINICAL/minical.md"]}, {"cve": "CVE-2023-5009", "desc": "An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of [CVE-2023-3932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3932) showing additional impact.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2361", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/24d91b83-c3df-48f5-a713-9def733f2de7"]}, {"cve": "CVE-2023-48619", "desc": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5152", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation of the argument sql leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240248. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.", "poc": ["https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_sql_%20importexport.md"]}, {"cve": "CVE-2023-1822", "desc": "Incorrect security UI in Navigation in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-26318", "desc": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers.", "poc": ["https://github.com/H4lo/awesome-IoT-security-article"]}, {"cve": "CVE-2023-4053", "desc": "A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1839079"]}, {"cve": "CVE-2023-37689", "desc": "Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Booking Request page.", "poc": ["https://github.com/rt122001/CVES/blob/main/CVE-2023-37689.txt", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43359", "desc": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component.", "poc": ["https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager"]}, {"cve": "CVE-2023-22421", "desc": "Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier. The insufficient buffer size for the PLC program instructions leads to out-of-bounds read. As a result, opening a specially crafted project file may lead to information disclosure and/or arbitrary code execution.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-26956", "desc": "onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.", "poc": ["https://github.com/keheying/onekeyadmin/issues/4"]}, {"cve": "CVE-2023-37981", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPKube Authors List plugin <=\u00a02.0.2 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-36620", "desc": "An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup=\"false\" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is used to authenticate requests to the API.", "poc": ["https://seclists.org/fulldisclosure/2023/Jul/12"]}, {"cve": "CVE-2023-33559", "desc": "A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file.", "poc": ["https://github.com/ninj4c0d3r/OcoMon-Research", "https://github.com/ninj4c0d3r/ninj4c0d3r"]}, {"cve": "CVE-2023-20019", "desc": "A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform, Cisco BroadWorks Application Server, and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device.\nThis vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.", "poc": ["https://github.com/Live-Hack-CVE/CVE-2023-20019"]}, {"cve": "CVE-2023-1517", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.", "poc": ["https://huntr.dev/bounties/82adf0dd-8ebd-4d15-9f91-6060c8fa5a0d", "https://github.com/ARPSyndicate/cvemon", "https://github.com/khanhchauminh/khanhchauminh"]}, {"cve": "CVE-2023-51023", "desc": "TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the \u2018host_time\u2019 parameter of the NTPSyncWithHost interface of the cstecgi .cgi.", "poc": ["https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031NTPSyncWithHost-host_time/"]}, {"cve": "CVE-2023-41537", "desc": "phpjabbers Business Directory Script 3.2 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.", "poc": ["https://github.com/2lambda123/Windows10Exploits", "https://github.com/nu11secur1ty/CVE-nu11secur1ty", "https://github.com/nu11secur1ty/Windows10Exploits"]}, {"cve": "CVE-2023-43661", "desc": "Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.", "poc": ["https://github.com/cachethq/cachet/security/advisories/GHSA-hv79-p62r-wg3p"]}, {"cve": "CVE-2023-49396", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.", "poc": ["https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20at%20the%20newly%20added%20section%20of%20column%20management.md"]}, {"cve": "CVE-2023-46761", "desc": "Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3169", "desc": "The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-74da0dc5abb5"]}, {"cve": "CVE-2023-2803", "desc": "The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/ec640d47-bb22-478d-9668-1dab72f12f8d"]}, {"cve": "CVE-2023-31130", "desc": "c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular \"0::00:00:00/2\" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42307", "desc": "Cross Site Scripting (XSS) vulnerability in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via \"Subject Name\" and \"Subject Code\" section.", "poc": ["https://github.com/ASR511-OO7/CVE-2023-42307", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26155", "desc": "All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the input pdf file path.", "poc": ["https://github.com/nrhirani/node-qpdf/issues/23", "https://security.snyk.io/vuln/SNYK-JS-NODEQPDF-5747918"]}, {"cve": "CVE-2023-0900", "desc": "The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.", "poc": ["https://wpscan.com/vulnerability/f601e637-a486-4f3a-9077-4f294ace7ea1"]}, {"cve": "CVE-2023-33670", "desc": "Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sub_4a79ec function.", "poc": ["https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N3/README.md", "https://github.com/DDizzzy79/Tenda-CVE/tree/main/AC8V4.0/N3", "https://github.com/DDizzzy79/Tenda-CVE", "https://github.com/retr0reg/Tenda-CVE"]}, {"cve": "CVE-2023-39137", "desc": "An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.", "poc": ["https://blog.ostorlab.co/zip-packages-exploitation.html", "https://github.com/brendan-duncan/archive/issues/266"]}, {"cve": "CVE-2023-37473", "desc": "zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.", "poc": ["https://github.com/Hzoid/NVDBuddy", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50892", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS.This issue affects TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36403", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/176209/Windows-Kernel-Race-Conditions.html"]}, {"cve": "CVE-2023-5815", "desc": "The News & Blog Designer Pack \u2013 WordPress Blog Plugin \u2014 (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX. This is due to function utilizing an unsafe extract() method to extract values from the POST variable and passing that input to the include() function. This makes it possible for unauthenticated attackers to include arbitrary PHP files and achieve remote code execution. On vulnerable Docker configurations it may be possible for an attacker to create a PHP file and then subsequently include it to achieve RCE.", "poc": ["https://github.com/codeb0ss/CVE-2023-5815-PoC"]}, {"cve": "CVE-2023-27103", "desc": "Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc.", "poc": ["https://github.com/strukturag/libde265/issues/394"]}, {"cve": "CVE-2023-3139", "desc": "The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.", "poc": ["https://wpscan.com/vulnerability/f8a29aee-19cd-4e62-b829-afc9107f69bd"]}, {"cve": "CVE-2023-7207", "desc": "Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.", "poc": ["https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-35896", "desc": "IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 259247.", "poc": ["https://github.com/kosmosec/CVE-numbers"]}, {"cve": "CVE-2023-3882", "desc": "A vulnerability, which was classified as critical, has been found in Campcodes Beauty Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit-accepted-appointment.php. The manipulation of the argument contactno leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235244.", "poc": ["https://vuldb.com/?id.235244"]}, {"cve": "CVE-2023-4704", "desc": "External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.", "poc": ["https://huntr.dev/bounties/4a54134d-df1f-43d4-9b14-45f023cd654a"]}, {"cve": "CVE-2023-1212", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.", "poc": ["https://huntr.dev/bounties/3d5199d6-9bb2-4f7b-bd81-bded704da499"]}, {"cve": "CVE-2023-2624", "desc": "The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator", "poc": ["http://packetstormsecurity.com/files/174895/WordPress-KiviCare-3.2.0-Cross-Site-Scripting.html", "https://wpscan.com/vulnerability/dc3a841d-a95b-462e-be4b-acaa44e77264"]}, {"cve": "CVE-2023-0497", "desc": "The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/ae5b7776-9d0d-4db8-81c3-237b16cd9c62"]}, {"cve": "CVE-2023-43650", "desc": "JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code, ranging from 000000 to 999999, to facilitate the password reset. Although the code is only available in 1 minute, this window potentially allows for up to 1,000,000 validation attempts. This issue has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25102", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_dmvpn function with the hub_ip and the hub_gre_ip variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-0079", "desc": "The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/fdaba4d1-950d-4512-95de-cd43fe9e73e5/"]}, {"cve": "CVE-2023-23455", "desc": "atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).", "poc": ["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2965c7be0522eaa18808684b7b82b248515511b", "https://github.com/ARPSyndicate/cvemon", "https://github.com/alopresto/epss_api_demo", "https://github.com/alopresto6m/epss_api_demo"]}, {"cve": "CVE-2023-7156", "desc": "A vulnerability has been found in Campcodes Online College Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file index.php of the component Search. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249178 is the identifier assigned to this vulnerability.", "poc": ["https://medium.com/@heishou/libsystem-foreground-sql-injection-vulnerability-95b95ab64ccc"]}, {"cve": "CVE-2023-52464", "desc": "In the Linux kernel, the following vulnerability has been resolved:EDAC/thunderx: Fix possible out-of-bounds string accessEnabling -Wstringop-overflow globally exposes a warning for a common bugin the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ...Apparently the author of this driver expected strncat() to behave theway that strlcat() does, which uses the size of the destination bufferas its third argument rather than the length of the source buffer. Theresult is that there is no check on the size of the allocated buffer.Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ]", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33951", "desc": "A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-37305", "desc": "An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php, hidden users can be exposed via public interfaces.", "poc": ["https://phabricator.wikimedia.org/T326952"]}, {"cve": "CVE-2023-25187", "desc": "An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factory-time installed) default SSH public/private key values that are specific to a network operator. As a result, the CSP internal BTS network SSH server (disabled by default) continues to apply the default SSH public/private key values. These keys don't give access to BTS, because service user authentication is username/password-based on top of SSH. Nokia factory installed default SSH keys are meant to be changed from operator-specific values during the BTS deployment commissioning phase. However, before the 21B release, BTS commissioning manuals did not provide instructions to change default SSH keys (to BTS operator-specific values). This leads to a possibility for malicious operations staff (inside a CSP network) to attempt MITM exploitation of BTS service user access, during the moments that SSH is enabled for Nokia service personnel to perform troubleshooting activities.", "poc": ["http://packetstormsecurity.com/files/173055/Nokia-ASIKA-7.13.52-Private-Key-Disclosure.html"]}, {"cve": "CVE-2023-52264", "desc": "The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2485", "desc": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/407830"]}, {"cve": "CVE-2023-51508", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.This issue affects Database Cleaner: Clean, Optimize & Repair: from n/a through 0.9.8.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20918", "desc": "In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Trinadh465/platform_frameworks_base_CVE-2023-20918", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/pazhanivel07/platform_frameworks_base_AOSP_10_r33_CVE-2023-20918"]}, {"cve": "CVE-2023-4561", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.4.", "poc": ["https://huntr.dev/bounties/d4302a0d-db62-4d76-93dd-e6e6473e057a"]}, {"cve": "CVE-2023-2954", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.", "poc": ["https://huntr.dev/bounties/47f08086-aaae-4ca7-b0ca-24c616d3ad7d", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-36368", "desc": "An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/Sedar2024/Sedar"]}, {"cve": "CVE-2023-25770", "desc": "Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37530", "desc": "A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information.", "poc": ["https://github.com/kaje11/CVEs"]}, {"cve": "CVE-2023-31679", "desc": "Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter.", "poc": ["https://github.com/zzh-newlearner/record/blob/main/yingshi_privacy.md"]}, {"cve": "CVE-2023-50811", "desc": "An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the \u201ccomputer\u201d POST parameter related to the ID of a specific reception by POST HTTP request interception. Iterating that parameter, it has been possible to access to the application and take control of many other receptions in addition the assigned one.", "poc": ["https://www.gruppotim.it/it/footer/red-team.html", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-46245", "desc": "Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.", "poc": ["https://github.com/kimai/kimai/security/advisories/GHSA-fjhg-96cp-6fcw"]}, {"cve": "CVE-2023-29905", "desc": "H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/H1IFt1Jgn"]}, {"cve": "CVE-2023-32575", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <=\u00a01.3.25 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36427", "desc": "Windows Hyper-V Elevation of Privilege Vulnerability", "poc": ["https://github.com/WinMin/awesome-vm-exploit", "https://github.com/aneasystone/github-trending", "https://github.com/iakat/stars", "https://github.com/johe123qwe/github-trending", "https://github.com/katlol/stars", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sampsonv/github-trending", "https://github.com/tandasat/CVE-2023-36427", "https://github.com/tanjiti/sec_profile", "https://github.com/unresolv/stars", "https://github.com/zengzzzzz/golang-trending-archive"]}, {"cve": "CVE-2023-26616", "desc": "D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the URL field in SetParentsControlInfo.", "poc": ["https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1/SetParentsControlInfo"]}, {"cve": "CVE-2023-1445", "desc": "A vulnerability classified as problematic has been found in Filseclab Twister Antivirus 8. Affected is the function 0x80112053 in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. VDB-223290 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1445", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-50949", "desc": "IBM QRadar SIEM 7.5 could allow an unauthorized user to perform unauthorized actions due to improper certificate validation. IBM X-Force ID: 275706.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6949", "desc": "** DISPUTED ** A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate and download videos and pictures saved on the drone internal or external memory without requiring any kind of authentication.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43580", "desc": "A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-24393", "desc": "Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Animated Number Counters plugin <=\u00a01.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26049", "desc": "Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `\"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE=\"b; JSESSIONID=1337; c=d\"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.", "poc": ["https://github.com/hshivhare67/Jetty_v9.4.31_CVE-2023-26049", "https://github.com/muneebaashiq/MBProjects", "https://github.com/nidhi7598/jetty-9.4.31_CVE-2023-26049", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2756", "desc": "SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.", "poc": ["https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44"]}, {"cve": "CVE-2023-33276", "desc": "The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 responds with a \"404 - Not Found\" status code if a path is accessed that does not exist. However, the value of the path is reflected in the response. As the application will reflect the supplied path without context-sensitive HTML encoding, it is vulnerable to reflective cross-site scripting (XSS).", "poc": ["https://www.syss.de/en/responsible-disclosure-policy", "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-016.txt"]}, {"cve": "CVE-2023-51141", "desc": "An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-46847", "desc": "Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.", "poc": ["https://github.com/MegaManSec/Squid-Security-Audit", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49428", "desc": "Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.", "poc": ["https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetOnlineDevName.md"]}, {"cve": "CVE-2023-52497", "desc": "In the Linux kernel, the following vulnerability has been resolved:erofs: fix lz4 inplace decompressionCurrently EROFS can map another compressed buffer for inplacedecompression, that was used to handle the cases that some pages ofcompressed data are actually not in-place I/O.However, like most simple LZ77 algorithms, LZ4 expects the compresseddata is arranged at the end of the decompressed buffer and itexplicitly uses memmove() to handle overlapping: __________________________________________________________ |_ direction of decompression --> ____ |_ compressed data _|Although EROFS arranges compressed data like this, it typically maps twoindividual virtual buffers so the relative order is uncertain.Previously, it was hardly observed since LZ4 only uses memmove() forshort overlapped literals and x86/arm64 memmove implementations seem tocompletely cover it up and they don't have this issue. Juhyung reportedthat EROFS data corruption can be found on a new Intel x86 processor.After some analysis, it seems that recent x86 processors with the newFSRM feature expose this issue with \"rep movsb\".Let's strictly use the decompressed buffer for lz4 inplacedecompression for now. Later, as an useful improvement, we could tryto tie up these two buffers together in the correct order.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38428", "desc": "An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read.", "poc": ["https://github.com/chenghungpan/test_data", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25750", "desc": "Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox < 111.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1814733"]}, {"cve": "CVE-2023-1667", "desc": "A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21884", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51011", "desc": "TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanPriDns parameter\u2019 of the setLanConfig interface of the cstecgi .cgi", "poc": ["https://815yang.github.io/2023/12/11/EX1800T/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setLanConfig-lanPriDns/"]}, {"cve": "CVE-2023-51622", "desc": "D-Link DIR-X3260 prog.cgi SetTriggerPPPoEValidate Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21672.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47703", "desc": "IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 271197.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31465", "desc": "An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.", "poc": ["https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-31465.md"]}, {"cve": "CVE-2023-6012", "desc": "An improper input validation vulnerability has been found in Lanaccess ONSAFE MonitorHM affecting version 3.7.0. This vulnerability could lead a remote attacker to exploit the checkbox element and perform remote code execution, compromising the entire infrastructure.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1878", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/93f981a3-231d-460d-a239-bb960e8c2fdc"]}, {"cve": "CVE-2023-36844", "desc": "A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.Using a crafted request an attacker is able to modify certain PHP environment variables\u00a0leading to partial loss of integrity,\u00a0which may allow chaining to other vulnerabilities.This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R3-S1; * 22.4 versions prior to 22.4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.", "poc": ["http://packetstormsecurity.com/files/174397/Juniper-JunOS-SRX-EX-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Pari-Malam/CVE-2023-36844", "https://github.com/ThatNotEasy/CVE-2023-36844", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/devmehedi101/bugbounty-CVE-Report", "https://github.com/f1tao/awesome-iot-security-resource", "https://github.com/johe123qwe/github-trending", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/r3dcl1ff/CVE-2023-36844_Juniper_RCE", "https://github.com/securi3ytalent/bugbounty-CVE-Report", "https://github.com/tanjiti/sec_profile", "https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844"]}, {"cve": "CVE-2023-38346", "desc": "An issue was discovered in Wind River VxWorks 6.9 and 7. The function ``tarExtract`` implements TAR file extraction and thereby also processes files within an archive that have relative or absolute file paths. A developer using the \"tarExtract\" function may expect that the function will strip leading slashes from absolute paths or stop processing when encountering relative paths that are outside of the extraction path, unless otherwise forced. This could lead to unexpected and undocumented behavior, which in general could result in a directory traversal, and associated unexpected behavior.", "poc": ["https://www.pentagrid.ch/en/blog/wind-river-vxworks-tarextract-directory-traversal-vulnerability/", "https://github.com/f1tao/awesome-iot-security-resource"]}, {"cve": "CVE-2023-44305", "desc": "Dell DM5500 5.14.0.0, contains a Stack-based Buffer Overflow Vulnerability in the appliance. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially crafted input data.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3788", "desc": "A vulnerability, which was classified as problematic, has been found in ActiveITzone Active Super Shop CMS 2.5. This issue affects some unknown processing of the component Manage Details Page. The manipulation of the argument name/phone/address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235055.", "poc": ["https://seclists.org/fulldisclosure/2023/Jul/34", "https://www.vulnerability-lab.com/get_content.php?id=2278"]}, {"cve": "CVE-2023-23754", "desc": "An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.", "poc": ["https://github.com/Srpopty/Corax"]}, {"cve": "CVE-2023-31756", "desc": "A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running firmware Versions <= 0.1.0. 0.9.1 v5006.0 Build 220518 Rel.32480n which allows remote attackers, authenticated to the administrative web portal as an administrator user to open an operating system level shell via the 'X_TP_IfName' parameter.", "poc": ["https://github.com/StanleyJobsonAU/LongBow", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-51385", "desc": "In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.", "poc": ["https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html", "https://github.com/2048JiaLi/CVE-2023-51385", "https://github.com/FeatherStark/CVE-2023-51385", "https://github.com/GitHubForSnap/openssh-server-gael", "https://github.com/GoodPeople-ZhangSan/CVE-2023-51385_test", "https://github.com/Le1a/CVE-2023-51385", "https://github.com/LtmThink/CVE-2023-51385_test", "https://github.com/Marco-zcl/POC", "https://github.com/N0rther/CVE-2023-51385_TT", "https://github.com/Sonicrrrr/CVE-2023-51385", "https://github.com/Tachanka-zz/CVE-2023-51385_test", "https://github.com/WLaoDuo/CVE-2023-51385_poc-test", "https://github.com/WOOOOONG/CVE-2023-51385", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/farliy-hacker/CVE-2023-51385", "https://github.com/farliy-hacker/CVE-2023-51385-save", "https://github.com/firatesatoglu/iot-searchengine", "https://github.com/juev/links", "https://github.com/julienbrs/exploit-CVE-2023-51385", "https://github.com/julienbrs/malicious-exploit-CVE-2023-51385", "https://github.com/kherrick/lobsters", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/power1314520/CVE-2023-51385_test", "https://github.com/tanjiti/sec_profile", "https://github.com/thinkliving2020/CVE-2023-51385-", "https://github.com/vin01/poc-proxycommand-vulnerable", "https://github.com/watarium/poc-cve-2023-51385", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-", "https://github.com/zls1793/CVE-2023-51385_test"]}, {"cve": "CVE-2023-3318", "desc": "A vulnerability was found in SourceCodester Resort Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231937 was assigned to this vulnerability.", "poc": ["https://kr1shna4garwal.github.io/posts/cve-poc-2023/#cve-2023-3318"]}, {"cve": "CVE-2023-47150", "desc": "IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 could allow a remote user to cause a denial of service due to incorrect data handling for certain types of AES operations. IBM X-Force ID: 270602.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32284", "desc": "An out-of-bounds write vulnerability exists in the tiff_planar_adobe functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1750"]}, {"cve": "CVE-2023-21504", "desc": "Potential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.", "poc": ["https://github.com/N3vv/N3vv"]}, {"cve": "CVE-2023-40101", "desc": "In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45678", "desc": "stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m->submaps` can be 16 but `submap_floor` and `submap_residue` are declared as arrays of 15 elements. This issue may lead to code execution.", "poc": ["https://github.com/runwuf/clickhouse-test"]}, {"cve": "CVE-2023-51951", "desc": "SQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the id parameter in the manage_bo.php file.", "poc": ["https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2023-004"]}, {"cve": "CVE-2023-2745", "desc": "WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the \u2018wp_lang\u2019 parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.", "poc": ["http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html", "https://github.com/hxlxmjxbbxs/CVE-2022-3590-WordPress-Vulnerability-Scanner"]}, {"cve": "CVE-2023-44826", "desc": "Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script.", "poc": ["https://github.com/jacyyang52/chandaoxss"]}, {"cve": "CVE-2023-40518", "desc": "LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.", "poc": ["https://github.com/narfindustries/http-garden"]}, {"cve": "CVE-2023-31273", "desc": "Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.", "poc": ["https://github.com/MrTuxracer/advisories"]}, {"cve": "CVE-2023-3401", "desc": "An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/416252"]}, {"cve": "CVE-2023-1435", "desc": "The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/0ca62908-4ef5-41e0-9223-f77ad2c333d7"]}, {"cve": "CVE-2023-24540", "desc": "Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set \"\\t\\n\\f\\r\\u0020\\u2028\\u2029\" in JavaScript contexts that also contain actions may not be properly sanitized during execution.", "poc": ["https://github.com/MNeverOff/ipmi-server", "https://github.com/nao1215/golling"]}, {"cve": "CVE-2023-24278", "desc": "Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-47624", "desc": "Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their permissions) may be able to read files from the local file system due to a path traversal in the `/hls` endpoint. This issue may lead to Information Disclosure. As of time of publication, no patches are available.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-203_GHSL-2023-204_audiobookshelf/"]}, {"cve": "CVE-2023-47308", "desc": "In the module \"Newsletter Popup PRO with Voucher/Coupon code\" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method `NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.", "poc": ["https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2023-11-09-newsletterpop.md"]}, {"cve": "CVE-2023-40771", "desc": "SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function.", "poc": ["https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-2623", "desc": "The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users", "poc": ["https://wpscan.com/vulnerability/85cc39b1-416f-4d23-84c1-fdcbffb0dda0"]}, {"cve": "CVE-2023-5869", "desc": "A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5377", "desc": "Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV.", "poc": ["https://huntr.dev/bounties/fe778df4-3867-41d6-954b-211c81bccbbf", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36052", "desc": "Azure CLI REST Command Information Disclosure Vulnerability", "poc": ["https://github.com/gustavoscarl/DesafioMXM-DependencyCheck"]}, {"cve": "CVE-2023-1265", "desc": "An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/394960"]}, {"cve": "CVE-2023-45052", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in dan009 WP Bing Map Pro plugin <\u00a05.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0813", "desc": "A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52143", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout.This issue affects WP Stripe Checkout: from n/a through 1.2.2.37.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49426", "desc": "Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.", "poc": ["https://github.com/ef4tless/vuln/blob/master/iot/AX12/SetStaticRouteCfg.md"]}, {"cve": "CVE-2023-46279", "desc": "Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5.Users are recommended to upgrade to the latest version, which fixes the issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21928", "desc": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: IPS repository daemon). The supported version that is affected is 11. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 1.8 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-48914", "desc": "Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.", "poc": ["https://github.com/Tiamat-ron/cms/blob/main/There%20is%20a%20csrf%20in%20the%20newly%20added%20section%20of%20article%20management.md"]}, {"cve": "CVE-2023-46468", "desc": "An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function.", "poc": ["https://www.sumor.top/index.php/archives/875/"]}, {"cve": "CVE-2023-47691", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33144", "desc": "Visual Studio Code Spoofing Vulnerability", "poc": ["https://github.com/em1ga3l/cve-msrc-extractor", "https://github.com/gbdixg/PSMDE"]}, {"cve": "CVE-2023-5910", "desc": "A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component Web Config. The manipulation of the argument Site Title with the input leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-244229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29519", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the \"property\" field of an attachment selector, as a gadget of their own dashboard. Note that the vulnerability does not impact comments of a wiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.2, 15.0-rc-1. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://jira.xwiki.org/browse/XWIKI-20364"]}, {"cve": "CVE-2023-3366", "desc": "The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attackers to make any logged in user, delete arbitrary shipment via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/b2f06223-9352-4227-ae94-32061e2c5611"]}, {"cve": "CVE-2023-33919", "desc": "A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.", "poc": ["http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html", "http://seclists.org/fulldisclosure/2023/Jul/14"]}, {"cve": "CVE-2023-4357", "desc": "Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/20142995/sectool", "https://github.com/Marco-zcl/POC", "https://github.com/OgulcanUnveren/CVE-2023-4357-APT-Style-exploitation", "https://github.com/T0ngMystic/Vulnerability_List", "https://github.com/Threekiii/CVE", "https://github.com/WinnieZy/CVE-2023-4357", "https://github.com/aneasystone/github-trending", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/johe123qwe/github-trending", "https://github.com/kujian/githubTrending", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/passwa11/CVE-2023-4357-APT-Style-exploitation", "https://github.com/sampsonv/github-trending", "https://github.com/sunu11/chrome-CVE-2023-4357", "https://github.com/tanjiti/sec_profile", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xcanwin/CVE-2023-4357-Chrome-XXE", "https://github.com/xingchennb/POC-", "https://github.com/zoroqi/my-awesome"]}, {"cve": "CVE-2023-38252", "desc": "An out-of-bounds read flaw was found in w3m, in the Strnew_size function in Str.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.", "poc": ["https://github.com/tats/w3m/issues/270", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41793", "desc": ": Path Traversal vulnerability in Pandora FMS on all allows Path Traversal.\u00a0This vulnerability allowed changing directories and creating files and downloading them outside the allowed directories.\u00a0This issue affects Pandora FMS: from 700 through <776.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-1892", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.", "poc": ["https://huntr.dev/bounties/e35e5653-c429-4fb8-94a3-cbc123ae4777"]}, {"cve": "CVE-2023-28523", "desc": "IBM Informix Dynamic Server 12.10 and 14.10 onsmsync is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 250753.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46428", "desc": "An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49965", "desc": "SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page.", "poc": ["https://hackintoanetwork.com/blog/2023-starlink-router-gen2-xss-eng/", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hackintoanetwork/SpaceX-Starlink-Router-Gen-2-XSS", "https://github.com/hackintoanetwork/hackintoanetwork", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2857", "desc": "BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-42459", "desc": "Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm"]}, {"cve": "CVE-2023-31621", "desc": "An issue in the kc_var_col component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1130"]}, {"cve": "CVE-2023-3615", "desc": "Mattermost iOS app fails\u00a0to properly\u00a0validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection.", "poc": ["https://github.com/aapooksman/certmitm"]}, {"cve": "CVE-2023-36623", "desc": "The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC address. This allows a local user to calculate the root password and escalate privileges.", "poc": ["https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-013.txt", "https://www.syss.de/pentest-blog/root-zugang-zu-smarthome-server-loxone-miniserver-go-gen-2-syss-2023-004/-012/-013"]}, {"cve": "CVE-2023-33780", "desc": "A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the body of news article.", "poc": ["https://github.com/invernyx/smartcars-3-bugs/security/advisories/GHSA-hx8p-f8h7-5h78"]}, {"cve": "CVE-2023-48294", "desc": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to `graph.php` to access graphs generated on the particular Device. This request can be accessed by a low privilege user and they can enumerate devices on librenms with their id or hostname. Leveraging this vulnerability a low privilege user can see all devices registered by admin users. This vulnerability has been addressed in commit `489978a923` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/librenms/librenms/security/advisories/GHSA-fpq5-4vwm-78x4"]}, {"cve": "CVE-2023-45247", "desc": "Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 36497.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/password123456/cve-collector"]}, {"cve": "CVE-2023-25218", "desc": "Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC5/8/8.md"]}, {"cve": "CVE-2023-33410", "desc": "Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file.", "poc": ["https://github.com/Thirukrishnan/CVE-2023-33410", "https://github.com/Thirukrishnan/CVE-2023-33410", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5610", "desc": "The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect", "poc": ["https://wpscan.com/vulnerability/e880a9fb-b089-4f98-9781-7d946f22777e"]}, {"cve": "CVE-2023-45017", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2626", "desc": "There exists an authentication bypass vulnerability in OpenThread border router devices and implementations.\u00a0This issue allows unauthenticated nodes to craft radio frames using \u201cKey ID Mode 2\u201d: a special mode using a static encryption key to bypass security checks, resulting in arbitrary IP packets being allowed on the Thread network. This provides a pathway for an attacker to send/receive arbitrary IPv6 packets to devices on the LAN, potentially exploiting them if they lack additional authentication or contain any network vulnerabilities that would normally be mitigated by the home router\u2019s NAT firewall. Effected devices have been mitigated through an automatic update beyond the affected range.", "poc": ["https://github.com/Qorvo/QGateway"]}, {"cve": "CVE-2023-30111", "desc": "Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).", "poc": ["https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-mts_0.zip"]}, {"cve": "CVE-2023-50053", "desc": "An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce (random number)", "poc": ["https://github.com/d0scoo1/Web3AuthRA"]}, {"cve": "CVE-2023-1019", "desc": "The Help Desk WP WordPress plugin through 1.2.0 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/a6331ca8-9603-4134-af39-8e77ac9d511c"]}, {"cve": "CVE-2023-7127", "desc": "A vulnerability classified as critical was found in code-projects Automated Voting System 1.0. This vulnerability affects unknown code of the component Login. The manipulation of the argument idno leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249130 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/Automated_Voting_System/Automated_Voting_System-SQL_Injection-2.md", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-32698", "desc": "nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for enforcing it\u2019s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.", "poc": ["https://github.com/goreleaser/nfpm/security/advisories/GHSA-w7jw-q4fg-qc4c"]}, {"cve": "CVE-2023-3718", "desc": "An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands on the underlying operating system as a privileged user on the affected switch. This allows an attacker to fully compromise the underlying operating system on the device running AOS-CX.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46402", "desc": "git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.", "poc": ["https://gist.github.com/6en6ar/7c2424c93e7fbf2b6fc44e7fb9acb95d"]}, {"cve": "CVE-2023-37270", "desc": "Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.", "poc": ["https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1596", "desc": "The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/cada9be9-522a-4ce8-847d-c8fff2ddcc07", "https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-3687", "desc": "A vulnerability was found in Bylancer QuickVCard 2.1. It has been rated as critical. This issue affects some unknown processing of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack may be initiated remotely. The identifier VDB-234233 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.234233"]}, {"cve": "CVE-2023-4774", "desc": "The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46837", "desc": "Arm provides multiple helpers to clean & invalidate the cachefor a given region. This is, for instance, used when allocatingguest memory to ensure any writes (such as the ones during scrubbing)have reached memory before handing over the page to a guest.Unfortunately, the arithmetics in the helpers can overflow and wouldthen result to skip the cache cleaning/invalidation. Therefore thereis no guarantee when all the writes will reach the memory.This undefined behavior was meant to be addressed by XSA-437, but theapproach was not sufficient.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42508", "desc": "JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3159", "desc": "A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.", "poc": ["https://github.com/ethan42/linux-ieee1394"]}, {"cve": "CVE-2023-47397", "desc": "WeBid <=1.2.2 is vulnerable to code injection via admin/categoriestrans.php.", "poc": ["https://liotree.github.io/2023/webid.html"]}, {"cve": "CVE-2023-52618", "desc": "In the Linux kernel, the following vulnerability has been resolved:block/rnbd-srv: Check for unlikely string overflowSince \"dev_search_path\" can technically be as large as PATH_MAX,there was a risk of truncation when copying it and a second stringinto \"full_path\" since it was also PATH_MAX sized. The W=1 builds werereporting this warning:drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra':drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(full_path, PATH_MAX, \"%s/%s\", | ^~In function 'rnbd_srv_get_full_path', inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(full_path, PATH_MAX, \"%s/%s\", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | dev_search_path, dev_name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~To fix this, unconditionally check for truncation (as was already donefor the case where \"%SESSNAME%\" was present).", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-26609", "desc": "ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field.", "poc": ["http://packetstormsecurity.com/files/171136/ABUS-Security-Camera-TVIP-20000-21150-LFI-Remote-Code-Execution.html", "http://seclists.org/fulldisclosure/2023/Feb/16", "https://nwsec.de/NWSSA-001-2023.txt", "https://github.com/ARPSyndicate/cvemon", "https://github.com/D1G17/CVE-2023-26609", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-34317", "desc": "An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to unexpected data in the configuration. An attacker can send a sequence of requests to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1772"]}, {"cve": "CVE-2023-45869", "desc": "ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.", "poc": ["https://rehmeinfosec.de/labor/cve-2023-45869"]}, {"cve": "CVE-2023-26009", "desc": "Improper Privilege Management vulnerability in favethemes Houzez Login Register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through 2.6.3.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-25760", "desc": "Incorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated user to modify other users passwords via a crafted request payload", "poc": ["https://github.com/sT0wn-nl/CVEs"]}, {"cve": "CVE-2023-23697", "desc": "Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may potentially exploit this vulnerability leading to arbitrary folder deletion.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/ycdxsb/ycdxsb"]}, {"cve": "CVE-2023-45830", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL Injection.This issue affects Accessibility Suite by Online ADA: from n/a through 4.11.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32046", "desc": "Windows MSHTML Platform Elevation of Privilege Vulnerability", "poc": ["http://seclists.org/fulldisclosure/2023/Jul/43", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/xaitax/cisa-catalog-known-vulnerabilities"]}, {"cve": "CVE-2023-51613", "desc": "D-Link DIR-X3260 prog.cgi SetDynamicDNSSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21590.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1231", "desc": "Inappropriate implementation in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to potentially spoof the contents of the omnibox via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/KirtiRamchandani/KirtiRamchandani"]}, {"cve": "CVE-2023-6773", "desc": "A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /accounts_con/register_account of the component User Creation Handler. The manipulation of the argument account_type with the input Admin leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247909 was assigned to this vulnerability.", "poc": ["https://drive.google.com/drive/folders/1yuc1n6tr57wD8qsT0HAFDVAuii7iibDM?usp=sharing"]}, {"cve": "CVE-2023-24018", "desc": "A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 security_decrypt_password functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to a buffer overflow. An authenticated attacker can send an HTTP request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1715"]}, {"cve": "CVE-2023-50265", "desc": "Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/"]}, {"cve": "CVE-2023-2774", "desc": "A vulnerability was found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file view_branch.php. The manipulation of the argument branchid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229280.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-31425", "desc": "A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticated user to perform privilege escalation to root by breaking the rbash shell. Starting with Fabric OS v9.1.0, \u201croot\u201d account access is disabled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42917", "desc": "A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-41592", "desc": "Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.", "poc": ["https://github.com/miguelc49/CVE-2023-41592-1", "https://github.com/miguelc49/CVE-2023-41592-2", "https://github.com/miguelc49/CVE-2023-41592-3", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1819", "desc": "Out of bounds read in Accessibility in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-29582", "desc": "** DISPUTED ** yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr1 at /nasm/nasm-parse.c. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.", "poc": ["https://github.com/yasm/yasm/issues/217", "https://github.com/z1r00/fuzz_vuln/blob/main/yasm/stack-overflow/parse_expr1/readme.md", "https://github.com/ayman-m/rosetta", "https://github.com/z1r00/fuzz_vuln"]}, {"cve": "CVE-2023-45686", "desc": "Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal", "poc": ["https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/"]}, {"cve": "CVE-2023-5673", "desc": "The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.", "poc": ["https://wpscan.com/vulnerability/231f72bf-9ad0-417e-b7a0-3555875749e9"]}, {"cve": "CVE-2023-49967", "desc": "Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc.", "poc": ["https://github.com/typecho/typecho/issues/1648"]}, {"cve": "CVE-2023-24123", "desc": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet.", "poc": ["https://oxnan.com/posts/WifiBasic_wepauth_DoS"]}, {"cve": "CVE-2023-40767", "desc": "User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51075", "desc": "hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial of Service (DoS) via manipulation of the first two parameters.", "poc": ["https://github.com/dromara/hutool/issues/3421"]}, {"cve": "CVE-2023-25081", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the firewall_handler_set function with the src and dmz variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-6015", "desc": "MLflow allowed arbitrary files to be PUT onto the server.", "poc": ["https://huntr.com/bounties/43e6fb72-676e-4670-a225-15d6836f65d3", "https://github.com/shubhamkulkarni97/CVE-Presentations"]}, {"cve": "CVE-2023-42954", "desc": "A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by reducing the information sent in requests.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-2832", "desc": "SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0.", "poc": ["https://huntr.dev/bounties/37b80402-0edf-4f26-a668-b6f8b48dcdfb"]}, {"cve": "CVE-2023-28725", "desc": "General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute arbitrary Java code by uploading a Java application to the /batm/app/admin/standalone/deployments directory, aka BATM-4780, as exploited in the wild in March 2023. This is fixed in 20221118.48 and 20230120.44.", "poc": ["https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023", "https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/951418958/Update+CAS"]}, {"cve": "CVE-2023-25108", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_gre function with the remote_ip variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-34928", "desc": "A stack overflow in the Edit_BasicSSID function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", "poc": ["https://github.com/h4kuy4/vuln/blob/main/H3C_B1STW/CVE-2023-34928.md", "https://github.com/MzzdToT/HAC_Bored_Writing", "https://github.com/izj007/wechat", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-0790", "desc": "Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.", "poc": ["https://huntr.dev/bounties/06af150b-b481-4248-9a48-56ded2814156", "https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-43976", "desc": "An issue in CatoNetworks CatoClient before v.5.4.0 allows attackers to escalate privileges and winning the race condition (TOCTOU) via the PrivilegedHelperTool component.", "poc": ["https://github.com/NSEcho/vos"]}, {"cve": "CVE-2023-5517", "desc": "A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect ;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/fokypoky/places-list", "https://github.com/marklogic/marklogic-docker"]}, {"cve": "CVE-2023-31920", "desc": "Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c.", "poc": ["https://github.com/jerryscript-project/jerryscript/issues/5070", "https://github.com/EJueon/EJueon"]}, {"cve": "CVE-2023-52064", "desc": "Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php.", "poc": ["https://github.com/wuzhicms/wuzhicms/issues/208"]}, {"cve": "CVE-2023-26131", "desc": "All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting (XSS) via the themes.NoPage(filename, theme) function due to improper user input sanitization. Exploiting this vulnerability is possible when a file/resource is not found.", "poc": ["https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONENGINE-3312111", "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONTHEMES-3312112", "https://github.com/dellalibera/dellalibera"]}, {"cve": "CVE-2023-0768", "desc": "The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.", "poc": ["https://wpscan.com/vulnerability/03d061b4-1b71-44f5-b3dc-f82a5fcd92eb"]}, {"cve": "CVE-2023-2156", "desc": "A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system.", "poc": ["http://www.openwall.com/lists/oss-security/2023/05/19/1", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-52310", "desc": "PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval. This resulted in the ability to execute arbitrary commands on the operating system.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-019.md"]}, {"cve": "CVE-2023-39534", "desc": "eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, and 2.6.5 contain a patch for this issue.", "poc": ["https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0442", "desc": "The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL.", "poc": ["https://wpscan.com/vulnerability/34d95d88-4114-4597-b4db-e9f5ef80d322"]}, {"cve": "CVE-2023-2825", "desc": "An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.", "poc": ["https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/EmmanuelCruzL/CVE-2023-2825", "https://github.com/GhostTroops/TOP", "https://github.com/Occamsec/CVE-2023-2825", "https://github.com/Rubikcuv5/CVE-2023-2825", "https://github.com/Threekiii/CVE", "https://github.com/Tornad0007/CVE-2023-2825-Gitlab", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/caopengyan/CVE-2023-2825", "https://github.com/hheeyywweellccoommee/CVE-2023-2825-zaskh", "https://github.com/hktalent/TOP", "https://github.com/johe123qwe/github-trending", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4969", "desc": "A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.", "poc": ["https://blog.trailofbits.com", "https://kb.cert.org/vuls/id/446598", "https://www.kb.cert.org/vuls/id/446598", "https://github.com/trailofbits/publications"]}, {"cve": "CVE-2023-34723", "desc": "An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows attackers to gain sensitive information via /config/system.conf.", "poc": ["http://packetstormsecurity.com/files/174553/TECHView-LA5570-Wireless-Gateway-1.0.19_T53-Traversal-Privilege-Escalation.html", "https://www.exploitsecurity.io/post/cve-2023-34723-cve-2023-34724-cve-2023-34725"]}, {"cve": "CVE-2023-2339", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/bb1537a5-fe7b-4c77-a582-10a82435fbc2"]}, {"cve": "CVE-2023-33268", "desc": "An issue was discovered in DTS Monitoring 3.57.0. The parameter port within the SSL Certificate check function is vulnerable to OS command injection (blind).", "poc": ["https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33268.md", "https://github.com/dtssec/CVE-Disclosures", "https://github.com/l4rRyxz/CVE-Disclosures"]}, {"cve": "CVE-2023-32634", "desc": "An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755"]}, {"cve": "CVE-2023-24756", "desc": "libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_unweighted_pred_8_sse function at sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.", "poc": ["https://github.com/strukturag/libde265/issues/380", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-43985", "desc": "SunnyToo stblogsearch up to v1.0.0 was discovered to contain a SQL injection vulnerability via the StBlogSearchClass::prepareSearch component.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5478", "desc": "Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4800", "desc": "The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.", "poc": ["https://wpscan.com/vulnerability/7eae1434-8c7a-4291-912d-a4a07b73ee56", "https://github.com/b0marek/CVE-2023-4800", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27600", "desc": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\\n`). The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\\n`). By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue is patched in versions 3.1.7 and 3.2.4.", "poc": ["https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"]}, {"cve": "CVE-2023-45667", "desc": "stb_image is a single file MIT licensed library for processing images.If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi__vertical_flip_slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5854", "desc": "Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24775", "desc": "Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \\member\\Member.php.", "poc": ["https://github.com/funadmin/funadmin/issues/9", "https://github.com/ARPSyndicate/cvemon", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/csffs/CVE-2023-24775-and-CVE-2023-24780", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-40556", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Greg Ross Schedule Posts Calendar plugin <=\u00a05.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2859", "desc": "Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.", "poc": ["https://huntr.dev/bounties/d7b8ea75-c74a-4721-89bb-12e5c80fb0ba", "https://github.com/mnqazi/CVE-2023-2859", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-28096", "desc": "OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{\"jsonrpc\": \"2.0\",\"method\": \"log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time. To abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system\u2019s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects. The issue has been fixed in versions 3.1.8 and 3.2.5.", "poc": ["https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-2650", "desc": "Issue summary: Processing some specially crafted ASN.1 object identifiers ordata containing them may be very slow.Impact summary: Applications that use OBJ_obj2txt() directly, or use any ofthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no messagesize limit may experience notable to very long delays when processing thosemessages, which may lead to a Denial of Service.An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -most of which have no size limit. OBJ_obj2txt() may be used to translatean ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSLtype ASN1_OBJECT) to its canonical numeric text form, which are thesub-identifiers of the OBJECT IDENTIFIER in decimal form, separated byperiods.When one of the sub-identifiers in the OBJECT IDENTIFIER is very large(these are sizes that are seen as absurdly large, taking up tens or hundredsof KiBs), the translation to a decimal number in text may take a very longtime. The time complexity is O(n^2) with 'n' being the size of thesub-identifiers in bytes (*).With OpenSSL 3.0, support to fetch cryptographic algorithms using names /identifiers in string form was introduced. This includes using OBJECTIDENTIFIERs in canonical numeric text form as identifiers for fetchingalgorithms.Such OBJECT IDENTIFIERs may be received through the ASN.1 structureAlgorithmIdentifier, which is commonly used in multiple protocols to specifywhat cryptographic algorithm should be used to sign or verify, encrypt ordecrypt, or digest passed data.Applications that call OBJ_obj2txt() directly with untrusted data areaffected, with any version of OpenSSL. If the use is for the mere purposeof display, the severity is considered low.In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,CMS, CMP/CRMF or TS. It also impacts anything that processes X.509certificates, including simple things like verifying its signature.The impact on TLS is relatively low, because all versions of OpenSSL have a100KiB limit on the peer's certificate chain. Additionally, this onlyimpacts clients, or servers that have explicitly enabled clientauthentication.In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,such as X.509 certificates. This is assumed to not happen in such a waythat it would cause a Denial of Service, so these versions are considerednot affected by this issue in such a way that it would be cause for concern,and the severity is therefore considered low.", "poc": ["https://github.com/VladimirPilip2004/Conteiner_HW03", "https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hshivhare67/OpenSSL_1.1.1g_CVE-2023-2650", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tquizzle/clamav-alpine"]}, {"cve": "CVE-2023-4725", "desc": "The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/e9b9a594-c960-4692-823e-23fc60cca7e7"]}, {"cve": "CVE-2023-37836", "desc": "libjpeg commit db33a6e was discovered to contain a reachable assertion via BitMapHook::BitMapHook at bitmaphook.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.", "poc": ["https://github.com/thorfdbg/libjpeg/issues/87#BUG1", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24346", "desc": "D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the wan_connected parameter at /goform/formEasySetupWizard3.", "poc": ["https://github.com/1160300418/Vuls/tree/main/D-Link/DIR-605L/02"]}, {"cve": "CVE-2023-21220", "desc": "there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-264590585References: N/A", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50966", "desc": "erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-31024", "desc": "NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause stack memory corruption by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3150", "desc": "A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file posts\\manage_post.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231019.", "poc": ["https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md"]}, {"cve": "CVE-2023-0252", "desc": "The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/5754a4fd-1adf-47aa-976f-3b28750058c2"]}, {"cve": "CVE-2023-49906", "desc": "A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `ssid` parameter at offset `0x0045ab7c` of the `httpd_portal` binary shipped with v5.1.0 Build 20220926 of the EAP225.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38097", "desc": "NETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the BkreProcessThread class. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.. Was ZDI-CAN-19719.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5921", "desc": "Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass.This issue affects Geodi: before 8.0.0.27396.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3899", "desc": "A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28853", "desc": "Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform LDAP injection attack to leak arbitrary attributes from LDAP database. This issue is fixed in versions 3.5.8, 4.0.4, and 4.1.2.", "poc": ["http://www.openwall.com/lists/oss-security/2023/07/06/6", "https://github.com/mastodon/mastodon/security/advisories/GHSA-38g9-pfm9-gfqv"]}, {"cve": "CVE-2023-25459", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Postsnippets Post Snippets plugin <=\u00a04.0.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46889", "desc": "Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi access point. In this phase, MSH30Q needs to connect to the Internet through a Wi-Fi router. This is why MSH30Q asks for the Wi-Fi network name (SSID) and the Wi-Fi network password. When the user enters the password, the transmission of the Wi-Fi password and name between the MSH30Q and mobile application is observed in the Wi-Fi network. Although the Wi-Fi password is encrypted, a part of the decryption algorithm is public so we complemented the missing parts to decrypt it.", "poc": ["https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219"]}, {"cve": "CVE-2023-39642", "desc": "Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display().", "poc": ["https://security.friendsofpresta.org/modules/2023/08/29/cartsguru.html"]}, {"cve": "CVE-2023-35016", "desc": "IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 257772.", "poc": ["https://www.ibm.com/support/pages/node/7014397"]}, {"cve": "CVE-2023-51025", "desc": "TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to an unauthorized arbitrary command execution in the \u2018admuser\u2019 parameter of the setPasswordCfg interface of the cstecgi .cgi.", "poc": ["https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B20220316setPasswordCfg-admuser/"]}, {"cve": "CVE-2023-39777", "desc": "A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.", "poc": ["https://gist.github.com/GiongfNef/8fe658dce4c7fcf3a7b4e6387e50141c"]}, {"cve": "CVE-2023-2224", "desc": "The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["http://packetstormsecurity.com/files/173725/WordPress-Seo-By-10Web-Cross-Site-Scripting.html", "https://wpscan.com/vulnerability/a76b6d22-1e00-428a-8a04-12162bd0d992"]}, {"cve": "CVE-2023-43887", "desc": "Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::dump.", "poc": ["https://github.com/strukturag/libde265/issues/418"]}, {"cve": "CVE-2023-38650", "desc": "Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is not zero.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46278", "desc": "Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huge storage space or cause significantly delayed communication.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39113", "desc": "ngiflib commit fb271 was discovered to contain a segmentation violation via the function \"main\" at gif2tag.c. This vulnerability is triggered when running the program gif2tga.", "poc": ["https://github.com/miniupnp/ngiflib/issues/27"]}, {"cve": "CVE-2023-0780", "desc": "Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.", "poc": ["https://huntr.dev/bounties/801efd0b-404b-4670-961a-12a986252fa4"]}, {"cve": "CVE-2023-6981", "desc": "The WP SMS \u2013 Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id' parameter in all versions up to, and including, 6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can leveraged to achieve Reflected Cross-site Scripting.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43533", "desc": "Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38141", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/175096/Microsoft-Windows-Kernel-Race-Condition-Memory-Corruption.html"]}, {"cve": "CVE-2023-2854", "desc": "BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-27748", "desc": "BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware. This can allow attackers to upload crafted firmware which contains backdoors and enables arbitrary code execution.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/eyJhb/blackvue-cve-2023"]}, {"cve": "CVE-2023-1448", "desc": "A vulnerability, which was classified as problematic, was found in GPAC 2.3-DEV-rev35-gbbca86917-master. This affects the function gf_m2ts_process_sdt of the file media_tools/mpegts.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-223293 was assigned to this vulnerability.", "poc": ["https://github.com/gpac/gpac/issues/2388"]}, {"cve": "CVE-2023-2805", "desc": "The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/bdb75c8c-87e2-4358-ad3b-f4236e9a43c0"]}, {"cve": "CVE-2023-27073", "desc": "A Cross-Site Request Forgery (CSRF) in Online Food Ordering System v1.0 allows attackers to change user details and credentials via a crafted POST request.", "poc": ["https://github.com/bhaveshkush007/CVEs/blob/main/CVE-2023-27073.txt"]}, {"cve": "CVE-2023-38300", "desc": "A certain software build for the Orbic Maui device (Orbic/RC545L/RC545L:10/ORB545L_V1.4.2_BVZPP/230106:user/release-keys) leaks the IMEI and the ICCID to system properties that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in this instance they are leaked by a high-privilege process and can be obtained indirectly. This malicious app reads from the \"persist.sys.verizon_test_plan_imei\" system property to indirectly obtain the IMEI and reads the \"persist.sys.verizon_test_plan_iccid\" system property to obtain the ICCID.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49583", "desc": "SAP\u00a0BTP\u00a0Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.", "poc": ["https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47248", "desc": "Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/linhkolor/BankChurn_CatBoost", "https://github.com/linhkolor/SalesPrediction_LightGBM"]}, {"cve": "CVE-2023-39410", "desc": "When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40754", "desc": "In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26965", "desc": "loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.", "poc": ["https://github.com/13579and2468/Wei-fuzz"]}, {"cve": "CVE-2023-1166", "desc": "The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).", "poc": ["https://wpscan.com/vulnerability/825eccf9-f351-4a5b-b238-9969141b94fa"]}, {"cve": "CVE-2023-48624", "desc": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52226", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50848", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.34.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48928", "desc": "Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open Redirect. The 'path' parameter of the prefs.asp resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.", "poc": ["https://github.com/MatJosephs/CVEs/tree/main/CVE-2023-48928", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31779", "desc": "Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in \"Reaction to comment\" feature.", "poc": ["https://github.com/jet-pentest/CVE-2023-31779", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-48861", "desc": "DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitrary code via urlmon.dll.", "poc": ["https://github.com/xieqiang11/POC4/blob/main/README.md"]}, {"cve": "CVE-2023-52429", "desc": "dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2437", "desc": "The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. An attacker can leverage CVE-2023-2448 and CVE-2023-2446 to get the user's email address to successfully exploit this vulnerability.", "poc": ["http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html", "https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681", "https://github.com/RxRCoder/CVE-2023-2437", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-22893", "desc": "Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.", "poc": ["https://github.com/strapi/strapi/releases", "https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve", "https://www.ghostccamm.com/blog/multi_strapi_vulns/", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-4542", "desc": "A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238047. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/PumpkinBridge/cve/blob/main/rce.md", "https://github.com/20142995/sectool", "https://github.com/tanjiti/sec_profile", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC"]}, {"cve": "CVE-2023-52305", "desc": "FPE in paddle.topk\u00a0in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-014.md"]}, {"cve": "CVE-2023-2330", "desc": "The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/fa8ccdd0-7b23-4b12-9aa9-4b29d47256b8"]}, {"cve": "CVE-2023-4485", "desc": "ARDEREG\u00a0\u200bSistema SCADA Central versions 2.203 and priorlogin page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, the vulnerability could allow an attacker to execute arbitrary SQL queries through the login page, potentially leading to unauthorized access, data leakage, or even disruption of critical industrial processes.", "poc": ["https://github.com/Hritikpatel/InsecureTrust_Bank", "https://github.com/Hritikpatel/SecureTrust_Bank", "https://github.com/futehc/tust5"]}, {"cve": "CVE-2023-36357", "desc": "An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.", "poc": ["https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/5/TL-WR941ND_TL-WR940N_TL-WR841N_userRpm_LocalManageControlRpm.md"]}, {"cve": "CVE-2023-22484", "desc": "cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.", "poc": ["https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r"]}, {"cve": "CVE-2023-29975", "desc": "An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification.", "poc": ["https://www.esecforte.com/cve-2023-29975-unverified-password-changed/"]}, {"cve": "CVE-2023-40812", "desc": "OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.", "poc": ["https://www.esecforte.com/cve-2023-40812-html-injection-accounts-group/"]}, {"cve": "CVE-2023-22482", "desc": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an `aud` (audience) claim in signed tokens. The value of that claim specifies the intended audience(s) of the token (i.e. the service or services which are meant to accept the token). Argo CD _does_ validate that the token was signed by Argo CD's configured OIDC provider. But Argo CD _does not_ validate the audience claim, so it will accept tokens that are not intended for Argo CD. If Argo CD's configured OIDC provider also serves other audiences (for example, a file storage service), then Argo CD will accept a token intended for one of those other audiences. Argo CD will grant the user privileges based on the token's `groups` claim, even though those groups were not intended to be used by Argo CD. This bug also increases the impact of a stolen token. If an attacker steals a valid token for a different audience, they can use it to access Argo CD. A patch for this vulnerability has been released in versions 2.6.0-rc3, 2.5.6, 2.4.19, and 2.3.13. There are no workarounds.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Threekiii/CVE"]}, {"cve": "CVE-2023-4478", "desc": "Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0270", "desc": "The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/ca3ca694-54ca-4e7e-82e6-33aa240754e1"]}, {"cve": "CVE-2023-39681", "desc": "Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php. This vulnerability is triggered via a crafted payload.", "poc": ["https://github.com/yanbochen97/CuppaCMS_RCE"]}, {"cve": "CVE-2023-32802", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <=\u00a01.9.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6672", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in National Keep Cyber Security Services CyberMath allows Stored XSS.This issue affects CyberMath: from v1.4 before v1.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4597", "desc": "The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["http://packetstormsecurity.com/files/174604/WordPress-Slimstat-Analytics-5.0.9-Cross-Site-Scripting-SQL-Injection.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5452", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.", "poc": ["https://huntr.dev/bounties/d6ed5ac1-2ad6-45fd-9492-979820bf60c8"]}, {"cve": "CVE-2023-46713", "desc": "An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27601", "desc": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\\n`). The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\\n`): By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.", "poc": ["https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"]}, {"cve": "CVE-2023-28663", "desc": "The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the \u2018fieldmap\u2019 parameter in the fpropdf_export_file action.", "poc": ["https://www.tenable.com/security/research/tra-2023-2", "https://github.com/ARPSyndicate/cvemon", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-44264", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Arrow Plugins The Awesome Feed \u2013 Custom Feed plugin <=\u00a02.2.5 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45612", "desc": "In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE", "poc": ["https://github.com/password123456/cve-collector"]}, {"cve": "CVE-2023-33111", "desc": "Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21398", "desc": "In sdksandbox, there is a possible strandhogg style overlay attack due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52440", "desc": "In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()If authblob->SessionKey.Length is bigger than session keysize(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes.cifs_arc4_crypt copy to session key array from SessionKey from client.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2427", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.", "poc": ["https://huntr.dev/bounties/89005a6d-d019-4cb7-ae88-486d2d44190d"]}, {"cve": "CVE-2023-1200", "desc": "A vulnerability was found in ehuacui bbs. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-222388.", "poc": ["https://vuldb.com/?id.222388"]}, {"cve": "CVE-2023-7141", "desc": "A vulnerability was found in code-projects Client Details System 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/update-clients.php. The manipulation of the argument uid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249144.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/Client_Details_System/Client_Details_System-SQL_Injection_5.md", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-6626", "desc": "The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/327ae124-79eb-4e07-b029-e4f543cbd356/"]}, {"cve": "CVE-2023-4443", "desc": "A vulnerability classified as critical has been found in SourceCodester Free Hospital Management System for Small Practices 1.0/5.0.12. Affected is an unknown function of the file vm\\doctor\\edit-doc.php. The manipulation of the argument id00/nic/oldemail/email/spec/Tele leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237564.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4445", "desc": "A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20230811. Affected by this issue is some unknown functionality of the file product/1/1?test=1&test2=2&. The manipulation of the argument orderBy leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-237566 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20178", "desc": "A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established.\nThis vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw", "https://github.com/DarkFunct/CVE_Exploits", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/Wh04m1001/CVE-2023-20178", "https://github.com/XalfiE/CVE-2023-20178_", "https://github.com/aneasystone/github-trending", "https://github.com/em1ga3l/cve-msrc-extractor", "https://github.com/johe123qwe/github-trending", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/xct/CVE-2024-27460"]}, {"cve": "CVE-2023-46858", "desc": "** DISPUTED ** Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states \"Some forms of rich content [are] used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not.\"", "poc": ["https://packetstormsecurity.com/files/175277/Moodle-4.3-Cross-Site-Scripting.html", "https://github.com/capture0x/My-CVE"]}, {"cve": "CVE-2023-5178", "desc": "A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rockrid3r/CVE-2023-5178", "https://github.com/shakyaraj9569/Documentation"]}, {"cve": "CVE-2023-41804", "desc": "Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates \u2014 Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates \u2014 Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26922", "desc": "SQL injection vulnerability found in Varisicte matrix-gui v.2 allows a remote attacker to execute arbitrary code via the shell_exect parameter to the \\www\\pages\\matrix-gui-2.0 endpoint.", "poc": ["https://github.com/varigit/matrix-gui-v2/issues/1"]}, {"cve": "CVE-2023-29809", "desc": "SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbitrary code via a crafted script in the request.", "poc": ["https://packetstormsecurity.com/files/172146/Companymaps-8.0-SQL-Injection.html", "https://www.exploit-db.com/exploits/51422", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zPrototype/CVE-2023-29809"]}, {"cve": "CVE-2023-28527", "desc": "IBM Informix Dynamic Server 12.10 and 14.10 cdr is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault. IBM X-Force ID: 251206.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4179", "desc": "A vulnerability classified as critical has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected is an unknown function of the file /vm/doctor/doctors.php?action=view. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-236214 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/Yesec/Free-Hospital-Management-System-for-Small-Practices/blob/main/SQL%20Injection%20in%20doctors.php/vuln.md"]}, {"cve": "CVE-2023-39784", "desc": "Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the save_virtualser_data function.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29343", "desc": "SysInternals Sysmon for Windows Elevation of Privilege Vulnerability", "poc": ["https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/DarkFunct/CVE_Exploits", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/Wh04m1001/CVE-2023-29343", "https://github.com/aneasystone/github-trending", "https://github.com/hktalent/TOP", "https://github.com/johe123qwe/github-trending", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3428", "desc": "A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4776", "desc": "The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.", "poc": ["https://wpscan.com/vulnerability/59dd3917-01cb-479f-a557-021b2a5147df"]}, {"cve": "CVE-2023-22671", "desc": "Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input.", "poc": ["https://github.com/NationalSecurityAgency/ghidra/issues/4869"]}, {"cve": "CVE-2023-4124", "desc": "Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.", "poc": ["https://huntr.dev/bounties/2c684f99-d181-4106-8ee2-64a76ae6a348"]}, {"cve": "CVE-2023-37288", "desc": "SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50849", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf \u2013 Export To Pdf Tool for WordPress.This issue affects E2Pdf \u2013 Export To Pdf Tool for WordPress: from n/a through 1.20.23.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0099", "desc": "The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["http://packetstormsecurity.com/files/176983/WordPress-Simple-URLs-Cross-Site-Scripting.html", "https://wpscan.com/vulnerability/fd50f2d6-e420-4220-b485-73f33227e8f8", "https://github.com/ARPSyndicate/cvemon", "https://github.com/amirzargham/CVE-2023-0099-exploit", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/xu-xiang/awesome-security-vul-llm"]}, {"cve": "CVE-2023-40278", "desc": "An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message.", "poc": ["https://github.com/BugBountyHunterCVE/CVE-2023-40278", "https://github.com/NaInSec/CVE-LIST", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30586", "desc": "A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process's stack memory to locate the permission model Permission::enabled_ in the host process's heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.", "poc": ["https://github.com/chnzzh/OpenSSL-CVE-lib"]}, {"cve": "CVE-2023-50002", "desc": "Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode.", "poc": ["https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_rebootMesh/w30e_rebootMesh.md"]}, {"cve": "CVE-2023-2901", "desc": "A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /SystemManage/User/GetGridJson?_search=false&nd=1680855479750&rows=50&page=1&sidx=F_CreatorTime+desc&sord=asc. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229975. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/NFine%20rapid%20development%20platform%20User-GetGridJson%20has%20unauthorized%20access%20vulnerability.md", "https://vuldb.com/?id.229975"]}, {"cve": "CVE-2023-27730", "desc": "Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh.c.", "poc": ["https://github.com/nginx/njs/issues/615"]}, {"cve": "CVE-2023-47148", "desc": "IBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper validation of unsecured endpoints which could be used in further attacks against the system. IBM X-Force ID: 270599.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28826", "desc": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS Sonoma 14.1, macOS Ventura 13.6.5. An app may be able to access sensitive user data.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44393", "desc": "Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted `plugin_id` value. When a victim who is logged in as an administrator visits this URL, the malicious code will be injected into the HTML page and executed. This vulnerability can be exploited by any attacker who has access to a malicious URL. However, only users who are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page, which is only accessible to administrators. Version 14.0.0.beta4 contains a patch for this issue.", "poc": ["https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg"]}, {"cve": "CVE-2023-21862", "desc": "Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Web Services Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-20105", "desc": "A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with Read-only credentials to elevate privileges to Administrator on an affected system.\nThis vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by authenticating to the application as a Read-only user and sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to alter the passwords of any user on the system, including an administrative user, and then impersonate that user.\nNote: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48122", "desc": "An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.", "poc": ["https://github.com/microweber/microweber/issues/1042"]}, {"cve": "CVE-2023-49085", "desc": "Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.", "poc": ["http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-20188", "desc": "A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device.\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to view a page containing malicious HTML or script content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need to have valid credentials to access the web-based management interface of the affected device.\nCisco has not released software updates to address this vulnerability.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-4033", "desc": "OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.", "poc": ["https://huntr.dev/bounties/5312d6f8-67a5-4607-bd47-5e19966fa321"]}, {"cve": "CVE-2023-52437", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29985", "desc": "Sourcecodester Student Study Center Desk Management System v1.0 admin\\reports\\index.php#date_from has a SQL Injection vulnerability.", "poc": ["https://liaorj.github.io/2023/03/17/admin-reports-date-from-has-sql-injection-vulnerability/#more"]}, {"cve": "CVE-2023-37573", "desc": "Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI's recoder (default) VCD parsing code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21335", "desc": "In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29506", "desc": "XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.", "poc": ["https://jira.xwiki.org/browse/XWIKI-20335"]}, {"cve": "CVE-2023-36624", "desc": "Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration. This allows the elevated execution of binaries without a password requirement.", "poc": ["https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-004.txt", "https://www.syss.de/pentest-blog/root-zugang-zu-smarthome-server-loxone-miniserver-go-gen-2-syss-2023-004/-012/-013"]}, {"cve": "CVE-2023-41642", "desc": "Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter.", "poc": ["https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41642%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md", "https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md"]}, {"cve": "CVE-2023-34872", "desc": "A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.", "poc": ["https://gitlab.freedesktop.org/poppler/poppler/-/issues/1399"]}, {"cve": "CVE-2023-30770", "desc": "A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation. An attacker can exploit this vulnerability to execute arbitrary code. Affected ADM versions include: 4.0.6.REG2, 4.1.0 and below as well as 4.2.0.RE71 and below.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-7006", "desc": "The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity.", "poc": ["https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29085", "desc": "An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP status line.", "poc": ["http://packetstormsecurity.com/files/172288/Shannon-Baseband-SIP-Status-Line-Stack-Buffer-Overflow.html"]}, {"cve": "CVE-2023-3316", "desc": "A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.", "poc": ["https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/"]}, {"cve": "CVE-2023-1989", "desc": "A use-after-free flaw was found in btsdio_remove in drivers\\bluetooth\\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices.", "poc": ["https://github.com/evdenis/cvehound"]}, {"cve": "CVE-2023-49078", "desc": "raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In version 0.4.4 of raptor-web, it is possible to craft a malicious URL that will result in a reflected cross-site scripting vulnerability. A user controlled URL parameter is loaded into an internal template that has autoescape disabled. This is a cross-site scripting vulnerability that affects all deployments of `raptor-web` on version `0.4.4`. Any victim who clicks on a malicious crafted link will be affected. This issue has been patched 0.4.4.1.", "poc": ["https://github.com/zediious/raptor-web/security/advisories/GHSA-8r6g-fhh4-xhmq"]}, {"cve": "CVE-2023-51624", "desc": "D-Link DCS-8300LHV2 RTSP ValidateAuthorizationHeader Nonce Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the Authorization header by the RTSP server, which listens on TCP port 554. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20072.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45815", "desc": "ArchiveBox is an open source self-hosted web archiving system. Any users who are using the `wget` extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to target your ArchiveBox instance. Malicious Javascript could potentially act using your logged-in admin credentials and add/remove/modify snapshots, add/remove/modify ArchiveBox users, and generally do anything an admin user could do. The impact is less severe for non-logged-in users, as malicious Javascript cannot *modify* any archives, but it can still *read* all the other archived content by fetching the snapshot index and iterating through it. Because all of ArchiveBox's archived content is served from the same host and port as the admin panel, when archived pages are viewed the JS executes in the same context as all the other archived pages (and the admin panel), defeating most of the browser's usual CORS/CSRF security protections and leading to this issue. A patch is being developed in https://github.com/ArchiveBox/ArchiveBox/issues/239. As a mitigation for this issue would be to disable the wget extractor by setting `archivebox config --set SAVE_WGET=False`, ensure you are always logged out, or serve only a [static HTML version](https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archive#2-export-and-host-it-as-static-html) of your archive.", "poc": ["https://github.com/ArchiveBox/ArchiveBox"]}, {"cve": "CVE-2023-4878", "desc": "Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.", "poc": ["https://huntr.dev/bounties/655c4f77-04b2-4220-bfaf-a4d99fe86703"]}, {"cve": "CVE-2023-36950", "desc": "TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.", "poc": ["https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/loginauth.md"]}, {"cve": "CVE-2023-49973", "desc": "A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter at /customer_support/index.php?page=customer_list.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/geraldoalcantara/CVE-2023-49973", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-49291", "desc": "tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. As a result an attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions. This vulnerability has been addressed in version 7.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://securitylab.github.com/research/github-actions-untrusted-input"]}, {"cve": "CVE-2023-43281", "desc": "Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbi_load_gif_main function.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35985", "desc": "An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted malicious site if the browser plugin extension is enabled.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1834", "https://github.com/SpiralBL0CK/-CVE-2023-35985", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-52306", "desc": "FPE in paddle.lerp\u00a0in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-015.md"]}, {"cve": "CVE-2023-39141", "desc": "webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.", "poc": ["https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e", "https://github.com/codeb0ss/CVE-2023-39141-PoC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-21721", "desc": "Microsoft OneNote Elevation of Privilege Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Ch0pin/related_work"]}, {"cve": "CVE-2023-1380", "desc": "A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.", "poc": ["http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html", "http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html"]}, {"cve": "CVE-2023-36693", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez WP RSS Images plugin <=\u00a01.1 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-21036", "desc": "In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidVersions: Android kernelAndroid ID: A-264261868References: N/A", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/cafedork/acropolypse-bot", "https://github.com/dorkeline/acropolypse-bot", "https://github.com/frankthetank-music/Acropalypse-Multi-Tool", "https://github.com/heriet/acropalypse-gif", "https://github.com/hktalent/TOP", "https://github.com/infobyte/CVE-2023-21036", "https://github.com/lordofpipes/acropadetect", "https://github.com/maddiethecafebabe/discord-acropolypse-bot", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/notaSWE/gocropalypse", "https://github.com/qixils/AntiCropalypse", "https://github.com/qixils/anticropalypse", "https://github.com/s1lver-lining/Starlight"]}, {"cve": "CVE-2023-39419", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2363", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. This issue affects some unknown processing of the file view_room.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227639.", "poc": ["https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Resort_Reservation_System-SQL-Injection-1.md"]}, {"cve": "CVE-2023-36160", "desc": "An issue was discovered in Qubo Smart Plug10A version HSP02_01_01_14_SYSTEM-10 A, allows local attackers to gain sensitive information and other unspecified impact via UART console.", "poc": ["https://github.com/Yashodhanvivek/Qubo_smart_switch_security_assessment"]}, {"cve": "CVE-2023-6567", "desc": "The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018order_by\u2019 parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "poc": ["https://github.com/mimiloveexe/CVE-2023-6567-poc", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/toxyl/lscve"]}, {"cve": "CVE-2023-3479", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.", "poc": ["https://huntr.dev/bounties/6ac5cf87-6350-4645-8930-8f2876427723"]}, {"cve": "CVE-2023-50332", "desc": "Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user's intention.", "poc": ["https://github.com/a-zara-n/a-zara-n"]}, {"cve": "CVE-2023-43147", "desc": "PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI.", "poc": ["https://github.com/MinoTauro2020/CVE-2023-43147/", "https://github.com/MinoTauro2020/CVE-2023-43147", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-49164", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29575", "desc": "Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.", "poc": ["https://github.com/axiomatic-systems/Bento4/issues/842", "https://github.com/z1r00/fuzz_vuln/blob/main/Bento4/mp42aac/readme.md", "https://github.com/z1r00/fuzz_vuln"]}, {"cve": "CVE-2023-23423", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/171866/Microsoft-Windows-Kernel-Transactional-Registry-Key-Rename-Issues.html"]}, {"cve": "CVE-2023-43260", "desc": "Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin panel.", "poc": ["https://gist.github.com/win3zz/c7eda501edcf5383df32fabe00938d13"]}, {"cve": "CVE-2023-5966", "desc": "An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/pedrojosenavasperez/cve-2023-5966"]}, {"cve": "CVE-2023-30094", "desc": "A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module.", "poc": ["https://www.edoardoottavianelli.it/CVE-2023-30094/", "https://www.youtube.com/watch?v=vOb9Fyg3iVo"]}, {"cve": "CVE-2023-5990", "desc": "The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks", "poc": ["https://wpscan.com/vulnerability/0a615ce3-93da-459d-a33f-a2a6e74a2f94"]}, {"cve": "CVE-2023-40127", "desc": "In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Trinadh465/CVE-2023-40127", "https://github.com/Trinadh465/platform_packages_providers_MediaProvider_CVE-2023-40127", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-32416", "desc": "A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5, watchOS 9.6. An app may be able to read sensitive location information.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-4552", "desc": "Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including access to its local file system.This issue affects AppBuilder: from 21.2 before 23.2.", "poc": ["https://github.com/cxosmo/CVEs"]}, {"cve": "CVE-2023-28473", "desc": "Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37900", "desc": "Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting in exhausting all the available memory and therefore in the container being OOMKilled. The impact is limited due to the high privileges required to be able to create the Package and the eventually consistency nature of controller. This issue is fixed in versions 1.11.5, 1.12.3, and 1.13.0.", "poc": ["https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf"]}, {"cve": "CVE-2023-4620", "desc": "The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators", "poc": ["https://wpscan.com/vulnerability/084e9494-2f9e-4420-9bf7-78a1a41433d7", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38762", "desc": "SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-20157", "desc": "Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sg-web-multi-S9g4Nkgv"]}, {"cve": "CVE-2023-48618", "desc": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2054", "desc": "A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. This affects an unknown part of the file /admin/positions_delete.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225939.", "poc": ["https://vuldb.com/?id.225939"]}, {"cve": "CVE-2023-51197", "desc": "** DISPUTED ** An issue discovered in shell command execution in ROS2 (Robot Operating System 2) Foxy Fitzroy, with ROS_VERSION=2 and ROS_PYTHON_VERSION=3 allows an attacker to run arbitrary commands and cause other impacts. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/16yashpatel/CVE-2023-51197", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2023-51197"]}, {"cve": "CVE-2023-2652", "desc": "A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file /classes/Master.php?f=delete_item. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228780.", "poc": ["https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Lost-and-Found-Information-System---Multiple-SQL-injections.md#2classesmasterphpfdelete_item"]}, {"cve": "CVE-2023-46084", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This issue affects Icons Font Loader: from n/a through 1.1.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44973", "desc": "An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.", "poc": ["https://github.com/yangliukk/emlog"]}, {"cve": "CVE-2023-27063", "desc": "Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the DNSDomainName parameter in the formModifyDnsForward function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.", "poc": ["https://github.com/didi-zhiyuan/vuln/blob/main/iot/Tenda/W15EV1/formModifyDnsForward.md"]}, {"cve": "CVE-2023-30095", "desc": "A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field.", "poc": ["https://www.edoardoottavianelli.it/CVE-2023-30095/", "https://www.youtube.com/watch?v=2k7e9E0Cw0Y"]}, {"cve": "CVE-2023-3345", "desc": "The LMS by Masteriyo WordPress plugin before 1.6.8 does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints.", "poc": ["https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a"]}, {"cve": "CVE-2023-0421", "desc": "The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link.", "poc": ["https://wpscan.com/vulnerability/a356fea0-f143-4736-b2b2-c545c525335c"]}, {"cve": "CVE-2023-29657", "desc": "eXtplorer 2.1.15 is vulnerable to Insecure Permissions. File upload in file manager allows uploading zip file containing php pages with arbitrary code executions.", "poc": ["http://blog.tristaomarinho.com/extplorer-2-1-15-arbitrary-file-upload/"]}, {"cve": "CVE-2023-49989", "desc": "Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49989", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4104", "desc": "An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups.*This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN client for Linux < v2.16.1.", "poc": ["https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7110", "https://github.com/aobakwewastaken/aobakwewastaken", "https://github.com/kherrick/hacker-news"]}, {"cve": "CVE-2023-21949", "desc": "Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 19.3-19.19 and 21.3-21.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Advanced Networking Option accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-40537", "desc": "An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform.\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30803", "desc": "The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a crafted Y-forwarded-for header.", "poc": ["https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4"]}, {"cve": "CVE-2023-5173", "desc": "In a non-standard configuration of Firefox, an integer overflow could have occurred based on network traffic (possibly under influence of a local unprivileged webpage), leading to an out-of-bounds write to privileged process memory. *This bug only affects Firefox if a non-standard preference allowing non-HTTPS Alternate Services (`network.http.altsvc.oe`) is enabled.* This vulnerability affects Firefox < 118.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1823172", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40275", "desc": "An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to _common/search/searchByAjax/patientslistShow.jsp.", "poc": ["https://github.com/BugBountyHunterCVE/CVE-2023-40275", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38430", "desc": "An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read.", "poc": ["https://github.com/chenghungpan/test_data", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43656", "desc": "matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have `generic.allowJsTransformationFunctions` in their config), may be vulnerable to an attack where it is possible to break out of the `vm2` sandbox and as a result Hookshot will be vulnerable to this. This problem is only likely to affect users who have allowed untrusted users to apply their own transformation functions. If you have only enabled a limited set of trusted users, this threat is reduced (though not eliminated). Version 4.5.0 and above of hookshot include a new sandbox library which should better protect users. Users are advised to upgrade. Users unable to upgrade should disable `generic.allowJsTransformationFunctions` in the config.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3534", "desc": "A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file check_availability.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-233286 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49081", "desc": "aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.", "poc": ["https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2"]}, {"cve": "CVE-2023-4408", "desc": "The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/fokypoky/places-list", "https://github.com/marklogic/marklogic-docker"]}, {"cve": "CVE-2023-40106", "desc": "In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-21875", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.31 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-23495", "desc": "A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14. An app may be able to access sensitive user data.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22524", "desc": "Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion\u2019s blocklist and MacOS Gatekeeper to allow execution of code.", "poc": ["https://github.com/imperva/CVE-2023-22524", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ron-imperva/CVE-2023-22524"]}, {"cve": "CVE-2023-21749", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/170947/Windows-Kernsl-SID-Table-Poisoning.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-44315", "desc": "A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could prepare a stored cross-site scripting (XSS) attack that may lead to unintentional modification of application data by legitimate users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20007", "desc": "A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code or cause the web-based management process on the device to restart unexpectedly, resulting in a denial of service (DoS) condition. The attacker must have valid administrator credentials. \nThis vulnerability is due to insufficient validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP input to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the web-based management process to restart, resulting in a DoS condition.", "poc": ["https://github.com/Live-Hack-CVE/CVE-2023-20007"]}, {"cve": "CVE-2023-50481", "desc": "An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms in the component /presets/ssr-auth-chain.js.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27040", "desc": "Simple Image Gallery v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the username parameter.", "poc": ["https://www.exploit-db.com/exploits/50214"]}, {"cve": "CVE-2023-0519", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.", "poc": ["https://huntr.dev/bounties/891ad0cb-d12f-4c5e-aac8-d7326caf2129"]}, {"cve": "CVE-2023-22061", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer). The supported version that is affected is 6.4.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-47460", "desc": "SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Service/Admin.svc/getGridColumnStructure component.", "poc": ["https://github.com/aleksey-vi/CVE-2023-47460", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38676", "desc": "Nullptr in paddle.dot\u00a0in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-008.md"]}, {"cve": "CVE-2023-27404", "desc": "A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to stack-based buffer while parsing specially crafted SPP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-20433)", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/dhn/dhn"]}, {"cve": "CVE-2023-6084", "desc": "A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/vehicle/checkup/delete.php. The manipulation of the argument VU_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-244994 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.244994", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-35799", "desc": "Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges.", "poc": ["https://advisories.stormshield.eu/2023-022/"]}, {"cve": "CVE-2023-36934", "desc": "In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.", "poc": ["https://github.com/KushGuptaRH/MOVEit-Response", "https://github.com/curated-intel/MOVEit-Transfer"]}, {"cve": "CVE-2023-0811", "desc": "Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-24236", "desc": "TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.", "poc": ["https://github.com/Am1ngl/ttt/tree/main/19"]}, {"cve": "CVE-2023-2316", "desc": "Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via \"typora://app/\". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.", "poc": ["https://starlabs.sg/advisories/23/23-2316/"]}, {"cve": "CVE-2023-46226", "desc": "Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2.Users are recommended to upgrade to version 1.3.0, which fixes the issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41014", "desc": "code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for \"Employer.\"", "poc": ["https://github.com/ASR511-OO7/CVE-2023-41014", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31147", "desc": "c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44763", "desc": "** DISPUTED ** Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that \"pdf\" should be excluded from the allowed file types, even though pdf is one of the allowed file types in the default configuration.", "poc": ["https://github.com/sromanhu/ConcreteCMS-Arbitrary-file-upload-Thumbnail", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-44763_ConcreteCMS-Arbitrary-file-upload-Thumbnail"]}, {"cve": "CVE-2023-45213", "desc": "A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32258", "desc": "A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35708", "desc": "In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).", "poc": ["https://github.com/KushGuptaRH/MOVEit-Response", "https://github.com/curated-intel/MOVEit-Transfer", "https://github.com/most-e/Capstone", "https://github.com/optiv/nvdsearch"]}, {"cve": "CVE-2023-4756", "desc": "Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.", "poc": ["https://huntr.dev/bounties/2342da0e-f097-4ce7-bfdc-3ec0ba446e05"]}, {"cve": "CVE-2023-49735", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED **The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles.This issue affects Apache Tiles from version 2 onwards.NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/weblegacy/struts1"]}, {"cve": "CVE-2023-37716", "desc": "Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN, AC10 V1.0, AC1206 V1.0, AC7 V1.0, AC5 V1.0, and AC9 V3.0 were discovered to contain a stack overflow in the page parameter in the function fromNatStaticSetting.", "poc": ["https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/fromNatStaticSetting/report.md"]}, {"cve": "CVE-2023-21855", "desc": "Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(PocketPC)). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Sales for Handhelds. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Sales for Handhelds accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-23408", "desc": "Azure Apache Ambari\u00a0Spoofing Vulnerability", "poc": ["http://packetstormsecurity.com/files/173134/Azure-Apache-Ambari-2302250400-Spoofing.html"]}, {"cve": "CVE-2023-38507", "desc": "Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12.1 has a fix for this issue.", "poc": ["https://github.com/strapi/strapi/security/advisories/GHSA-24q2-59hm-rh9r"]}, {"cve": "CVE-2023-3854", "desc": "A vulnerability classified as critical has been found in phpscriptpoint BloodBank 1.1. Affected is an unknown function of the file /search of the component POST Parameter Handler. The manipulation of the argument country/city/blood_group_id leads to sql injection. It is possible to launch the attack remotely. VDB-235206 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51074", "desc": "json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.", "poc": ["https://github.com/json-path/JsonPath/issues/973", "https://github.com/decothegod/DemoNisum", "https://github.com/decothegod/PortalNews", "https://github.com/decothegod/demoSJ"]}, {"cve": "CVE-2023-2088", "desc": "A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.", "poc": ["https://github.com/EGI-Federation/SVG-advisories"]}, {"cve": "CVE-2023-0491", "desc": "The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/b1a7e8fc-ffcf-493b-9f2d-ffa5d2348b60"]}, {"cve": "CVE-2023-34932", "desc": "A stack overflow in the UpdateWanMode function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", "poc": ["https://github.com/h4kuy4/vuln/blob/main/H3C_B1STW/CVE-2023-34932.md"]}, {"cve": "CVE-2023-32676", "desc": "Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Using the install assessment functionality an attacker can feed a Tar file that contain files with paths pointing outside of the target directory (e.g., `../../../../tmp/tarslipped1.sh`). When the Install assessment form is submitted the files inside of the archives are expanded to the attacker-chosen locations. This issue has been addressed in version 2.11.0. Users are advised to upgrade.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-081_GHSL-2023-082_Autolab/"]}, {"cve": "CVE-2023-37785", "desc": "A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the component /editprofile.php.", "poc": ["https://github.com/CrownZTX/cve-description"]}, {"cve": "CVE-2023-30948", "desc": "A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbitrary comments to discover it's content.This defect was fixed in Foundry Comments 2.249.0, and a patch was rolled out to affected Foundry environments. No further intervention is required at this time.", "poc": ["https://palantir.safebase.us/?tcuUid=101b083b-6389-4261-98f8-23448e133a62"]}, {"cve": "CVE-2023-46354", "desc": "In the module \"Orders (CSV, Excel) Export PRO\" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer/ps_address tables such as name / surname / email / phone number / full postal address.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21972", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-25403", "desc": "CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication.", "poc": ["https://github.com/CleverStupidDog/yf-exam/issues/2"]}, {"cve": "CVE-2023-52433", "desc": "In the Linux kernel, the following vulnerability has been resolved:netfilter: nft_set_rbtree: skip sync GC for new elements in this transactionNew elements in this transaction might expired before such transactionends. Skip sync GC for such elements otherwise commit path might walkover an already released object. Once transaction is finished, async GCwill collect such expired element.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2925", "desc": "A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. This affects an unknown part of the file /admin/contacts/organizations/edit/2 of the component Edit Person Page. The manipulation of the argument Organization leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230079. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.230079", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-2474", "desc": "A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-227866 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.227866"]}, {"cve": "CVE-2023-33538", "desc": "TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .", "poc": ["https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md", "https://github.com/d4n-sec/d4n-sec.github.io"]}, {"cve": "CVE-2023-5140", "desc": "The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/ee1824e8-09a6-4763-b65e-03701dc3e171"]}, {"cve": "CVE-2023-48835", "desc": "Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.", "poc": ["http://packetstormsecurity.com/files/176045"]}, {"cve": "CVE-2023-49805", "desc": "Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting to the server using Socket.IO, the server does not validate the `Origin` header leading to other site being able to open connections to the server and communicate with it. Other websites still need to authenticate to access most features, however this can be used to circumvent firewall protections made in place by people deploying the application.Without origin validation, Javascript executed from another origin would be allowed to connect to the application without any user interaction. Without login credentials, such a connection is unable to access protected endpoints containing sensitive data of the application. However, such a connection may allow attacker to further exploit unseen vulnerabilities of the application. Users with \"No-auth\" mode configured who are relying on a reverse proxy or firewall to provide protection to the application would be especially vulnerable as it would grant the attacker full access to the application.In version 1.23.9, additional verification of the HTTP Origin header has been added to the socket.io connection handler. By default, if the `Origin` header is present, it would be checked against the Host header. Connection would be denied if the hostnames do not match, which would indicate that the request is cross-origin. Connection would be allowed if the `Origin` header is not present. Users can override this behavior by setting environment variable `UPTIME_KUMA_WS_ORIGIN_CHECK=bypass`.", "poc": ["https://github.com/louislam/uptime-kuma/security/advisories/GHSA-mj22-23ff-2hrr"]}, {"cve": "CVE-2023-34751", "desc": "bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&action=edit.", "poc": ["https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability"]}, {"cve": "CVE-2023-40210", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Sean Barton (Tortoise IT) SB Child List plugin <=\u00a04.5 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4820", "desc": "The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.", "poc": ["https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432"]}, {"cve": "CVE-2023-39785", "desc": "Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the set_qosMib_list function.", "poc": ["https://github.com/Xunflash/IOT/tree/main/Tenda_AC8_V4/2", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-2074", "desc": "A vulnerability was found in Campcodes Online Traffic Offense Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226052.", "poc": ["https://github.com/E1CHO/cve_hub/blob/main/Online%20Traffic%20Offense%20Management%20System/Online%20Traffic%20Offense%20Management%20System%20-%20vuln%202.pdf", "https://vuldb.com/?id.226052"]}, {"cve": "CVE-2023-3434", "desc": "Improper Input Validation in the hyperlink interpretation in\u00a0Savoir-faire Linux's Jami (version 20222284)\u00a0on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43267", "desc": "A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title field.", "poc": ["https://github.com/Fliggyaaa/xss", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0094", "desc": "The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/1453471f-164d-4487-a736-8cea086212fe/"]}, {"cve": "CVE-2023-24729", "desc": "Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function.", "poc": ["https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip"]}, {"cve": "CVE-2023-6174", "desc": "SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5373", "desc": "A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is the function register of the file Master.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-241254 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49804", "desc": "Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive information. The same vulnerability was partially fixed in CVE-2023-44400, but logging existing users out of their accounts was forgotten. To mitigate the risks associated with this vulnerability, the maintainers made the server emit a `refresh` event (clients handle this by reloading) and then disconnecting all clients except the one initiating the password change. It is recommended to update Uptime Kuma to version 1.23.9.", "poc": ["https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3", "https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g"]}, {"cve": "CVE-2023-3241", "desc": "A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512.", "poc": ["https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36847", "desc": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrityfor a certain part of the file system, which may allow chaining to other vulnerabilities.This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S8; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2-S1, 22.4R3.", "poc": ["http://packetstormsecurity.com/files/174397/Juniper-JunOS-SRX-EX-Remote-Code-Execution.html", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/devmehedi101/bugbounty-CVE-Report", "https://github.com/r3dcl1ff/CVE-2023-36844_Juniper_RCE", "https://github.com/securi3ytalent/bugbounty-CVE-Report", "https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844"]}, {"cve": "CVE-2023-2983", "desc": "Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.", "poc": ["https://huntr.dev/bounties/6b2f33d3-2fd0-4d2d-ad7b-2c1e2417eeb1"]}, {"cve": "CVE-2023-43838", "desc": "An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rootd4ddy/CVE-2023-43838"]}, {"cve": "CVE-2023-2216", "desc": "A vulnerability classified as problematic was found in Campcodes Coffee Shop POS System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument firstname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226981 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.226981"]}, {"cve": "CVE-2023-38334", "desc": "Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer possible to delete, view, change, copy, rename, duplicate, or print a locked class. Due to implementation issues, locked classes in Omnis libraries can be unlocked, and thus further analyzed and modified by Omnis Studio. This allows for further analyzing and also deleting, viewing, changing, copying, renaming, duplicating, or printing previously locked Omnis classes. This violates the expected behavior of an \"irreversible operation.\"", "poc": ["http://packetstormsecurity.com/files/173696/Omnis-Studio-10.22.00-Library-Unlock.html", "http://seclists.org/fulldisclosure/2023/Jul/42", "http://seclists.org/fulldisclosure/2023/Jul/43", "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-006.txt"]}, {"cve": "CVE-2023-23006", "desc": "In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.13"]}, {"cve": "CVE-2023-49397", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.", "poc": ["https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20at%20the%20change%20of%20column%20management%20status.md"]}, {"cve": "CVE-2023-0335", "desc": "The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.", "poc": ["https://wpscan.com/vulnerability/f7a20bea-c3d5-431b-bdcf-e189c81a561a"]}, {"cve": "CVE-2023-45385", "desc": "ProQuality pqprintshippinglabels before v.4.15.0 is vulnerable to Directory Traversal via the pqprintshippinglabels module.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39919", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in maennchen1.De wpShopGermany \u2013 Protected Shops plugin <=\u00a02.0 versions.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-45079", "desc": "A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-2837", "desc": "Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.", "poc": ["https://huntr.dev/bounties/a6bfd1b2-aba8-4c6f-90c4-e95b1831cb17"]}, {"cve": "CVE-2023-35391", "desc": "ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/r3volved/CVEAggregate"]}, {"cve": "CVE-2023-33843", "desc": "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 256544.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4637", "desc": "The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_restore_progress() function in versions up to, and including, 0.9.94. This makes it possible for unauthenticated attackers to invoke these functions and obtain full file paths if they have access to a back-up ID.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49398", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.", "poc": ["https://github.com/nightcloudos/new_cms/blob/main/CSRF%20exists%20at%20the%20deletion%20point%20of%20column%20management.md"]}, {"cve": "CVE-2023-37793", "desc": "WAYOS FBM-291W 19.09.11V was discovered to contain a buffer overflow via the component /upgrade_filter.asp.", "poc": ["https://github.com/PwnYouLin/IOT_vul/blob/main/wayos/2/readme.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29569", "desc": "Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).", "poc": ["https://github.com/cesanta/mjs/issues/239", "https://github.com/z1r00/fuzz_vuln/blob/main/mjs/SEGV/mjs_ffi/readme.md", "https://github.com/z1r00/fuzz_vuln"]}, {"cve": "CVE-2023-4981", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.", "poc": ["https://huntr.dev/bounties/1f014494-49a9-4bf0-8d43-a675498b9609"]}, {"cve": "CVE-2023-6789", "desc": "A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator.", "poc": ["https://github.com/kaje11/CVEs"]}, {"cve": "CVE-2023-33409", "desc": "Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php.", "poc": ["https://github.com/Thirukrishnan/CVE-2023-33409", "https://github.com/Thirukrishnan/CVE-2023-33409", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-28071", "desc": "Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious user could potentially exploit this vulnerability to create arbitrary folder leading to permanent Denial of Service (DOS).", "poc": ["https://github.com/ycdxsb/ycdxsb"]}, {"cve": "CVE-2023-4836", "desc": "The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced", "poc": ["https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-poc", "https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6"]}, {"cve": "CVE-2023-21990", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-4172", "desc": "A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some unknown processing of the file \\Service\\FileHandler.ashx. The manipulation of the argument FileDirectory leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236207.", "poc": ["https://vuldb.com/?id.236207"]}, {"cve": "CVE-2023-6054", "desc": "A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/manage/lock.php. The manipulation of the argument TERM_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244875. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.244875"]}, {"cve": "CVE-2023-38225", "desc": "Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/markyason/markyason.github.io"]}, {"cve": "CVE-2023-0538", "desc": "The Campaign URL Builder WordPress plugin before 1.8.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/4869fdc7-4fc7-4917-bc00-b6ced9ccc871"]}, {"cve": "CVE-2023-5341", "desc": "A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.", "poc": ["https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44113", "desc": "Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28848", "desc": "user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade user_oidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.", "poc": ["https://github.com/nextcloud/security-advisories/security/advisories/GHSA-52hv-xw32-wf7f"]}, {"cve": "CVE-2023-4903", "desc": "Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/btklab/posh-mocks"]}, {"cve": "CVE-2023-51548", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Neil Gee SlickNav Mobile Menu allows Stored XSS.This issue affects SlickNav Mobile Menu: from n/a through 1.9.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4457", "desc": "Grafana is an open-source platform for monitoring and observability.The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability.The plugin did not properly sanitize error messages, making it potentially expose the Google Sheet API-key that is configured for the data source.This vulnerability was fixed in version 1.2.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33639", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/Bk2hvYkH3"]}, {"cve": "CVE-2023-0487", "desc": "The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/0e874a1d-c866-45fa-b456-c8012dca32af"]}, {"cve": "CVE-2023-4966", "desc": "Sensitive information disclosure\u00a0in NetScaler ADC and NetScaler Gateway when configured as a\u00a0Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy)\u00a0or\u00a0AAA \u202fvirtual\u202fserver.", "poc": ["http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html", "https://github.com/0xKayala/CVE-2023-4966", "https://github.com/B0lg0r0v/citrix-adc-forensics", "https://github.com/B0lg0r0v/citrix-netscaler-forensics", "https://github.com/CerTusHack/Citrix-bleed-Xploit", "https://github.com/Chocapikk/CVE-2023-4966", "https://github.com/EvilGreys/Citrix-BLEED", "https://github.com/IceBreakerCode/CVE-2023-4966", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/RevoltSecurities/CVE-2023-4966", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/CVE", "https://github.com/aleff-github/my-flipper-shits", "https://github.com/byte4RR4Y/CVE-2023-4966", "https://github.com/certat/citrix-logchecker", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/dinosn/citrix_cve-2023-4966", "https://github.com/ditekshen/ansible-cve-2023-4966", "https://github.com/frankenk/frankenk", "https://github.com/izj007/wechat", "https://github.com/jmussmann/cve-2023-4966-iocs", "https://github.com/mlynchcogent/CVE-2023-4966-POC", "https://github.com/morganwdavis/overread", "https://github.com/nanoRoot1/Herramientas-de-Seguridad-Digital", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/s-bt/CVE-2023-4966", "https://github.com/sanjai-AK47/CVE-2023-4966", "https://github.com/senpaisamp/Netscaler-CVE-2023-4966-POC", "https://github.com/tanjiti/sec_profile", "https://github.com/venkycs/cy8", "https://github.com/whitfieldsdad/cisa_kev", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-51389", "desc": "Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/luelueking/luelueking"]}, {"cve": "CVE-2023-0904", "desc": "A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221453 was assigned to this vulnerability.", "poc": ["https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Employee%20Task%20Management%20System%20-%20SQL%20Injection%20-%202.md", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-1756", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/e495b443-b328-42f5-aed5-d68b929b4cb9", "https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-3706", "desc": "The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector", "poc": ["https://wpscan.com/vulnerability/daa4d93a-f8b1-4809-a18e-8ab63a05de5a"]}, {"cve": "CVE-2023-30542", "desc": "OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.", "poc": ["https://github.com/davidlpoole/eth-erc20-governance"]}, {"cve": "CVE-2023-5028", "desc": "A vulnerability, which was classified as problematic, has been found in China Unicom TEWA-800G 4.16L.04_CT2015_Yueme. Affected by this issue is some unknown functionality. The manipulation leads to information exposure through debug log file. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-239870 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.239870"]}, {"cve": "CVE-2023-46767", "desc": "Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3607", "desc": "A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of the component WebConsole Plug-In. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233476. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/mohdkey/cve/blob/main/kodbox.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25618", "desc": "SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authenticated as a non-administrative user can craft a request with certain parameters which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-46484", "desc": "An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.", "poc": ["https://815yang.github.io/2023/10/29/x6000r/setLedCfg/TOTOlink%20X6000R%20setLedCfg%20e/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7219", "desc": "A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6562", "desc": "JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the attacker to upload a specially-crafted the image that is displayed back to the attacker.", "poc": ["https://github.com/google/security-research/security/advisories/GHSA-g6qc-fhcq-vhf9"]}, {"cve": "CVE-2023-33120", "desc": "Memory corruption in Audio when memory map command is executed consecutively in ADSP.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21563", "desc": "BitLocker Security Feature Bypass Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Wack0/bitlocker-attacks"]}, {"cve": "CVE-2023-34319", "desc": "The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a way such that not all of the headerswould come in one piece. Unfortunately the logic introduced theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all (possible)headers together. Such an unusual packet would therefore trigger abuffer overrun in the driver.", "poc": ["http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html"]}, {"cve": "CVE-2023-3896", "desc": "Divide By Zero in vim/vim from\u00a09.0.1367-1 to\u00a09.0.1367-3", "poc": ["https://github.com/vim/vim/issues/12528", "https://github.com/fullwaywang/QlRules"]}, {"cve": "CVE-2023-4019", "desc": "The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.", "poc": ["https://wpscan.com/vulnerability/0d323b07-c6e7-4aba-85bc-64659ad0c85d", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23491", "desc": "The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.", "poc": ["https://www.tenable.com/security/research/tra-2023-3", "https://github.com/ARPSyndicate/cvemon", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-3787", "desc": "A vulnerability classified as problematic was found in Codecanyon Tiva Events Calender 1.4. This vulnerability affects unknown code. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235054 is the identifier assigned to this vulnerability.", "poc": ["https://seclists.org/fulldisclosure/2023/Jul/35", "https://vuldb.com/?id.235054", "https://www.vulnerability-lab.com/get_content.php?id=2276"]}, {"cve": "CVE-2023-44282", "desc": "Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could potentially exploit this vulnerability, leading to gaining escalated privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0024", "desc": "SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources, resulting in Cross-Site Scripting vulnerability.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-35158", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: > /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.", "poc": ["https://jira.xwiki.org/browse/XWIKI-20352"]}, {"cve": "CVE-2023-22003", "desc": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-24251", "desc": "WangEditor v5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /dist/index.js.", "poc": ["https://github.com/Cutegod/CMS_0_day/issues/2"]}, {"cve": "CVE-2023-6837", "desc": "Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning.\u00a0In order for this vulnerability to have any impact on your deployment, following conditions must be met: * An IDP configured for federated authentication and JIT provisioning enabled with the \"Prompt for username, password and consent\" option. * A service provider that uses the above IDP for federated authentication and has the \"Assert identity using mapped local subject identifier\" flag enabled.Attacker should have: * A fresh valid user account in the federated IDP that has not been used earlier. * Knowledge of the username of a valid user in the local IDP.When all preconditions are met, a malicious actor could use JIT provisioning flow to perform user impersonation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0606", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.", "poc": ["https://huntr.dev/bounties/0bfed46d-ac96-43c4-93fb-13f68b4e711b"]}, {"cve": "CVE-2023-7055", "desc": "A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profile.php of the component Contact Information Handler. The manipulation of the argument mobilenumber leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-248742 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35360", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5463", "desc": "A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfgmgr32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. VDB-241586 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://drive.google.com/drive/folders/1mpRxWOPjxVS980r0qu1IY_Hf0irKO-cu"]}, {"cve": "CVE-2023-3469", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.", "poc": ["https://huntr.dev/bounties/3565cfc9-82c4-4db8-9b8f-494dd81b56ca"]}, {"cve": "CVE-2023-24333", "desc": "A stack overflow vulnerability in Tenda AC21 with firmware version US_AC21V1.0re_V16.03.08.15_cn_TDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/openSchedWifi.", "poc": ["https://github.com/caoyebo/CVE/tree/main/TENDA%20AC21%20-%20CVE-2023-24333"]}, {"cve": "CVE-2023-1755", "desc": "Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/882ffa07-5397-4dbb-886f-4626859d711a", "https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-28840", "desc": "Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*.Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the u32 iptables extension provided by the xt_u32 kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.Two iptables rules serve to filter incoming VXLAN datagrams with a VNI that corresponds to an encrypted network and discards unencrypted datagrams. The rules are appended to the end of the INPUT filter chain, following any rules that have been previously set by the system administrator. Administrator-set rules take precedence over the rules Moby sets to discard unencrypted VXLAN datagrams, which can potentially admit unencrypted datagrams that should have been discarded.The injection of arbitrary Ethernet frames can enable a Denial of Service attack. A sophisticated attacker may be able to establish a UDP or TCP connection by way of the container\u2019s outbound gateway that would otherwise be blocked by a stateful firewall, or carry out other escalations beyond simple injection by smuggling packets into the overlay network.Patches are available in Moby releases 23.0.3 and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16.Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to incoming traffic at the Internet boundary to prevent all VXLAN packet injection, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster.", "poc": ["https://github.com/wolfi-dev/advisories"]}, {"cve": "CVE-2023-39660", "desc": "An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.", "poc": ["https://github.com/gventuri/pandas-ai/issues/399"]}, {"cve": "CVE-2023-40594", "desc": "In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37601", "desc": "Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts.", "poc": ["https://packetstormsecurity.com/files/173146/Office-Suite-Premium-10.9.1.42602-Local-File-Inclusion.html", "https://github.com/capture0x/My-CVE"]}, {"cve": "CVE-2023-42882", "desc": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2. Processing an image may lead to arbitrary code execution.", "poc": ["http://packetstormsecurity.com/files/176536/macOS-AppleVADriver-Out-Of-Bounds-Write.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34094", "desc": "ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized access to the config.json file of the privately deployed ChuanghuChatGPT project, when authentication is not configured. The attacker can exploit this vulnerability to steal the API keys in the configuration file. The vulnerability has been fixed in commit bfac445. As a workaround, setting up access authentication can help mitigate the vulnerability.", "poc": ["https://github.com/aboutbo/aboutbo"]}, {"cve": "CVE-2023-1994", "desc": "GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-1094", "desc": "MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food parameter.", "poc": ["https://fluidattacks.com/advisories/napoli"]}, {"cve": "CVE-2023-2986", "desc": "The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.", "poc": ["http://packetstormsecurity.com/files/172966/WordPress-Abandoned-Cart-Lite-For-WooCommerce-5.14.2-Authentication-Bypass.html", "http://packetstormsecurity.com/files/173018/WordPress-Abandoned-Cart-Lite-For-WooCommerce-5.14.2-Authentication-Bypass.html", "https://github.com/Ayantaker/CVE-2023-2986", "https://github.com/TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment-1601813615", "https://github.com/Alucard0x1/CVE-2023-2986", "https://github.com/Ayantaker/CVE-2023-2986", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-52613", "desc": "In the Linux kernel, the following vulnerability has been resolved:drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgmentPTR_ERR() returns -ENODEV when thermal-zones are undefined, and we need-ENODEV as the right value for comparison.Otherwise, tz->type is NULL when thermal-zones is undefined, resultingin the following error:[ 12.290030] CPU 1 Unable to handle kernel paging request at virtual address fffffffffffffff1, era == 900000000355f410, ra == 90000000031579b8[ 12.302877] Oops[#1]:[ 12.305190] CPU: 1 PID: 181 Comm: systemd-udevd Not tainted 6.6.0-rc7+ #5385[ 12.312304] pc 900000000355f410 ra 90000000031579b8 tp 90000001069e8000 sp 90000001069eba10[ 12.320739] a0 0000000000000000 a1 fffffffffffffff1 a2 0000000000000014 a3 0000000000000001[ 12.329173] a4 90000001069eb990 a5 0000000000000001 a6 0000000000001001 a7 900000010003431c[ 12.337606] t0 fffffffffffffff1 t1 54567fd5da9b4fd4 t2 900000010614ec40 t3 00000000000dc901[ 12.346041] t4 0000000000000000 t5 0000000000000004 t6 900000010614ee20 t7 900000000d00b790[ 12.354472] t8 00000000000dc901 u0 54567fd5da9b4fd4 s9 900000000402ae10 s0 900000010614ec40[ 12.362916] s1 90000000039fced0 s2 ffffffffffffffed s3 ffffffffffffffed s4 9000000003acc000[ 12.362931] s5 0000000000000004 s6 fffffffffffff000 s7 0000000000000490 s8 90000001028b2ec8[ 12.362938] ra: 90000000031579b8 thermal_add_hwmon_sysfs+0x258/0x300[ 12.386411] ERA: 900000000355f410 strscpy+0xf0/0x160[ 12.391626] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)[ 12.397898] PRMD: 00000004 (PPLV0 +PIE -PWE)[ 12.403678] EUEN: 00000000 (-FPE -SXE -ASXE -BTE)[ 12.409859] ECFG: 00071c1c (LIE=2-4,10-12 VS=7)[ 12.415882] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)[ 12.415907] BADV: fffffffffffffff1[ 12.415911] PRID: 0014a000 (Loongson-64bit, Loongson-2K1000)[ 12.415917] Modules linked in: loongson2_thermal(+) vfat fat uio_pdrv_genirq uio fuse zram zsmalloc[ 12.415950] Process systemd-udevd (pid: 181, threadinfo=00000000358b9718, task=00000000ace72fe3)[ 12.415961] Stack : 0000000000000dc0 54567fd5da9b4fd4 900000000402ae10 9000000002df9358[ 12.415982] ffffffffffffffed 0000000000000004 9000000107a10aa8 90000001002a3410[ 12.415999] ffffffffffffffed ffffffffffffffed 9000000107a11268 9000000003157ab0[ 12.416016] 9000000107a10aa8 ffffff80020fc0c8 90000001002a3410 ffffffffffffffed[ 12.416032] 0000000000000024 ffffff80020cc1e8 900000000402b2a0 9000000003acc000[ 12.416048] 90000001002a3410 0000000000000000 ffffff80020f4030 90000001002a3410[ 12.416065] 0000000000000000 9000000002df6808 90000001002a3410 0000000000000000[ 12.416081] ffffff80020f4030 0000000000000000 90000001002a3410 9000000002df2ba8[ 12.416097] 00000000000000b4 90000001002a34f4 90000001002a3410 0000000000000002[ 12.416114] ffffff80020f4030 fffffffffffffff0 90000001002a3410 9000000002df2f30[ 12.416131] ...[ 12.416138] Call Trace:[ 12.416142] [<900000000355f410>] strscpy+0xf0/0x160[ 12.416167] [<90000000031579b8>] thermal_add_hwmon_sysfs+0x258/0x300[ 12.416183] [<9000000003157ab0>] devm_thermal_add_hwmon_sysfs+0x50/0xe0[ 12.416200] [] loongson2_thermal_probe+0x128/0x200 [loongson2_thermal][ 12.416232] [<9000000002df6808>] platform_probe+0x68/0x140[ 12.416249] [<9000000002df2ba8>] really_probe+0xc8/0x3c0[ 12.416269] [<9000000002df2f30>] __driver_probe_device+0x90/0x180[ 12.416286] [<9000000002df3058>] driver_probe_device+0x38/0x160[ 12.416302] [<9000000002df33a8>] __driver_attach+0xa8/0x200[ 12.416314] [<9000000002deffec>] bus_for_each_dev+0x8c/0x120[ 12.416330] [<9000000002df198c>] bus_add_driver+0x10c/0x2a0[ 12.416346] [<9000000002df46b4>] driver_register+0x74/0x160[ 12.416358] [<90000000022201a4>] do_one_initcall+0x84/0x220[ 12.416372] [<90000000022f3ab8>] do_init_module+0x58/0x2c0[---truncated---", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-29052", "desc": "Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/176422/OX-App-Suite-7.10.6-Access-Control-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33274", "desc": "The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access Common Gateway Interface (CGI) scripts without proper identification or authorization. This vulnerability arises from a lack of proper cookie verification and affects all instances of SNMP Web Pro 1.1 without HTTP Digest authentication enabled, regardless of the password used for the web interface.", "poc": ["https://gist.github.com/pedromonteirobb/a0584095b46141702c8cae0f3f1b6759"]}, {"cve": "CVE-2023-6938", "desc": "The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Version 4.8.1 of the Oxygen Builder plugin for WordPress addresses this vulnerability by implementing an optional filter to provide output escaping for dynamic data. Please see https://oxygenbuilder.com/documentation/other/security/#filtering-dynamic-data for more details.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28702", "desc": "ASUS RT-AC86U does not filter special characters for parameters in specific web URLs. A remote attacker with normal user privileges can exploit this vulnerability to perform command injection attack to execute arbitrary system commands, disrupt system or terminate service.", "poc": ["https://github.com/xxy1126/Vuln"]}, {"cve": "CVE-2023-1549", "desc": "The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present", "poc": ["https://wpscan.com/vulnerability/c94b3a68-673b-44d7-9251-f3590cc5ee9e"]}, {"cve": "CVE-2023-4491", "desc": "Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long username string to /searchbook.ghp, asking for the name via a POST request, resulting in arbitrary code execution on the remote machine.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50250", "desc": "Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73"]}, {"cve": "CVE-2023-28578", "desc": "Memory corruption in Core Services while executing the command for removing a single event listener.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38504", "desc": "Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js` client.", "poc": ["https://github.com/bdragon-org/dependabot-create-pull-requests-from-rules-2"]}, {"cve": "CVE-2023-3635", "desc": "GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.", "poc": ["https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195/", "https://github.com/jenkinsci/defensics-plugin"]}, {"cve": "CVE-2023-24930", "desc": "Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability", "poc": ["https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-30943", "desc": "The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.", "poc": ["https://github.com/Chocapikk/CVE-2023-30943", "https://github.com/RubyCat1337/CVE-2023-30943", "https://github.com/d0rb/CVE-2023-30943", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27951", "desc": "The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An archive may be able to bypass Gatekeeper.", "poc": ["https://github.com/houjingyi233/macOS-iOS-system-security"]}, {"cve": "CVE-2023-25948", "desc": "Server information leak of configuration data when an error is generated in response to a specially crafted message.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27199", "desc": "PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and use LD_PRELOAD to bypass authorization checks.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29722", "desc": "The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with this data to cause an escalation of privilege attack.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29722/CVE%20detail.md"]}, {"cve": "CVE-2023-24998", "desc": "Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Threekiii/CVE", "https://github.com/muneebaashiq/MBProjects", "https://github.com/nice1st/CVE-2023-24998", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/speedyfriend67/Experiments"]}, {"cve": "CVE-2023-34259", "desc": "Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the filesystem, even files that require root privileges. NOTE: this issue exists because of an incomplete fix for CVE-2020-23575.", "poc": ["https://seclists.org/fulldisclosure/2023/Jul/15"]}, {"cve": "CVE-2023-45670", "desc": "Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the `config/save` and `config/set` endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server (e.g. via \"drive-by\" attack). Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. This issue can lead to arbitrary configuration updates for the Frigate server, resulting in denial of service and possible data exfiltration. Version 0.13.0 Beta 3 contains a patch.", "poc": ["https://about.gitlab.com/blog/2021/09/07/why-are-developers-vulnerable-to-driveby-attacks/", "https://github.com/blakeblackshear/frigate/security/advisories/GHSA-xq49-hv88-jr6h", "https://securitylab.github.com/advisories/GHSL-2023-190_Frigate/"]}, {"cve": "CVE-2023-46615", "desc": "Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7.", "poc": ["https://github.com/RandomRobbieBF/CVE-2023-46615", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38495", "desc": "Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.", "poc": ["https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf"]}, {"cve": "CVE-2023-41669", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <=\u00a01.06 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-4407", "desc": "A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument date1/date2 leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-237511.", "poc": ["http://packetstormsecurity.com/files/174244/Credit-Lite-1.5.4-SQL-Injection.html", "https://github.com/shankarsimi9/Apple.Remote.crash"]}, {"cve": "CVE-2023-34935", "desc": "A stack overflow in the AddWlanMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", "poc": ["https://github.com/h4kuy4/vuln/blob/main/H3C_B1STW/CVE-2023-34935.md"]}, {"cve": "CVE-2023-24389", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in brandiD Social Proof (Testimonial) Slider plugin <=\u00a02.2.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1315", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.", "poc": ["https://huntr.dev/bounties/70a7fd8c-7e6f-4a43-9f8c-163b8967b16e", "https://github.com/indevi0us/indevi0us"]}, {"cve": "CVE-2023-37941", "desc": "If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend.The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges.This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.", "poc": ["http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html", "https://github.com/Barroqueiro/CVE-2023-37941", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/nvn1729/advisories", "https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2023-40176", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights). This issue is present since version 4.1M2 when the time zone user preference was introduced. The issue has been fixed in XWiki 14.10.5 and 15.1RC1.", "poc": ["https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-51699", "desc": "Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to unauthorized access, modification or deletion of data. Users who're using versions < 0.9.3 with JuicefsRuntime should upgrade to v0.9.3.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-31519", "desc": "Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the email parameter at login_core.php.", "poc": ["https://github.com/yangliukk/Injection-Vulnerability-In-Pharmacy-Management-System-1.0"]}, {"cve": "CVE-2023-7143", "desc": "A vulnerability was found in code-projects Client Details System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/regester.php. The manipulation of the argument fname/lname/email/contact leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249146 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/Client_Details_System/Client_Details_System-Blind_Cross_Site_Scripting.md", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-49253", "desc": "Root user password is hardcoded into the device and cannot be changed in the user interface.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29659", "desc": "A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.", "poc": ["https://github.com/strukturag/libheif/issues/794"]}, {"cve": "CVE-2023-38056", "desc": "Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25728", "desc": "The General -> Geographical maps) allows using HTML in the field \u201cAttribution text\u201d when selected \u201cOther\u201d Tile provider.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52277", "desc": "Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service (Heap Memory Corruption and application crash) or possibly have unspecified other impact via a long hostname in an RTSZ file, if the victim clicks on Test Connection. This occurs during SecureGatewayHost object processing in RAPortCheck.createNWConnection.", "poc": ["https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5788.php", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46449", "desc": "Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbitrary user can change the password of another user and takeover the account via IDOR in the password change function.", "poc": ["https://github.com/sajaljat/CVE-2023-46449/tree/main", "https://www.youtube.com/watch?v=H5QnsOKjs3s", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sajaljat/CVE-2023-46449"]}, {"cve": "CVE-2023-6832", "desc": "Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.", "poc": ["https://huntr.com/bounties/53105a20-f4b1-45ad-a734-0349de6d7376"]}, {"cve": "CVE-2023-5555", "desc": "Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.", "poc": ["https://huntr.dev/bounties/f6d688ee-b049-4f85-ac3e-f4d3e29e7b9f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42283", "desc": "Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query.", "poc": ["https://github.com/andreysanyuk/CVE-2023-42283", "https://github.com/andreysanyuk/CVE-2023-42283", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-34566", "desc": "Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter time at /goform/saveParentControlInfo.", "poc": ["https://hackmd.io/@0dayResearch/rk8hQf5rh"]}, {"cve": "CVE-2023-42483", "desc": "A TOCTOU race condition in Samsung Mobile Processor Exynos 9820, Exynos 980, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, and Exynos 1380 can cause unexpected termination of a system.", "poc": ["https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-25649", "desc": "There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38771", "desc": "SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-0374", "desc": "The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/ddb10f2e-73b8-444c-90b2-5c84cdf6de5c"]}, {"cve": "CVE-2023-31933", "desc": "Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-pass-detail.php file.", "poc": ["https://github.com/DiliLearngent/BugReport"]}, {"cve": "CVE-2023-32664", "desc": "A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted Javascript code inside a malicious PDF document can cause memory corruption and lead to remote code execution. User would need to open a malicious file to trigger the vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1795"]}, {"cve": "CVE-2023-40195", "desc": "Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users.To view the warning in the docs please visit\u00a0 https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html", "poc": ["https://github.com/f0ur0four/Insecure-Deserialization", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43541", "desc": "Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27034", "desc": "PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.", "poc": ["https://github.com/codeb0ss/CVE-2023-27034-Exploit", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-28345", "desc": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to the affected endpoint and obtain the teacher's password. This enables them to log into the Teacher Console and begin trivially attacking student machines.", "poc": ["https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/", "https://research.nccgroup.com/?research=Technical%20advisories"]}, {"cve": "CVE-2023-49501", "desc": "Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.", "poc": ["https://trac.ffmpeg.org/ticket/10686", "https://trac.ffmpeg.org/ticket/10686#no1"]}, {"cve": "CVE-2023-49251", "desc": "A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The \"intermediate installation\" system state of the affected application allows an attacker to add their own login credentials to the device. This allows an attacker to remotely login as root and take control of the device even after the affected device is fully set up.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5774", "desc": "The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://drive.google.com/file/d/1zXWW545ktCznO36k90AN0APhTz8ky-gG/view?usp=sharing", "https://www.wordfence.com/threat-intel/vulnerabilities/id/33c2756d-c300-479f-b3aa-8f22c3a70278?source=cve"]}, {"cve": "CVE-2023-5846", "desc": "Franklin Fueling System TS-550 versions prior to 1.9.23.8960 are vulnerable to attackers decoding admin credentials, resulting in unauthenticated access to the device.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-04"]}, {"cve": "CVE-2023-2667", "desc": "A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228883.", "poc": ["https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/CVE-2023-2667.md", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-28522", "desc": "IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/cxosmo/CVEs"]}, {"cve": "CVE-2023-2773", "desc": "A vulnerability has been found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file view_admin.php. The manipulation of the argument adminid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229279.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-33798", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.", "poc": ["https://github.com/anhdq201/netbox/issues/13"]}, {"cve": "CVE-2023-50266", "desc": "Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get() without any sanitization, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting GET requests to internal and external resources on behalf of the server. 1.3.1 contains a partial fix, which limits the vulnerability to HTTP/HTTPS protocols.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/"]}, {"cve": "CVE-2023-50968", "desc": "Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.The same uri can be operated to realize a SSRF attack also without authorizations.Users are recommended to upgrade to version 18.12.11, which fixes this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3510", "desc": "The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin will view the settings of the plugin. The attack could also be perform via CSRF against any authenticated user.", "poc": ["https://wpscan.com/vulnerability/76abf4ac-5cc1-41a0-84c3-dff42c659581"]}, {"cve": "CVE-2023-30369", "desc": "Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow.", "poc": ["https://github.com/2205794866/Tenda/blob/main/AC15/3.md"]}, {"cve": "CVE-2023-2228", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.", "poc": ["https://huntr.dev/bounties/619fb490-69ad-4a2a-b686-4c42a62404a9"]}, {"cve": "CVE-2023-51623", "desc": "D-Link DIR-X3260 prog.cgi SetAPClientSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21673.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2117", "desc": "The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.", "poc": ["https://wpscan.com/vulnerability/44024299-ba40-4da7-81e1-bd44d10846f3"]}, {"cve": "CVE-2023-6129", "desc": "Issue summary: The POLY1305 MAC (message authentication code) implementationcontains a bug that might corrupt the internal state of applications runningon PowerPC CPU based platforms if the CPU provides vector instructions.Impact summary: If an attacker can influence whether the POLY1305 MACalgorithm is used, the application state might be corrupted with variousapplication dependent consequences.The POLY1305 MAC (message authentication code) implementation in OpenSSL forPowerPC CPUs restores the contents of vector registers in a different orderthan they are saved. Thus the contents of some of these vector registersare corrupted when returning to the caller. The vulnerable code is used onlyon newer PowerPC processors supporting the PowerISA 2.07 instructions.The consequences of this kind of internal application state corruption canbe various - from no consequences, if the calling application does notdepend on the contents of non-volatile XMM registers at all, to the worstconsequences, where the attacker could get complete control of the applicationprocess. However unless the compiler uses the vector registers for storingpointers, the most likely consequence, if any, would be an incorrect resultof some application dependent calculations or a crash leading to a denial ofservice.The POLY1305 MAC algorithm is most frequently used as part of theCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)algorithm. The most common usage of this AEAD cipher is with TLS protocolversions 1.2 and 1.3. If this cipher is enabled on the server a maliciousclient can influence whether this AEAD cipher is used. This implies thatTLS server applications using OpenSSL can be potentially impacted. Howeverwe are currently not aware of any concrete application that would be affectedby this issue therefore we consider this a Low severity security issue.", "poc": ["https://github.com/GrigGM/05-virt-04-docker-hw", "https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/seal-community/patches", "https://github.com/tquizzle/clamav-alpine"]}, {"cve": "CVE-2023-24097", "desc": "** UNSUPPORTED WHEN ASSIGNED ** TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formPasswordAuth. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/03/README.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43809", "desc": "Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is active, through the `allow-keyless` setting, and the public key requires additional client-side verification for example using FIDO2 or GPG. This is due to insufficient validation procedures of the public key step during SSH request handshake, granting unauthorized access if the keyboard-interaction mode is utilized. An attacker could exploit this vulnerability by presenting manipulated SSH requests using keyboard-interactive authentication mode. This could potentially result in unauthorized access to the Soft Serve. Users should upgrade to the latest Soft Serve version `v0.6.2` to receive the patch for this issue. To workaround this vulnerability without upgrading, users can temporarily disable Keyboard-Interactive SSH Authentication using the `allow-keyless` setting.", "poc": ["https://github.com/charmbracelet/soft-serve/issues/389"]}, {"cve": "CVE-2023-5482", "desc": "Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5108", "desc": "The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/1b277929-e88b-4ab6-9190-526e75f5ce7a"]}, {"cve": "CVE-2023-27395", "desc": "A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1735"]}, {"cve": "CVE-2023-33627", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/UpdateSnat"]}, {"cve": "CVE-2023-4184", "desc": "A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file sell_return.php. The manipulation of the argument pid leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-236219.", "poc": ["https://vuldb.com/?id.236219"]}, {"cve": "CVE-2023-34040", "desc": "In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.Specifically, an application is vulnerable when all of the following are true: * The user does not\u00a0configure an ErrorHandlingDeserializer for the key and/or value of the record * The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true. * The user allows untrusted sources to publish to a Kafka topicBy default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.", "poc": ["https://github.com/Contrast-Security-OSS/Spring-Kafka-POC-CVE-2023-34040", "https://github.com/Y4tacker/JavaSec", "https://github.com/buiduchoang24/CVE-2023-34040", "https://github.com/f0ur0four/Insecure-Deserialization", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/pyn3rd/CVE-2023-34040", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-52535", "desc": "In vsp driver, there is a possible missing verification incorrect input. This could lead to local denial of service with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30547", "desc": "vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.", "poc": ["https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244", "https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m", "https://github.com/Af7eR9l0W/HTB-Codify", "https://github.com/Cur1iosity/CVE-2023-30547", "https://github.com/Maladra/Write-Up-Codify", "https://github.com/karimhabush/cyberowl", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rvizx/CVE-2023-30547", "https://github.com/user0x1337/CVE-2023-30547"]}, {"cve": "CVE-2023-3151", "desc": "A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file user\\manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231020.", "poc": ["https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md"]}, {"cve": "CVE-2023-52534", "desc": "In ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31918", "desc": "Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser_parse_function_arguments at jerry-core/parser/js/js-parser.c.", "poc": ["https://github.com/jerryscript-project/jerryscript/issues/5064", "https://github.com/EJueon/EJueon"]}, {"cve": "CVE-2023-37569", "desc": "This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system.Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on targeted system.", "poc": ["http://packetstormsecurity.com/files/174084/Emagic-Data-Center-Management-Suite-6.0-Remote-Command-Execution.html"]}, {"cve": "CVE-2023-30453", "desc": "The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter.", "poc": ["https://y-security.de/news-en/reminder-for-jira-cross-site-scripting-cve-2023-30453/index.html"]}, {"cve": "CVE-2023-6313", "desc": "A vulnerability was found in SourceCodester URL Shortener 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Long URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246139.", "poc": ["https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/url-shortener.md"]}, {"cve": "CVE-2023-41254", "desc": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. An app may be able to access sensitive user data.", "poc": ["https://github.com/iCMDdev/iCMDdev"]}, {"cve": "CVE-2023-44189", "desc": "An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.This issue affects Juniper Networks Junos OS Evolved on PTX10003 Series: * All versions prior to 21.4R3-S4-EVO; * 22.1 versions prior to 22.1R3-S3-EVO; * 22.2 version 22.2R1-EVO and later versions; * 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO; * 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO; * 23.2 versions prior to 23.2R2-EVO.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33905", "desc": "In iwnpi server, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3823", "desc": "In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as\u00a0ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.", "poc": ["https://github.com/php/php-src/security/advisories/GHSA-3qrf-m4j2-pcrr", "https://github.com/bkatapi/Advisories", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51095", "desc": "Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formDelWlRfPolicy.", "poc": ["https://github.com/GD008/TENDA/blob/main/M3/delWlPolicyData/M3_delWlPolicyData.md"]}, {"cve": "CVE-2023-52533", "desc": "In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5732", "desc": "An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. This vulnerability affects Firefox < 117, Firefox ESR < 115.4, and Thunderbird < 115.4.1.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1690979", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3147", "desc": "A vulnerability has been found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin\\categories\\view_category.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231016.", "poc": ["https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#7sql-injection-vulnerability-in-admincategoriesview_categoryphp"]}, {"cve": "CVE-2023-26966", "desc": "libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/530", "https://github.com/13579and2468/Wei-fuzz"]}, {"cve": "CVE-2023-0360", "desc": "The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/ba653457-415f-4ab3-a792-42640b59302b"]}, {"cve": "CVE-2023-52446", "desc": "In the Linux kernel, the following vulnerability has been resolved:bpf: Fix a race condition between btf_put() and map_free()When running `./test_progs -j` in my local vm with latest kernel,I once hit a kasan error like below: [ 1887.184724] BUG: KASAN: slab-use-after-free in bpf_rb_root_free+0x1f8/0x2b0 [ 1887.185599] Read of size 4 at addr ffff888106806910 by task kworker/u12:2/2830 [ 1887.186498] [ 1887.186712] CPU: 3 PID: 2830 Comm: kworker/u12:2 Tainted: G OEL 6.7.0-rc3-00699-g90679706d486-dirty #494 [ 1887.188034] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1887.189618] Workqueue: events_unbound bpf_map_free_deferred [ 1887.190341] Call Trace: [ 1887.190666] [ 1887.190949] dump_stack_lvl+0xac/0xe0 [ 1887.191423] ? nf_tcp_handle_invalid+0x1b0/0x1b0 [ 1887.192019] ? panic+0x3c0/0x3c0 [ 1887.192449] print_report+0x14f/0x720 [ 1887.192930] ? preempt_count_sub+0x1c/0xd0 [ 1887.193459] ? __virt_addr_valid+0xac/0x120 [ 1887.194004] ? bpf_rb_root_free+0x1f8/0x2b0 [ 1887.194572] kasan_report+0xc3/0x100 [ 1887.195085] ? bpf_rb_root_free+0x1f8/0x2b0 [ 1887.195668] bpf_rb_root_free+0x1f8/0x2b0 [ 1887.196183] ? __bpf_obj_drop_impl+0xb0/0xb0 [ 1887.196736] ? preempt_count_sub+0x1c/0xd0 [ 1887.197270] ? preempt_count_sub+0x1c/0xd0 [ 1887.197802] ? _raw_spin_unlock+0x1f/0x40 [ 1887.198319] bpf_obj_free_fields+0x1d4/0x260 [ 1887.198883] array_map_free+0x1a3/0x260 [ 1887.199380] bpf_map_free_deferred+0x7b/0xe0 [ 1887.199943] process_scheduled_works+0x3a2/0x6c0 [ 1887.200549] worker_thread+0x633/0x890 [ 1887.201047] ? __kthread_parkme+0xd7/0xf0 [ 1887.201574] ? kthread+0x102/0x1d0 [ 1887.202020] kthread+0x1ab/0x1d0 [ 1887.202447] ? pr_cont_work+0x270/0x270 [ 1887.202954] ? kthread_blkcg+0x50/0x50 [ 1887.203444] ret_from_fork+0x34/0x50 [ 1887.203914] ? kthread_blkcg+0x50/0x50 [ 1887.204397] ret_from_fork_asm+0x11/0x20 [ 1887.204913] [ 1887.204913] [ 1887.205209] [ 1887.205416] Allocated by task 2197: [ 1887.205881] kasan_set_track+0x3f/0x60 [ 1887.206366] __kasan_kmalloc+0x6e/0x80 [ 1887.206856] __kmalloc+0xac/0x1a0 [ 1887.207293] btf_parse_fields+0xa15/0x1480 [ 1887.207836] btf_parse_struct_metas+0x566/0x670 [ 1887.208387] btf_new_fd+0x294/0x4d0 [ 1887.208851] __sys_bpf+0x4ba/0x600 [ 1887.209292] __x64_sys_bpf+0x41/0x50 [ 1887.209762] do_syscall_64+0x4c/0xf0 [ 1887.210222] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1887.210868] [ 1887.211074] Freed by task 36: [ 1887.211460] kasan_set_track+0x3f/0x60 [ 1887.211951] kasan_save_free_info+0x28/0x40 [ 1887.212485] ____kasan_slab_free+0x101/0x180 [ 1887.213027] __kmem_cache_free+0xe4/0x210 [ 1887.213514] btf_free+0x5b/0x130 [ 1887.213918] rcu_core+0x638/0xcc0 [ 1887.214347] __do_softirq+0x114/0x37eThe error happens at bpf_rb_root_free+0x1f8/0x2b0: 00000000000034c0 : ; { 34c0: f3 0f 1e fa endbr64 34c4: e8 00 00 00 00 callq 0x34c9 34c9: 55 pushq %rbp 34ca: 48 89 e5 movq %rsp, %rbp ... ; if (rec && rec->refcount_off >= 0 && 36aa: 4d 85 ed testq %r13, %r13 36ad: 74 a9 je 0x3658 36af: 49 8d 7d 10 leaq 0x10(%r13), %rdi 36b3: e8 00 00 00 00 callq 0x36b8 <==== kasan function 36b8: 45 8b 7d 10 movl 0x10(%r13), %r15d <==== use-after-free load 36bc: 45 85 ff testl %r15d, %r15d 36bf: 78 8c js 0x364d So the problem ---truncated---", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24167", "desc": "Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/add_white_node.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC18/1/1.md"]}, {"cve": "CVE-2023-2705", "desc": "The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin", "poc": ["https://wpscan.com/vulnerability/0b3c83ad-d490-4ca3-8589-39163ea5e24b"]}, {"cve": "CVE-2023-1916", "desc": "A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/537"]}, {"cve": "CVE-2023-38646", "desc": "Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.", "poc": ["http://packetstormsecurity.com/files/174091/Metabase-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Execution.html", "https://github.com/0utl4nder/Another-Metabase-RCE-CVE-2023-38646", "https://github.com/0xrobiul/CVE-2023-38646", "https://github.com/20142995/sectool", "https://github.com/Anekant-Singhai/Exploits", "https://github.com/AnvithLobo/CVE-2023-38646", "https://github.com/Any3ite/cve-2023-38646-metabase-ReverseShell", "https://github.com/Awrrays/FrameVul", "https://github.com/Boogipop/MetabaseRceTools", "https://github.com/CN016/Metabase-H2-CVE-2023-38646-", "https://github.com/Chocapikk/CVE-2023-38646", "https://github.com/DarkFunct/CVE_Exploits", "https://github.com/Ego1stoo/CVE-2023-38646", "https://github.com/LazyySec/CVE-2023-38646", "https://github.com/Loginsoft-LLC/Linux-Exploit-Detection", "https://github.com/Loginsoft-Research/Linux-Exploit-Detection", "https://github.com/Mrunalkaran/CVE-2023-38646", "https://github.com/MzzdToT/HAC_Bored_Writing", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Pumpkin-Garden/POC_Metabase_CVE-2023-38646", "https://github.com/Pyr0sec/CVE-2023-38646", "https://github.com/Red4mber/CVE-2023-38646", "https://github.com/SUT0L/CVE-2023-38646", "https://github.com/Shisones/MetabaseRCE_CVE-2023-38646", "https://github.com/Spectral-Source/Collaborator-like", "https://github.com/SrcVme50/Analytics", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/CVE", "https://github.com/Threekiii/Vulhub-Reproduce", "https://github.com/UserConnecting/Exploit-CVE-2023-38646-Metabase", "https://github.com/Xuxfff/CVE-2023-38646-Poc", "https://github.com/Zenmovie/CVE-2023-38646", "https://github.com/acesoyeo/METABASE-RCE-CVE-2023-38646-", "https://github.com/adriyansyah-mf/metabase", "https://github.com/alexandre-pecorilla/CVE-2023-38646", "https://github.com/asepsaepdin/CVE-2023-38646", "https://github.com/bakery312/Vulhub-Reproduce", "https://github.com/birdm4nw/CVE-2023-38646", "https://github.com/churamanib/metabase-pre-auth-rce-poc-", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/fidjiw/CVE-2023-38646-POC", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/getdrive/PoC", "https://github.com/ggjkjk/1444", "https://github.com/gobysec/Research", "https://github.com/hadrian3689/metabase_preauth_rce", "https://github.com/hheeyywweellccoommee/CVE-2023-38646-glwax", "https://github.com/hheeyywweellccoommee/CVE-2023-38646-hmoje", "https://github.com/hheeyywweellccoommee/CVE-2023-38646-suynl", "https://github.com/hktalent/bug-bounty", "https://github.com/ibaiw/2023Hvv", "https://github.com/iluaster/getdrive_PoC", "https://github.com/j0yb0y0h/CVE-2023-38646", "https://github.com/joaoviictorti/CVE-2023-38646", "https://github.com/junnythemarksman/CVE-2023-38646", "https://github.com/kh4sh3i/CVE-2023-38646", "https://github.com/lazysec0x21/CVE-2023-38646", "https://github.com/m3m0o/metabase-pre-auth-rce-poc", "https://github.com/massco99/Analytics-htb-Rce", "https://github.com/nenandjabhata/CTFs-Journey", "https://github.com/niTROCket51/ctf-writeups", "https://github.com/nickswink/CVE-2023-38646", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/passwa11/2023Hvv_", "https://github.com/passwa11/CVE-2023-38646", "https://github.com/raytheon0x21/CVE-2023-38646", "https://github.com/robotmikhro/CVE-2023-38646", "https://github.com/samurai411/toolbox", "https://github.com/securezeron/CVE-2023-38646", "https://github.com/shamo0/CVE-2023-38646-PoC", "https://github.com/syr1ne/exploits", "https://github.com/threatHNTR/CVE-2023-38646", "https://github.com/xxRON-js/Collaborator-like", "https://github.com/yxl2001/CVE-2023-38646"]}, {"cve": "CVE-2023-27958", "desc": "The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A remote user may be able to cause unexpected system termination or corrupt kernel memory.", "poc": ["https://github.com/houjingyi233/macOS-iOS-system-security"]}, {"cve": "CVE-2023-27900", "desc": "Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.", "poc": ["https://github.com/speedyfriend67/Experiments"]}, {"cve": "CVE-2023-3744", "desc": "Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the \"scrape_image.php\" file in the imageURL parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45687", "desc": "A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizating a session id of their choosing", "poc": ["https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/"]}, {"cve": "CVE-2023-22804", "desc": "LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device.", "poc": ["https://github.com/goheea/goheea"]}, {"cve": "CVE-2023-47622", "desc": "iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1.", "poc": ["https://github.com/martinkubecka/Attributed-CVEs"]}, {"cve": "CVE-2023-24815", "desc": "Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource. When computing the relative path to locate the resource, in case of wildcards, the code: `return \"/\" + rest;` from `Utils.java` returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized `\\` are not properly handled and an attacker can build a path that is valid within the classpath. This issue only affects users deploying in windows environments and upgrading is the advised remediation path. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/vert-x3/vertx-web/security/advisories/GHSA-53jx-vvf9-4x38"]}, {"cve": "CVE-2023-31972", "desc": "** DISPUTED ** yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.", "poc": ["https://github.com/yasm/yasm/issues/209"]}, {"cve": "CVE-2023-40969", "desc": "Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.", "poc": ["https://github.com/slims/slims9_bulian/issues/204"]}, {"cve": "CVE-2023-49047", "desc": "Tenda AX1803 v1.0.0.1 contains a stack overflow via the devName parameter in the function formSetDeviceName.", "poc": ["https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/formSetDeviceName.md"]}, {"cve": "CVE-2023-28874", "desc": "The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0033/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6269", "desc": "An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products \"Session Border Controller\" (SBC) and \"Branch\", before version V10 R3.4.0,\u00a0and OpenScape \"BCF\" before versions V10R10.12.00 and V10R11.05.02. This allows an unauthenticated attacker to gain root access to the appliance via SSH (scope change) and also bypass authentication for the administrative interface and gain access as an arbitrary (administrative) user.", "poc": ["http://packetstormsecurity.com/files/176194/Atos-Unify-OpenScape-Authentication-Bypass-Remote-Code-Execution.html", "http://seclists.org/fulldisclosure/2023/Dec/16", "https://r.sec-consult.com/unifyroot"]}, {"cve": "CVE-2023-35055", "desc": "A buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.This buffer overflow is in the next_page parameter in the gozila_cgi function.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1761"]}, {"cve": "CVE-2023-44484", "desc": "Online Blood Donation Management System v1.0 is vulnerable to a Stored Cross-Site Scripting vulnerability. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43961", "desc": "An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.", "poc": ["https://github.com/m4ra7h0n/m4ra7h0n"]}, {"cve": "CVE-2023-42426", "desc": "Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component.", "poc": ["https://github.com/b0marek/CVE-2023-42426", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-40164", "desc": "Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingStateMachine::NextStater`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-092_Notepad__/", "https://github.com/123papapro/123papapro", "https://github.com/Tonaram/DSS-BufferOverflow"]}, {"cve": "CVE-2023-1804", "desc": "The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.", "poc": ["https://wpscan.com/vulnerability/55b28fa6-a54f-4365-9d59-f9e331c1e11b"]}, {"cve": "CVE-2023-40658", "desc": "A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23514", "desc": "A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, macOS Big Sur 11.7.5. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["http://packetstormsecurity.com/files/171359/XNU-NFSSVC-Root-Check-Bypass-Use-After-Free.html", "http://seclists.org/fulldisclosure/2023/Mar/21", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-26074", "desc": "An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123.. A heap-based buffer overflow in the 5G MM message codec can occur due to insufficient parameter validation when decoding operator-defined access category definitions.", "poc": ["http://packetstormsecurity.com/files/171383/Shannon-Baseband-NrmmMsgCodec-Access-Category-Definitions-Heap-Buffer-Overflow.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-0464", "desc": "A security vulnerability has been identified in all supported versionsof OpenSSL related to the verification of X.509 certificate chainsthat include policy constraints. Attackers may be able to exploit thisvulnerability by creating a malicious certificate chain that triggersexponential use of computational resources, leading to a denial-of-service(DoS) attack on affected systems.Policy processing is disabled by default but can be enabled by passingthe `-policy' argument to the command line utilities or by calling the`X509_VERIFY_PARAM_set1_policies()' function.", "poc": ["https://github.com/1g-v/DevSec_Docker_lab", "https://github.com/ARPSyndicate/cvemon", "https://github.com/L-ivan7/-.-DevSec_Docker", "https://github.com/Trinadh465/Openssl_1.1.1g_CVE-2023-0464", "https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/cloudogu/ces-build-lib", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ortelius/ms-textfile-crud", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-28075", "desc": "Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI in order to gain arbitrary code execution on the system.", "poc": ["https://github.com/another1024/another1024"]}, {"cve": "CVE-2023-1643", "desc": "A vulnerability has been found in IObit Malware Fighter 9.4.0.776 and classified as problematic. Affected by this vulnerability is the function 0x8001E000/0x8001E004/0x8001E018/0x8001E01C/0x8001E024/0x8001E040 in the library ImfHpRegFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224023.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1643", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/2023iThome", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-2691", "desc": "A vulnerability, which was classified as problematic, was found in SourceCodester Personnel Property Equipment System 1.0. Affected is an unknown function of the file admin/add_item.php of the component POST Parameter Handler. The manipulation of the argument item_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228972.", "poc": ["https://vuldb.com/?id.228972"]}, {"cve": "CVE-2023-25262", "desc": "Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather than the client. Therefore, the server causes outbound traffic and potentially imports data. An attacker may also leverage this behaviour to exfiltrate data of machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).", "poc": ["https://cves.at/posts/cve-2023-25262/writeup/", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/trustcves/CVE-2023-25262"]}, {"cve": "CVE-2023-50714", "desc": "yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36728", "desc": "Microsoft SQL Server Denial of Service Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24152", "desc": "A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.", "poc": ["https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/meshSlaveUpdate/meshSlaveUpdate.md", "https://github.com/fullwaywang/QlRules"]}, {"cve": "CVE-2023-27192", "desc": "An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the key_wifi_safe_net_check_url, KEY_Cirus_scan_whitelist and KEY_AD_NEW_USER_AVOID_TIME parameters.", "poc": ["https://apkpure.com/cn/super-security-virus-cleaner/com.ludashi.security", "https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27192/CVE%20detail.md"]}, {"cve": "CVE-2023-27116", "desc": "WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType.", "poc": ["https://github.com/WebAssembly/wabt/issues/1984"]}, {"cve": "CVE-2023-26076", "desc": "An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. An intra-object overflow in the 5G SM message codec can occur due to insufficient parameter validation when decoding reserved options.", "poc": ["http://packetstormsecurity.com/files/171400/Shannon-Baseband-NrSmPcoCodec-Intra-Object-Overflow.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-30146", "desc": "Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the administrator credentials.", "poc": ["https://github.com/L1-0/CVE-2023-30146", "https://github.com/L1-0/CVE-2023-30146", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38139", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/174849/Microsoft-Windows-Kernel-Refcount-Overflow-Use-After-Free.html"]}, {"cve": "CVE-2023-21960", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-0422", "desc": "The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts.", "poc": ["https://wpscan.com/vulnerability/d57f2fb2-5251-4069-8c9a-a4af269c5e62"]}, {"cve": "CVE-2023-30590", "desc": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: \"Generates private and public Diffie-Hellman key values\".The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33675", "desc": "Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the get_parentControl_list_Info function.", "poc": ["https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N5/README.md", "https://github.com/DDizzzy79/Tenda-CVE/tree/main/AC8V4.0/N5", "https://github.com/DDizzzy79/Tenda-CVE", "https://github.com/retr0reg/Tenda-CVE"]}, {"cve": "CVE-2023-21956", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-47704", "desc": "IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48840", "desc": "A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.", "poc": ["http://packetstormsecurity.com/files/176056"]}, {"cve": "CVE-2023-2002", "desc": "A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication.", "poc": ["https://www.openwall.com/lists/oss-security/2023/04/16/3", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/hktalent/TOP", "https://github.com/lrh2000/CVE-2023-2002", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-46454", "desc": "In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.", "poc": ["https://github.com/cyberaz0r/GL.iNet-Multiple-Vulnerabilities", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38678", "desc": "OOB access in paddle.mode\u00a0in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-010.md"]}, {"cve": "CVE-2023-4722", "desc": "Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.", "poc": ["https://huntr.dev/bounties/ddfdb41d-e708-4fec-afe5-68ff1f88f830"]}, {"cve": "CVE-2023-1729", "desc": "A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.", "poc": ["https://github.com/LibRaw/LibRaw/issues/557"]}, {"cve": "CVE-2023-3026", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.", "poc": ["https://huntr.dev/bounties/9bbcc127-1e69-4c88-b318-d2afef48eff0"]}, {"cve": "CVE-2023-48902", "desc": "An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicles, and upload car images via authentication bypass in uploadCarImages.php.", "poc": ["https://packetstormsecurity.com/files/177661/Tramyardg-Autoexpress-1.3.0-Authentication-Bypass.html", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-5153", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231. This affects an unknown part of the file /Tool/querysql.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240249 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.", "poc": ["https://vuldb.com/?id.240249"]}, {"cve": "CVE-2023-1183", "desc": "A flaw was found in the Libreoffice package. An attacker can craft an odb containing a \"database/script\" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.", "poc": ["http://www.openwall.com/lists/oss-security/2023/12/28/4", "http://www.openwall.com/lists/oss-security/2024/01/03/4", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33219", "desc": "The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation operations. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32321", "desc": "CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in `resource_create` and `package_update` actions, using the `ResourceUploader` object. Also reachable via `package_create`, `package_revise`, and `package_patch` via calls to `package_update`. Remote code execution via unsafe pickle loading, via Beaker's session store when configured to use the file session store backend. Potential DOS due to lack of a length check on the resource id. Information disclosure: A user with permission to create a resource can access any other resource on the system if they know the id, even if they don't have access to it. Resource overwrite: A user with permission to create a resource can overwrite any resource if they know the id, even if they don't have access to it. A user with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded file in an arbitrary location. This can be leveraged to Remote Code Execution via Beaker's insecure pickle loading. All the above listed vulnerabilities have been fixed in CKAN 2.9.9 and CKAN 2.10.1. Users are advised to upgrade. There are no known workarounds for these issues.", "poc": ["https://github.com/ckan/ckan/blob/2a6080e61d5601fa0e2a0317afd6a8e9b7abf6dd/CHANGELOG.rst"]}, {"cve": "CVE-2023-45471", "desc": "The QAD Search Server is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to, and including, 1.0.0.315 due to insufficient checks on indexes. This makes it possible for unauthenticated attackers to create a new index and inject a malicious web script into its name, that will execute whenever a user accesses the search page.", "poc": ["https://github.com/itsAptx/CVE-2023-45471", "https://github.com/itsAptx/CVE-2023-45471", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-33562", "desc": "User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51469", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestres do WP Checkout Mestres WP.This issue affects Checkout Mestres WP: from n/a through 7.1.9.6.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1429", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.", "poc": ["https://huntr.dev/bounties/e0829fea-e458-47b8-84a3-a74476d9638f", "https://github.com/ARPSyndicate/cvemon", "https://github.com/khanhchauminh/khanhchauminh"]}, {"cve": "CVE-2023-31417", "desc": "Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.", "poc": ["https://www.elastic.co/community/security"]}, {"cve": "CVE-2023-22013", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-26129", "desc": "All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm-ng.js file. \n**Note:**\nTo execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability to run Node.js code within the target environment. This typically requires some level of access to the system or application hosting the Node.js environment.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-BWMNG-3175876"]}, {"cve": "CVE-2023-5355", "desc": "The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.", "poc": ["https://wpscan.com/vulnerability/d6f7faca-dacf-4455-a837-0404803d0f25"]}, {"cve": "CVE-2023-37241", "desc": "Input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may cause the device to restart.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49378", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.", "poc": ["https://github.com/cui2shark/cms/blob/main/CSRF%20exists%20at%20the%20creation%20location%20of%20the%20custom%20table.md"]}, {"cve": "CVE-2023-1063", "desc": "A vulnerability has been found in SourceCodester Doctors Appointment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/patient.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221827.", "poc": ["https://vuldb.com/?id.221827"]}, {"cve": "CVE-2023-5571", "desc": "Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0.", "poc": ["https://huntr.dev/bounties/926ca25f-dd4a-40cf-8e6b-9d7b5938e95a"]}, {"cve": "CVE-2023-28613", "desc": "An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300. An integer overflow in IPv4 fragment handling can occur due to insufficient parameter validation when reassembling these fragments.", "poc": ["http://packetstormsecurity.com/files/172177/Shannon-Baseband-Integer-Overflow.html"]}, {"cve": "CVE-2023-41474", "desc": "Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.resource component.", "poc": ["https://github.com/JBalanza/CVE-2023-41474", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26136", "desc": "Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.", "poc": ["https://github.com/salesforce/tough-cookie/issues/282", "https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873", "https://github.com/CUCUMBERanOrSNCompany/SealSecurityAssignment", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/mathworks/MATLAB-language-server", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/seal-community/patches", "https://github.com/trong0dn/eth-todo-list"]}, {"cve": "CVE-2023-40166", "desc": "Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-092_Notepad__/", "https://github.com/123papapro/123papapro"]}, {"cve": "CVE-2023-1101", "desc": "SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-32841", "desc": "In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01128524; Issue ID: MOLY01128524 (MSV-846).", "poc": ["https://github.com/AEPP294/5ghoul-5g-nr-attacks", "https://github.com/asset-group/5ghoul-5g-nr-attacks"]}, {"cve": "CVE-2023-32750", "desc": "Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job \"remote-download\" can be used to cause the backend to send a HTTP GET request to a specified URL and save the response to a new file. The response file is then available in a user-specified folder in Pydio Cells.", "poc": ["https://www.redteam-pentesting.de/advisories/rt-sa-2023-005/", "https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses"]}, {"cve": "CVE-2023-29517", "desc": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user running the servlet engine (e.g. tomcat) running XWiki. The same vulnerability also allowed to perform internal requests to resources from the hosting server. The problem has been patched in XWiki 13.10.11, 14.10.1, 14.4.8, 15.0-rc-1. Users are advised to upgrade. It might be possible to workaround this vulnerability by running XWiki in a sandbox with a user with very low privileges on the machine.", "poc": ["https://jira.xwiki.org/browse/XWIKI-20324"]}, {"cve": "CVE-2023-45805", "desc": "pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `pdm.lock` file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project `foo` can be targeted by creating the project `foo-2` and uploading the file `foo-2-2.tar.gz` to pypi.org. PyPI will see this as project `foo-2` version `2`, while PDM will see this as project `foo` version `2-2`. The version must only be `parseable as a version` and the filename must be a prefix of the project name, but it's not verified to match the version being installed. Version `2-2` is also not a valid normalized version per PEP 440. Matching the project name exactly (not just prefix) would fix the issue. When installing dependencies with PDM, what's actually installed could differ from what's listed in `pyproject.toml` (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version. This issue has been addressed in commit `6853e2642df` which is included in release version `2.9.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/pdm-project/pdm/security/advisories/GHSA-j44v-mmf2-xvm9", "https://peps.python.org/pep-0440/#post-release-spelling"]}, {"cve": "CVE-2023-25063", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anadnet Quick Page/Post Redirect Plugin plugin <=\u00a05.2.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27651", "desc": "An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file.", "poc": ["https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27651/CVE%20detail.md"]}, {"cve": "CVE-2023-3178", "desc": "The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack.", "poc": ["https://wpscan.com/vulnerability/5341cb5d-d204-49e1-b013-f8959461995f/"]}, {"cve": "CVE-2023-22058", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-21779", "desc": "Visual Studio Code Remote Code Execution Vulnerability", "poc": ["https://github.com/gbdixg/PSMDE"]}, {"cve": "CVE-2023-31699", "desc": "ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.", "poc": ["https://github.com/ChurchCRM/CRM/issues/6471"]}, {"cve": "CVE-2023-29724", "desc": "The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with this data to cause an escalation of privilege attack.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29724/CVE%20detail.md"]}, {"cve": "CVE-2023-5344", "desc": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.", "poc": ["https://github.com/vim/vim/commit/3bd7fa12e146c6051490d048a4acbfba974eeb04", "https://huntr.dev/bounties/530cb762-899e-48d7-b50e-dad09eb775bf", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26773", "desc": "Cross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote attacker to gain privileges via the product list function in the Master.php file.", "poc": ["https://packetstormsecurity.com/files/171686/Sales-Tracker-Management-System-1.0-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-45077", "desc": "A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-31700", "desc": "TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceAdd.", "poc": ["https://github.com/FirmRec/IoT-Vulns/blob/main/tp-link/postPlcJson/report.md"]}, {"cve": "CVE-2023-7181", "desc": "A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add Attachment Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249368. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.249368"]}, {"cve": "CVE-2023-4349", "desc": "Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31096", "desc": "An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). There is Local Privilege Escalation to SYSTEM via a Stack Overflow in RTLCopyMemory (IOCTL 0x1b2150). An attacker can exploit this to elevate privileges from a medium-integrity process to SYSTEM. This can also be used to bypass kernel-level protections such as AV or PPL, because exploit code runs with high-integrity privileges and can be used in coordinated BYOVD (bring your own vulnerable driver) ransomware campaigns.", "poc": ["https://cschwarz1.github.io/posts/0x04/"]}, {"cve": "CVE-2023-3655", "desc": "cashIT! - serving solutions. Devices from \"PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH\" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that allows to leak the database (system settings, user accounts,...).\u00a0This vulnerability can be triggered by an HTTP endpoint exposed to the network.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35813", "desc": "Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.", "poc": ["https://github.com/BagheeraAltered/CVE-2023-35813-PoC", "https://github.com/aalexpereira/CVE-2023-35813", "https://github.com/aalexpereira/pipelines-tricks", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30563", "desc": "A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52627", "desc": "In the Linux kernel, the following vulnerability has been resolved:iio: adc: ad7091r: Allow users to configure device eventsAD7091R-5 devices are supported by the ad7091r-5 driver together withthe ad7091r-base driver. Those drivers declared iio events for notifyinguser space when ADC readings fall bellow the thresholds of low limitregisters or above the values set in high limit registers.However, to configure iio events and their thresholds, a set of callbackfunctions must be implemented and those were not present until now.The consequence of trying to configure ad7091r-5 events without theproper callback functions was a null pointer dereference in the kernelbecause the pointers to the callback functions were not set.Implement event configuration callbacks allowing users to read/writeevent thresholds and enable/disable event generation.Since the event spec structs are generic to AD7091R devices, also movethose from the ad7091r-5 driver the base driver so they can be reusedwhen support for ad7091r-2/-4/-8 be added.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50472", "desc": "cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.", "poc": ["https://github.com/DaveGamble/cJSON/issues/803"]}, {"cve": "CVE-2023-27745", "desc": "An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending requests to the user server.", "poc": ["https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf"]}, {"cve": "CVE-2023-38432", "desc": "An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read.", "poc": ["https://github.com/chenghungpan/test_data", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50342", "desc": "HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. \u00a0A user can obtain certain details about another user as a result of improper access control.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21670", "desc": "Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.", "poc": ["http://packetstormsecurity.com/files/173296/Qualcomm-Adreno-KGSL-Insecure-Execution.html"]}, {"cve": "CVE-2023-24046", "desc": "An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to run arbitrary commands via use of a crafted string in the ping utility.", "poc": ["https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/"]}, {"cve": "CVE-2023-1562", "desc": "Mattermost fails to check the \"Show Full Name\" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-6166", "desc": "The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting", "poc": ["https://wpscan.com/vulnerability/e6155d9b-f6bb-4607-ad64-1976a8afe907"]}, {"cve": "CVE-2023-0527", "desc": "A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file search-request.php. The manipulation of the argument searchdata with the input \"> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219596.", "poc": ["http://packetstormsecurity.com/files/172667/Online-Security-Guards-Hiring-System-1.0-Cross-Site-Scripting.html", "https://github.com/ctflearner/Vulnerability/blob/main/Online-Security-guard-POC.md", "https://github.com/ctflearner/ctflearner"]}, {"cve": "CVE-2023-0465", "desc": "Applications that use a non-default option when verifying certificates may bevulnerable to an attack from a malicious CA to circumvent certain checks.Invalid certificate policies in leaf certificates are silently ignored byOpenSSL and other certificate policy checks are skipped for that certificate.A malicious CA could use this to deliberately assert invalid certificate policiesin order to circumvent policy checking on the certificate altogether.Policy processing is disabled by default but can be enabled by passingthe `-policy' argument to the command line utilities or by calling the`X509_VERIFY_PARAM_set1_policies()' function.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23127", "desc": "** DISPUTED **In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hktalent/TOP", "https://github.com/l00neyhacker/CVE-2023-23127"]}, {"cve": "CVE-2023-0833", "desc": "A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.", "poc": ["https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9"]}, {"cve": "CVE-2023-50967", "desc": "latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40013", "desc": "SVG Loader is a javascript library that fetches SVGs using XMLHttpRequests and injects the SVG code in the tag's place. According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not sufficient and can be trivially bypassed. This allows an attacker to craft a malicious SVG which can result in Cross-site Scripting (XSS). When trying to sanitize the svg the lib removes event attributes such as `onmouseover`, `onclick` but the list of events is not exhaustive. Any website which uses external-svg-loader and allows its users to provide svg src, upload svg files would be susceptible to stored XSS attack. This issue has been addressed in commit `d3562fc08` which is included in releases from 1.6.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/shubhamjain/svg-loader/security/advisories/GHSA-xc2r-jf2x-gjr8"]}, {"cve": "CVE-2023-6816", "desc": "A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21916", "desc": "Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-49088", "desc": "Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http:///cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-hrg9-qqqx-wc4h", "https://github.com/Cacti/cacti/security/advisories/GHSA-q7g7-gcf6-wh4x", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-27777", "desc": "Cross-site scripting (XSS) vulnerability was discovered in Online Jewelry Shop v1.0 that allows attackers to execute arbitrary script via a crafted URL.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/lohyt/Privilege-escalation-in-online-jewelry-website"]}, {"cve": "CVE-2023-23773", "desc": "Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract secret key material, and/or leave a persistent implant on the device.", "poc": ["https://tetraburst.com/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0502", "desc": "The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/c959f4ce-b6ea-4aee-9a98-aa98d2a62138"]}, {"cve": "CVE-2023-47147", "desc": "IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow an attacker to overwrite a log message under specific conditions. IBM X-Force ID: 270598.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2875", "desc": "A vulnerability, which was classified as problematic, was found in eScan Antivirus 22.0.1400.2443. Affected is the function 0x22E008u in the library PROCOBSRVESX.SYS of the component IoControlCode Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2875", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-49210", "desc": "** UNSUPPORTED WHEN ASSIGNED ** The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as \"a nonsense wrapper with no real purpose\" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e", "https://github.com/chnzzh/OpenSSL-CVE-lib"]}, {"cve": "CVE-2023-30380", "desc": "An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal.", "poc": ["https://github.com/Howard512966/DedeCMS-v5.7.107-Directory-Traversal"]}, {"cve": "CVE-2023-45229", "desc": "EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.", "poc": ["http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html", "https://github.com/quarkslab/pixiefail"]}, {"cve": "CVE-2023-3657", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. This issue affects some unknown processing of the file Master.php?f=save_book of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-234011.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3047", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMT Lockcell allows SQL Injection.This issue affects Lockcell: before 15.", "poc": ["https://github.com/Kimsovannareth/Phamchie", "https://github.com/Phamchie/CVE-2023-3047", "https://github.com/d0r4-hackers/dora-hacking", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-24621", "desc": "An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.", "poc": ["https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38666", "desc": "Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.", "poc": ["https://github.com/axiomatic-systems/Bento4/issues/784"]}, {"cve": "CVE-2023-51693", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Icons allows Stored XSS.This issue affects Themify Icons: from n/a through 2.0.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3439", "desc": "A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.", "poc": ["http://www.openwall.com/lists/oss-security/2023/07/02/1", "https://github.com/torvalds/linux/commit/b561275d633bcd8e0e8055ab86f1a13df75a0269"]}, {"cve": "CVE-2023-5101", "desc": "Files or Directories Accessible to External Parties in RDT400 in SICK APU allows anunprivileged remote attacker to download various files from the server via HTTP requests.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1413", "desc": "The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/6938fee5-3510-45e6-8112-c9e2b30f6881"]}, {"cve": "CVE-2023-51033", "desc": "TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi setOpModeCfg interface.", "poc": ["https://815yang.github.io/2023/12/12/ex1200l/totolink_ex1200L_setOpModeCfg/"]}, {"cve": "CVE-2023-27159", "desc": "Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.", "poc": ["https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a", "https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb"]}, {"cve": "CVE-2023-36656", "desc": "Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via the KeyValuesTable component.", "poc": ["https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r"]}, {"cve": "CVE-2023-29573", "desc": "Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.", "poc": ["https://github.com/axiomatic-systems/Bento4/issues/840", "https://github.com/z1r00/fuzz_vuln/blob/main/Bento4/mp4info/readme.md", "https://github.com/z1r00/fuzz_vuln"]}, {"cve": "CVE-2023-7004", "desc": "The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity.", "poc": ["https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48197", "desc": "Cross-Site Scripting (XSS) vulnerability in the \u2018manageApiKeys\u2019 component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the \"see QR code\" function.", "poc": ["https://nitipoom-jar.github.io/CVE-2023-48197/", "https://github.com/nitipoom-jar/CVE-2023-48197", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-39619", "desc": "ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component.", "poc": ["https://gist.github.com/6en6ar/712a4c1eab0324f15e09232c77ea08f8"]}, {"cve": "CVE-2023-2615", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/af9c360a-87f8-4e97-a24b-6db675ee942a"]}, {"cve": "CVE-2023-52623", "desc": "In the Linux kernel, the following vulnerability has been resolved:SUNRPC: Fix a suspicious RCU usage warningI received the following warning while running cthon against an ontapserver running pNFS:[ 57.202521] =============================[ 57.202522] WARNING: suspicious RCU usage[ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted[ 57.202525] -----------------------------[ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!![ 57.202527] other info that might help us debug this:[ 57.202528] rcu_scheduler_active = 2, debug_locks = 1[ 57.202529] no locks held by test5/3567.[ 57.202530] stack backtrace:[ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e[ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022[ 57.202536] Call Trace:[ 57.202537] [ 57.202540] dump_stack_lvl+0x77/0xb0[ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0[ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6][ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6][ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6][ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6][ 57.202671] ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6][ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9][ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9][ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a][ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a][ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9][ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902][ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902][ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902][ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902][ 57.202866] write_cache_pages+0x265/0x450[ 57.202870] ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902][ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902][ 57.202913] do_writepages+0xd2/0x230[ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80[ 57.202921] filemap_fdatawrite_wbc+0x67/0x80[ 57.202924] filemap_write_and_wait_range+0xd9/0x170[ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902][ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9][ 57.202969] __se_sys_close+0x46/0xd0[ 57.202972] do_syscall_64+0x68/0x100[ 57.202975] ? do_syscall_64+0x77/0x100[ 57.202976] ? do_syscall_64+0x77/0x100[ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76[ 57.202982] RIP: 0033:0x7fe2b12e4a94[ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3[ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003[ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94[ 57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003[ 57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49[ 57.202993] R10: 00007f---truncated---", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52620", "desc": "In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: disallow timeout for anonymous setsNever used from userspace, disallow these parameters.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-5253", "desc": "A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication.Malicious unauthenticated users with knowledge on the underlying system may be able to extract asset information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3712", "desc": "Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This issue affects PM43 versions prior to P10.19.050004.\u00a0Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).", "poc": ["https://www.honeywell.com/us/en/product-security", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/vpxuser/CVE-2023-3712-POC"]}, {"cve": "CVE-2023-35641", "desc": "Internet Connection Sharing (ICS) Remote Code Execution Vulnerability", "poc": ["https://github.com/myseq/ms_patch_tuesday"]}, {"cve": "CVE-2023-33560", "desc": "There is a Cross Site Scripting (XSS) vulnerability in \"cid\" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24780", "desc": "Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.", "poc": ["https://github.com/funadmin/funadmin/issues/6", "https://github.com/ARPSyndicate/cvemon", "https://github.com/csffs/CVE-2023-24775-and-CVE-2023-24780", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-48702", "desc": "Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `ProcessStartInfo` via the `ValidateVersion` function. A malicious administrator can setup a network share and supply a UNC path to `/System/MediaEncoder/Path` which points to an executable on the network share, causing Jellyfin server to run the executable in the local context. The endpoint was removed in version 10.8.13.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-028_jellyfin/"]}, {"cve": "CVE-2023-38760", "desc": "SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-52557", "desc": "In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37722", "desc": "Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromSafeUrlFilter.", "poc": ["https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/fromSafeUrlFilter/report.md"]}, {"cve": "CVE-2023-46347", "desc": "In the module \"Step by Step products Pack\" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The method `NdkSpack::getPacks()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.", "poc": ["https://security.friendsofpresta.org/modules/2023/10/24/ndk_steppingpack.html"]}, {"cve": "CVE-2023-33517", "desc": "carRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end System).", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5594", "desc": "Improper validation of the server\u2019s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algorithm as trusted.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52235", "desc": "SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Rebinding attack.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-0019", "desc": "In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-7080", "desc": "The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect to the inspector and run arbitrary code. Additionally, the inspector server did not validate Origin/Host headers, granting an attacker that can trick any user on the local network into opening a malicious website the ability to run code. If wrangler dev --remote was being used, an attacker could access production resources if they were bound to the worker.This issue was fixed in wrangler@3.19.0 and wrangler@2.20.2. Whilst wrangler dev's inspector server listens on local interfaces by default as of wrangler@3.16.0, an SSRF vulnerability in miniflare https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7 \u00a0(CVE-2023-7078) allowed access from the local network until wrangler@3.18.0. wrangler@3.19.0 and wrangler@2.20.2 introduced validation for the Origin/Host headers.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/mix-archive/MessyStack"]}, {"cve": "CVE-2023-23399", "desc": "Microsoft Excel Remote Code Execution Vulnerability", "poc": ["http://packetstormsecurity.com/files/171767/Microsoft-Excel-365-MSO-2302-Build-16.0.16130.20186-Remote-Code-Execution.html", "https://github.com/2lambda123/CVE-mitre", "https://github.com/ARPSyndicate/cvemon", "https://github.com/nu11secur1ty/CVE-mitre"]}, {"cve": "CVE-2023-0316", "desc": "Path Traversal: '\\..\\filename' in GitHub repository froxlor/froxlor prior to 2.0.0.", "poc": ["https://huntr.dev/bounties/c190e42a-4806-47aa-aa1e-ff5d6407e244", "https://github.com/ARPSyndicate/cvemon", "https://github.com/kos0ng/CVEs"]}, {"cve": "CVE-2023-6719", "desc": "An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable application, and can be exploited by a third party by sending a specially crafted JavaScript payload to a user, and thus gain full control of their session.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4814", "desc": "A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does not have permission to.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10407"]}, {"cve": "CVE-2023-31124", "desc": "c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52357", "desc": "Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect availability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37786", "desc": "Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail Settings[backend], Mail Settings[host], Mail Settings[port] and Mail Settings[auth] parameters of the /admin/configuration.php.", "poc": ["https://github.com/CrownZTX/reflectedxss1", "https://github.com/Phamchie/CVE-2023-37786", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-21389", "desc": "In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sxsuperxuan/Weblogic_CVE-2023-21389"]}, {"cve": "CVE-2023-6677", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Financial Technology Online Collection allows SQL Injection.This issue affects Online Collection: before v.1.0.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38203", "desc": "Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.", "poc": ["https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html", "https://github.com/Ostorlab/KEV"]}, {"cve": "CVE-2023-0701", "desc": "Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interaction . (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-2404", "desc": "The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita"]}, {"cve": "CVE-2023-40610", "desc": "Improper authorization check and possible privilege escalation on Apache Superset\u00a0up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.", "poc": ["https://github.com/orangecertcc/security-research/security/advisories/GHSA-f678-j579-4xf5"]}, {"cve": "CVE-2023-4060", "desc": "The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/88745c9b-1c20-4004-89f6-d9ee223651f2"]}, {"cve": "CVE-2023-0836", "desc": "An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-6200", "desc": "A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52625", "desc": "In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Refactor DMCUB enter/exit idle interface[Why]We can hang in place trying to send commands when the DMCUB isn'tpowered on.[How]We need to exit out of the idle state prior to sending a command,but the process that performs the exit also invokes a command itself.Fixing this issue involves the following:1. Using a software state to track whether or not we need to start the process to exit idle or notify idle.It's possible for the hardware to have exited an idle state withoutdriver knowledge, but entering one is always restricted to a driverallow - which makes the SW state vs HW state mismatch issue purely oneof optimization, which should seldomly be hit, if at all.2. Refactor any instances of exit/notify idle to use a single wrapper that maintains this SW state.This works simialr to dc_allow_idle_optimizations, but works at theDMCUB level and makes sure the state is marked prior to any notify/exitidle so we don't enter an infinite loop.3. Make sure we exit out of idle prior to sending any commands or waiting for DMCUB idle.This patch takes care of 1/2. A future patch will take care of wrappingDMCUB command submission with calls to this new interface.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39828", "desc": "Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.", "poc": ["https://github.com/lst-oss/Vulnerability/tree/main/Tenda/A18/formWifiBasicSet"]}, {"cve": "CVE-2023-6048", "desc": "The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset", "poc": ["https://wpscan.com/vulnerability/74cb07fe-fc82-472f-8c52-859c176d9e51"]}, {"cve": "CVE-2023-37996", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix GTmetrix for WordPress plugin <=\u00a00.4.7 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41847", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WEN Solutions Notice Bar plugin <=\u00a03.1.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5983", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Botanik Software Pharmacy Automation allows Retrieve Embedded Sensitive Data.This issue affects Pharmacy Automation: before 2.1.133.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46772", "desc": "Vulnerability of parameters being out of the value range in the QMI service module. Successful exploitation of this vulnerability may cause errors in reading file data.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5203", "desc": "The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.", "poc": ["https://wpscan.com/vulnerability/7f4f505b-2667-4e0f-9841-9c1cd0831932", "https://github.com/20142995/sectool", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-51016", "desc": "TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the setRebootScheCfg interface of the cstecgi .cgi.", "poc": ["https://815yang.github.io/2023/12/10/EX1800T/TOTOlink%20EX1800T_V9.1.0cu.2112_B20220316(setRebootScheCfg)/"]}, {"cve": "CVE-2023-0827", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.", "poc": ["https://huntr.dev/bounties/75bc7d07-46a7-4ed9-a405-af4fc47fb422"]}, {"cve": "CVE-2023-3129", "desc": "The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/5717d729-c24b-4415-bb99-fcdd259328c4"]}, {"cve": "CVE-2023-4237", "desc": "A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36696", "desc": "Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability", "poc": ["https://github.com/myseq/ms_patch_tuesday"]}, {"cve": "CVE-2023-20226", "desc": "A vulnerability in Application Quality of Experience (AppQoE) and Unified Threat Defense (UTD) on Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.\nThis vulnerability is due to the mishandling of a crafted packet stream through the AppQoE or UTD application. An attacker could exploit this vulnerability by sending a crafted packet stream through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4279", "desc": "This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.", "poc": ["https://wpscan.com/vulnerability/2bd2579e-b383-4d12-b207-6fc32cfb82bc", "https://github.com/b0marek/CVE-2023-4279", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-41504", "desc": "SQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary code via the Student Search function.", "poc": ["https://github.com/ASR511-OO7/CVE-2023-41504", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-34936", "desc": "A stack overflow in the UpdateMacClone function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", "poc": ["https://github.com/h4kuy4/vuln/blob/main/H3C_B1STW/CVE-2023-34936.md"]}, {"cve": "CVE-2023-48193", "desc": "Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function.", "poc": ["https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-32563", "desc": "An unauthenticated attacker could achieve the code execution through a RemoteControl server.", "poc": ["https://github.com/mayur-esh/vuln-liners"]}, {"cve": "CVE-2023-3314", "desc": "A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to control the process execution of the .zip application allows an authorized user to obtain control of the .zip application to execute arbitrary commands or obtain elevation of system privileges.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10403"]}, {"cve": "CVE-2023-30868", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jon Christopher CMS Tree Page View plugin <=\u00a01.6.7 versions.", "poc": ["http://packetstormsecurity.com/files/172730/WordPress-Tree-Page-View-1.6.7-Cross-Site-Scripting.html", "https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-40550", "desc": "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1176", "desc": "Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.", "poc": ["https://huntr.dev/bounties/ae92f814-6a08-435c-8445-eec0ef4f1085"]}, {"cve": "CVE-2023-4276", "desc": "The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abpr_profileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40293", "desc": "Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.", "poc": ["https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/"]}, {"cve": "CVE-2023-22796", "desc": "A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/holmes-py/reports-summary"]}, {"cve": "CVE-2023-46382", "desc": "LOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3 devices use cleartext HTTP for login.", "poc": ["http://packetstormsecurity.com/files/175646/LOYTEC-Electronics-Insecure-Transit-Insecure-Permissions-Unauthenticated-Access.html"]}, {"cve": "CVE-2023-36918", "desc": "In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads to Cross-Site Scripting, which could result in disclosure or modification of information.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-35857", "desc": "In Siren Investigate before 13.2.2, session keys remain active even after logging out.", "poc": ["https://github.com/ghsec/getEPSS"]}, {"cve": "CVE-2023-51547", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support \u2013 WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support \u2013 WordPress Helpdesk and Customer Support Ticket Plugin: from n/a through 1.7.6.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4599", "desc": "The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43651", "desc": "JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands. This vulnerability has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/N0th1n3/JumpServer-MySQLRCE", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39902", "desc": "A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23660", "desc": "Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP MainWP Maintenance Extension plugin <=\u00a04.1.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27572", "desc": "An issue was discovered in CommScope Arris DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10. A reflected XSS vulnerability was discovered in the https_redirect.php web page via the page parameter.", "poc": ["https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-arris-dg3450-cable-gateway/"]}, {"cve": "CVE-2023-47182", "desc": "Cross-Site Request Forgery (CSRF) leading to a Stored Cross-Site Scripting (XSS) vulnerability in Nazmul Hossain Nihal Login Screen Manager plugin <=\u00a03.5.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5304", "desc": "A vulnerability has been found in Online Banquet Booking System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /book-services.php of the component Service Booking. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-240943.", "poc": ["https://github.com/scumdestroy/scumdestroy"]}, {"cve": "CVE-2023-44048", "desc": "Sourcecodester Expense Tracker App v1 is vulnerable to Cross Site Scripting (XSS) via add category.", "poc": ["https://github.com/xcodeOn1/XSS-Stored-Expense-Tracker-App/tree/main", "https://github.com/xcodeOn1/xcode0x-CVEs/blob/main/CVE/CVE-2023-44048.md", "https://github.com/xcodeOn1/xcode0x-CVEs"]}, {"cve": "CVE-2023-5196", "desc": "Mattermost fails to enforce character limits in all possible notification props allowing an attacker to\u00a0send a really long value for a notification_prop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming temporarily unavailable for its users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3509", "desc": "An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated with projects in the group.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/416945"]}, {"cve": "CVE-2023-5583", "desc": "The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.34 via deserialization of untrusted input from the 'wpsimplegallery_gallery' post meta via 'wpsgallery' shortcode. This allows authenticated attackers, with contributor-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27326", "desc": "Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability.The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-18933.", "poc": ["https://github.com/Impalabs/CVE-2023-27326", "https://github.com/Malwareman007/CVE-2023-27326", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/WinMin/awesome-vm-exploit", "https://github.com/izj007/wechat", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/taielab/awesome-hacking-lists", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-21332", "desc": "In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26116", "desc": "Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.", "poc": ["https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406320", "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406322", "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406321", "https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373044", "https://github.com/patrikx3/redis-ui"]}, {"cve": "CVE-2023-30729", "desc": "Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including sensitive information.", "poc": ["https://github.com/aapooksman/certmitm"]}, {"cve": "CVE-2023-32172", "desc": "Unified Automation UaGateway OPC UA Server Use-After-Free Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability.The specific flaw exists within the implementation of the ImportXML function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20497.", "poc": ["https://github.com/claroty/opcua-exploit-framework"]}, {"cve": "CVE-2023-2628", "desc": "The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)", "poc": ["https://wpscan.com/vulnerability/e0741e2c-c529-4815-8744-16e01cdb0aed"]}, {"cve": "CVE-2023-44023", "desc": "Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.", "poc": ["https://github.com/aixiao0621/Tenda/blob/main/AC10U/4/0.md", "https://github.com/aixiao0621/Tenda"]}, {"cve": "CVE-2023-39515", "desc": "Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_debug.php` displays data source related debugging information such as _data source paths, polling settings, meta-data on the data source_. _CENSUS_ found that an adversary that is able to configure a malicious data-source path, can deploy a stored XSS attack against any user that has privileges related to viewing the `data_debug.php` information. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the data source path in _cacti_. This configuration occurs through `http:///cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-hrg9-qqqx-wc4h", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-36941", "desc": "A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the team name, leader, and member fields.", "poc": ["https://packetstormsecurity.com"]}, {"cve": "CVE-2023-3209", "desc": "The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.", "poc": ["https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c"]}, {"cve": "CVE-2023-0234", "desc": "The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.", "poc": ["https://wpscan.com/vulnerability/acf3e369-1290-4b3f-83bf-2209b9dd06e1"]}, {"cve": "CVE-2023-24166", "desc": "Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/formWifiBasicSet.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC18/2/2.md"]}, {"cve": "CVE-2023-32444", "desc": "A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. A sandboxed process may be able to circumvent sandbox restrictions.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-4023", "desc": "The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.", "poc": ["https://wpscan.com/vulnerability/682c0226-28bd-4051-830d-8b679626213d", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28659", "desc": "The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] parameter of the pbc_save_downs action.", "poc": ["https://www.tenable.com/security/research/tra-2023-2", "https://github.com/ARPSyndicate/cvemon", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-23064", "desc": "TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control.", "poc": ["https://github.com/shellpei/TOTOLINK-Unauthorized/blob/main/CVE-2023-23064"]}, {"cve": "CVE-2023-46344", "desc": "A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate their privileges by exploiting a stored cross-site scripting (XSS) vulnerability in the switch group function under /#ilang=DE&b=c_smartenergy_swgroups in the web portal. The vulnerability can be exploited to gain the rights of an installer or PM, which can then be used to gain administrative access to the web portal and execute further attacks.", "poc": ["https://github.com/vinnie1717/CVE-2023-46344/blob/main/Solar-Log%20XSS", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/vinnie1717/CVE-2023-46344"]}, {"cve": "CVE-2023-22074", "desc": "Vulnerability in the Oracle Database Sharding component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows high privileged attacker having Create Session, Select Any Dictionary privilege with network access via Oracle Net to compromise Oracle Database Sharding. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Sharding. CVSS 3.1 Base Score 2.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L).", "poc": ["http://packetstormsecurity.com/files/175352/Oracle-19c-21c-Sharding-Component-Password-Hash-Exposure.html", "https://github.com/emad-almousa/CVE-2023-22074", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-40743", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through \"ServiceFactory.getService\" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to \"ServiceFactory.getService\", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.", "poc": ["https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9", "https://github.com/junxiant/xnat-aws-monailabel"]}, {"cve": "CVE-2023-1720", "desc": "Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via uploading a crafted HTML file through /desktop_app/file.ajax.php?action=uploadfile.", "poc": ["https://starlabs.sg/advisories/23/23-1720/"]}, {"cve": "CVE-2023-40037", "desc": "Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.", "poc": ["https://github.com/mbadanoiu/CVE-2023-34212", "https://github.com/mbadanoiu/CVE-2023-34468", "https://github.com/mbadanoiu/CVE-2023-40037", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-25462", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP htaccess Control plugin <=\u00a03.5.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52074", "desc": "FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updagte.", "poc": ["https://github.com/zouyang0714/cms/blob/main/1.md"]}, {"cve": "CVE-2023-27561", "desc": "runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.", "poc": ["https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9", "https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334", "https://github.com/opencontainers/runc/issues/3751", "https://github.com/shakyaraj9569/Documentation", "https://github.com/ssst0n3/docker_archive"]}, {"cve": "CVE-2023-22020", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-4965", "desc": "A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239732.", "poc": ["https://github.com/ctflearner/Vulnerability/blob/main/PHPIPAM/Open_Redirect.md"]}, {"cve": "CVE-2023-0329", "desc": "The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.", "poc": ["http://packetstormsecurity.com/files/175639/Elementor-Website-Builder-SQL-Injection.html", "https://wpscan.com/vulnerability/a875836d-77f4-4306-b275-2b60efff1493"]}, {"cve": "CVE-2023-2470", "desc": "The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.", "poc": ["https://wpscan.com/vulnerability/de0adf26-8a0b-4b90-96d5-4bec6e770e04"]}, {"cve": "CVE-2023-44808", "desc": "D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function.", "poc": ["https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug3.md"]}, {"cve": "CVE-2023-22621", "desc": "Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.", "poc": ["https://github.com/strapi/strapi/releases", "https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve", "https://www.ghostccamm.com/blog/multi_strapi_vulns/", "https://github.com/ARPSyndicate/cvemon", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sofianeelhor/CVE-2023-22621-POC", "https://github.com/strapi/security-patches"]}, {"cve": "CVE-2023-6631", "desc": "PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4073", "desc": "Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7129", "desc": "A vulnerability, which was classified as critical, was found in code-projects Voting System 1.0. Affected is an unknown function of the component Voters Login. The manipulation of the argument voter leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249132.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/Voting_System/Voting_System-SQL_Injection-2.md", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-21224", "desc": "In ss_ProcessReturnResultComponent of ss_MmConManagement.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-265276966References: N/A", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6568", "desc": "A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim's browser. The vulnerability is present in the mlflow/server/auth/__init__.py file, where the user-supplied Content-Type header is directly injected into a Python formatted string and returned to the user, facilitating the XSS attack.", "poc": ["https://huntr.com/bounties/816bdaaa-8153-4732-951e-b0d92fddf709", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24785", "desc": "An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea UNPEA feature.", "poc": ["https://sourceforge.net/p/peazip/tickets/734/"]}, {"cve": "CVE-2023-32422", "desc": "This issue was addressed by adding additional SQLite logging restrictions. This issue is fixed in iOS 16.5 and iPadOS 16.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to bypass Privacy preferences.", "poc": ["https://github.com/gergelykalman/CVE-2023-32422-a-macOS-TCC-bypass-in-sqlite", "https://github.com/houjingyi233/macOS-iOS-system-security", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-36815", "desc": "Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account `sealos[.] io/v1/Payment`, resulting in the ability to recharge any amount of 1 renminbi (RMB). The charging interface may expose resource information. The namespace of this custom resource would be user's control and may have permission to correct it. It is not clear whether a fix exists.", "poc": ["https://github.com/labring/sealos/security/advisories/GHSA-vpxf-q44g-w34w"]}, {"cve": "CVE-2023-25103", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_dmvpn function with the gre_ip and the gre_mask variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-22958", "desc": "The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter.", "poc": ["https://github.com/piuppi/Proof-of-Concepts/blob/main/Syracom/SecureLogin2FA-OpenRedirect.md", "https://github.com/piuppi/Proof-of-Concepts"]}, {"cve": "CVE-2023-49328", "desc": "On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module.", "poc": ["https://www.gruppotim.it/it/footer/red-team.html"]}, {"cve": "CVE-2023-41079", "desc": "The issue was addressed with improved permissions logic. This issue is fixed in macOS Sonoma 14. An app may be able to bypass Privacy preferences.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0940", "desc": "The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.", "poc": ["https://wpscan.com/vulnerability/56744f72-2d48-4f42-8195-24b4dd951bb5"]}, {"cve": "CVE-2023-38745", "desc": "Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating files via the --extract-media option or outputting to PDF format. This allows an attacker to create or overwrite arbitrary files, depending on the privileges of the process running Pandoc. It only affects systems that pass untrusted user input to Pandoc and allow Pandoc to be used to produce a PDF or with the --extract-media option. NOTE: this issue exists because of an incomplete fix for CVE-2023-35936 (failure to properly account for double encoded path names).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52203", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliver Seidel, Bastian Germann cformsII allows Stored XSS.This issue affects cformsII: from n/a through 15.0.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25461", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in namithjawahar Wp-Insert plugin <=\u00a02.5.0 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/yaudahbanh/CVE-Archive"]}, {"cve": "CVE-2023-50126", "desc": "Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical proximity to one of the original tags, which results in an attacker being able to bring the alarm system to a disarmed state.", "poc": ["https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices"]}, {"cve": "CVE-2023-47529", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.", "poc": ["https://github.com/RandomRobbieBF/CVE-2023-47529", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-39288", "desc": "A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. A successful exploit could allow an attacker to access network information and to generate excessive network traffic.", "poc": ["https://github.com/SYNgularity1/mitel-exploits"]}, {"cve": "CVE-2023-26146", "desc": "All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a malicious payload is served by the application, the filename is displayed without proper sanitization when it is rendered.", "poc": ["https://gist.github.com/dellalibera/c53448135480cbe12257c4b413a90d20", "https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730766", "https://github.com/dellalibera/dellalibera", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43760", "desc": "Certain WithSecure products allow Denial of Service via a fuzzed PE32 file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49255", "desc": "The router console is accessible without authentication at \"data\" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated one. If the logged in user has administrative privileges, it is possible to use webadmin service configuration commands to create a new admin user with a chosen password.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6007", "desc": "The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.1.1. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options.", "poc": ["https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681"]}, {"cve": "CVE-2023-38766", "desc": "Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-44093", "desc": "Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46919", "desc": "Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K encryption key. The threat is from a man-in-the-middle attacker who can intercept and potentially modify data during transmission.", "poc": ["https://github.com/actuator/com.phlox.simpleserver", "https://github.com/actuator/cve"]}, {"cve": "CVE-2023-6656", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. It has been rated as critical. Affected by this issue is some unknown functionality of the file DFLIMG/DFLJPG.py. The manipulation leads to deserialization. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of this vulnerability is VDB-247364. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49086", "desc": "Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). Bypassing an earlier fix (CVE-2023-39360) that leads to a DOM XSS attack.Exploitation of the vulnerability is possible for an authorized user. The vulnerable component isthe `graphs_new.php`. Impact of the vulnerability - execution of arbitrary javascript code inthe attacked user's browser. This issue has been patched in version 1.2.26.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-wc73-r2vw-59pr", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38675", "desc": "FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-007.md"]}, {"cve": "CVE-2023-33101", "desc": "Transient DOS while processing DL NAS TRANSPORT message with payload length 0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32353", "desc": "A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to elevate privileges.", "poc": ["https://github.com/86x/CVE-2023-32353-PoC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6338", "desc": "Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1571", "desc": "A vulnerability, which was classified as critical, was found in DataGear up to 4.5.0. This affects an unknown part of the file /analysisProject/pagingQueryData. The manipulation of the argument queryOrder leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223563.", "poc": ["https://vuldb.com/?id.223563"]}, {"cve": "CVE-2023-37611", "desc": "Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/management/media component.", "poc": ["https://rodelllemit.medium.com/stored-xss-in-neo-cms-8-3-3-9bd1cb973c5b", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7063", "desc": "The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51828", "desc": "A SQL Injection vulnerability in /admin/convert/export.class.php in PMB 7.4.7 and earlier versions allows remote unauthenticated attackers to execute arbitrary SQL commands via the query parameter in get_next_notice function.", "poc": ["https://nexacybersecurity.blogspot.com/2024/02/journey-finding-vulnerabilities-in-pmb-library-management-system.html"]}, {"cve": "CVE-2023-38427", "desc": "An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_contexts.", "poc": ["https://github.com/chenghungpan/test_data"]}, {"cve": "CVE-2023-34468", "desc": "The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.The resolution validates the Database URL and rejects H2 JDBC locations.You are recommended to upgrade to version 1.22.0 or later which fixes this issue.", "poc": ["http://packetstormsecurity.com/files/174398/Apache-NiFi-H2-Connection-String-Remote-Code-Execution.html", "https://github.com/itaispiegel/infosec-workshop", "https://github.com/mbadanoiu/CVE-2023-34468", "https://github.com/mbadanoiu/CVE-2023-40037", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27568", "desc": "SQL injection vulnerability inSpryker Commerce OS 0.9 that allows for access to sensitive data via customer/order?orderSearchForm[searchText]=", "poc": ["http://packetstormsecurity.com/files/172257/Spryker-Commerce-OS-1.0-SQL-Injection.html"]}, {"cve": "CVE-2023-52452", "desc": "In the Linux kernel, the following vulnerability has been resolved:bpf: Fix accesses to uninit stack slotsPrivileged programs are supposed to be able to read uninitialized stackmemory (ever since 6715df8d5) but, before this patch, these accesseswere permitted inconsistently. In particular, accesses were permittedabove state->allocated_stack, but not below it. In other words, if thestack was already \"large enough\", the access was permitted, butotherwise the access was rejected instead of being allowed to \"grow thestack\". This undesired rejection was happening in two places:- in check_stack_slot_within_bounds()- in check_stack_range_initialized()This patch arranges for these accesses to be permitted. A bunch of teststhat were relying on the old rejection had to change; all of them werechanged to add also run unprivileged, in which case the old behaviorpersists. One tests couldn't be updated - global_func16 - because itcan't run unprivileged for other reasons.This patch also fixes the tracking of the stack size for variable-offsetreads. This second fix is bundled in the same commit as the first onebecause they're inter-related. Before this patch, writes to the stackusing registers containing a variable offset (as opposed to registerswith fixed, known values) were not properly contributing to thefunction's needed stack size. As a result, it was possible for a programto verify, but then to attempt to read out-of-bounds data at runtimebecause a too small stack had been allocated for it.Each function tracks the size of the stack it needs inbpf_subprog_info.stack_depth, which is maintained byupdate_stack_depth(). For regular memory accesses, check_mem_access()was calling update_state_depth() but it was passing in only the fixedpart of the offset register, ignoring the variable offset. This wasincorrect; the minimum possible value of that register should be usedinstead.This tracking is now fixed by centralizing the tracking of stack size ingrow_stack_state(), and by lifting the calls to grow_stack_state() tocheck_stack_access_within_bounds() as suggested by Andrii. The code isnow simpler and more convincingly tracks the correct maximum stack size.check_stack_range_initialized() can now rely on enough stack having beenallocated for the access; this helps with the fix for the first issue.A few tests were changed to also check the stack depth computation. Theone that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2658", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknown functionality of the file products.php. The manipulation of the argument c leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228800.", "poc": ["https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Online-Computer-and-Laptop-Store---Multiple-vulnerabilities.md#2sql-injection-vulnerability-in-productsphp", "https://vuldb.com/?id.228800"]}, {"cve": "CVE-2023-27842", "desc": "Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via the index.php compenent", "poc": ["http://blog.tristaomarinho.com/extplorer-2-1-15-insecure-permissions-following-remote-code-execution/", "https://github.com/tristao-marinho/CVE-2023-27842", "https://github.com/tristao-marinho/CVE-2023-27842/blob/main/README.md", "https://github.com/0xFTW/CVE-2023-27842", "https://github.com/cowsecurity/CVE-2023-27842", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tristao-marinho/CVE-2023-27842"]}, {"cve": "CVE-2023-27451", "desc": "Server-Side Request Forgery (SSRF) vulnerability in Darren Cooney Instant Images plugin <=\u00a05.1.0.2 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Universe1122/Universe1122"]}, {"cve": "CVE-2023-32163", "desc": "Wacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Tablet Service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-16857.", "poc": ["https://github.com/LucaBarile/ZDI-CAN-16857", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-7109", "desc": "A vulnerability classified as critical was found in code-projects Library Management System 2.0. This vulnerability affects unknown code of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249004.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/Library-Management-System/Library-Management-System_SQL_Injection-1.md", "https://vuldb.com/?id.249004", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-46280", "desc": "A vulnerability has been identified in S7-PCT (All versions), Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC NET PC Software (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC PDM V9.2 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC STEP 7 V5 (All versions), SIMATIC WinCC OA V3.17 (All versions), SIMATIC WinCC OA V3.18 (All versions < V3.18 P025), SIMATIC WinCC OA V3.19 (All versions < V3.19 P010), SIMATIC WinCC Runtime Advanced (All versions), SIMATIC WinCC Runtime Professional V16 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Unified PC Runtime (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SINAMICS Startdrive (All versions < V19 SP1), SINUMERIK ONE virtual (All versions < V6.23), SINUMERIK PLC Programming Tool (All versions), TIA Portal Cloud Connector (All versions < V2.0), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 2). The affected applications contain an out of bounds read vulnerability. This could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel.", "poc": ["https://github.com/5angjun/5angjun"]}, {"cve": "CVE-2023-24731", "desc": "Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the query parameter in the user profile update function.", "poc": ["https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip"]}, {"cve": "CVE-2023-30545", "desc": "PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9", "poc": ["https://github.com/drkbcn/lblfixer_cve_2023_30839"]}, {"cve": "CVE-2023-4693", "desc": "An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk.", "poc": ["https://github.com/Jurij-Ivastsuk/WAXAR-shim-review", "https://github.com/NaverCloudPlatform/shim-review", "https://github.com/Rodrigo-NR/shim-review", "https://github.com/ctrliq/ciq-shim-build", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/rhboot/shim-review", "https://github.com/vathpela/shim-review"]}, {"cve": "CVE-2023-34585", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2023-31556", "desc": "podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent.", "poc": ["https://github.com/podofo/podofo/issues/66"]}, {"cve": "CVE-2023-30349", "desc": "JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.", "poc": ["https://github.com/jflyfox/jfinal_cms/issues/54"]}, {"cve": "CVE-2023-42498", "desc": "Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49096", "desc": "Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifically the `/Videos//stream` and `/Videos//stream.` endpoints which are present in the current Jellyfin version. Additional endpoints in the AudioController might also be vulnerable, as they differ only slightly in execution. Those endpoints are reachable by an unauthenticated user. In order to exploit this vulnerability an unauthenticated attacker has to guess an itemId, which is a completely random GUID. It\u2019s a very unlikely case even for a large media database with lots of items. Without an additional information leak, this vulnerability shouldn\u2019t be directly exploitable, even if the instance is reachable from the Internet. There are a lot of query parameters that get accepted by the method. At least two of those, videoCodec and audioCodec are vulnerable to the argument injection. The values can be traced through a lot of code and might be changed in the process. However, the fallback is to always use them as-is, which means we can inject our own arguments. Those arguments land in the command line of FFmpeg. Because UseShellExecute is always set to false, we can\u2019t simply terminate the FFmpeg command and execute our own. It should only be possible to add additional arguments to FFmpeg, which is powerful enough as it stands. There is probably a way of overwriting an arbitrary file with malicious content. This vulnerability has been addressed in version 10.8.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://ffmpeg.org/ffmpeg-filters.html#drawtext-1", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21387", "desc": "In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51093", "desc": "Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo.", "poc": ["https://github.com/GD008/TENDA/blob/main/M3/setVlanInfo/M3_setVlanInfo.md"]}, {"cve": "CVE-2023-5556", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.", "poc": ["https://huntr.dev/bounties/a3ee0f98-6898-41ae-b1bd-242a03a73d1b", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29850", "desc": "SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information.", "poc": ["https://github.com/slims/slims9_bulian/issues/186"]}, {"cve": "CVE-2023-5725", "desc": "A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34599", "desc": "Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.", "poc": ["https://github.com/maddsec/CVE-2023-34599", "https://github.com/Imahian/CVE-2023-34599", "https://github.com/hheeyywweellccoommee/CVE-2023-34599-xsddo", "https://github.com/maddsec/CVE-2023-34599", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5870", "desc": "A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31302", "desc": "Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Teller field.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0056/"]}, {"cve": "CVE-2023-50089", "desc": "A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP for SOAP authentication, command execution occurs during the process after successful authentication.", "poc": ["https://github.com/NoneShell/Vulnerabilities/blob/main/NETGEAR/WNR2000v4-1.0.0.70-Authorized-Command-Injection.md"]}, {"cve": "CVE-2023-24800", "desc": "D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_495220 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/D-link/blob/main/Dir878/3/3.md"]}, {"cve": "CVE-2023-34055", "desc": "In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * org.springframework.boot:spring-boot-actuator\u00a0is on the classpath", "poc": ["https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9"]}, {"cve": "CVE-2023-0470", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.", "poc": ["https://huntr.dev/bounties/baae3180-b63b-4880-b2af-1a3f30056c2b"]}, {"cve": "CVE-2023-24517", "desc": "Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbitrary system commands. This issue affects Pandora FMS v767 version and prior versions on all platforms.", "poc": ["https://github.com/Argonx21/CVE-2023-24517", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-7090", "desc": "A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38545", "desc": "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxyhandshake.When curl is asked to pass along the host name to the SOCKS5 proxy to allowthat to resolve the address instead of it getting done by curl itself, themaximum length that host name can be is 255 bytes.If the host name is detected to be longer, curl switches to local nameresolving and instead passes on the resolved address only. Due to this bug,the local variable that means \"let the host resolve the name\" could get thewrong value during a slow SOCKS5 handshake, and contrary to the intention,copy the too long host name to the target buffer instead of copying just theresolved address there.The target buffer being a heap based buffer, and the host name coming from theURL that curl has been told to operate with.", "poc": ["https://github.com/JosephYostos/Vulnerability-Management-remediation-with-Talon-", "https://github.com/KONNEKTIO/konnekt-docs", "https://github.com/MNeverOff/ipmi-server", "https://github.com/UTsweetyfish/CVE-2023-38545", "https://github.com/Yang-Shun-Yu/CVE-2023-38545", "https://github.com/alex-grandson/docker-python-example", "https://github.com/bcdannyboy/CVE-2023-38545", "https://github.com/d0rb/CVE-2023-38545", "https://github.com/dbrugman/CVE-2023-38545-POC", "https://github.com/fatmo666/CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflow", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/imfht/CVE-2023-38545", "https://github.com/izj007/wechat", "https://github.com/kherrick/lobsters", "https://github.com/malinkamedok/devops_sandbox", "https://github.com/mayur-esh/vuln-liners", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile", "https://github.com/vanigori/CVE-2023-38545-sample", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-36887", "desc": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "poc": ["https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1747"]}, {"cve": "CVE-2023-4111", "desc": "A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index/pickup_id leads to cross site scripting. The attack may be launched remotely. VDB-235958 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/173927/PHPJabbers-Bus-Reservation-System-1.1-Cross-Site-Scripting.html", "http://packetstormsecurity.com/files/173945/PHPJabbers-Bus-Reservation-System-1.1-SQL-Injection.html"]}, {"cve": "CVE-2023-45210", "desc": "Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files uploaded by other users who are not permitted to access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1576", "desc": "** REJECT ** This is a duplicate of an earlier CVE, CVE-2022-47069.", "poc": ["https://sourceforge.net/p/p7zip/bugs/241/"]}, {"cve": "CVE-2023-48205", "desc": "Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails.", "poc": ["http://packetstormsecurity.com/files/175802"]}, {"cve": "CVE-2023-28809", "desc": "Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.", "poc": ["http://packetstormsecurity.com/files/174506/Hikvision-Access-Control-Session-Hijacking.html"]}, {"cve": "CVE-2023-52154", "desc": "File Upload vulnerability in pmb/camera_upload.php in PMB 7.4.7 and earlier allows attackers to run arbitrary code via upload of crafted PHTML files.", "poc": ["https://nexacybersecurity.blogspot.com/2024/02/journey-finding-vulnerabilities-in-pmb-library-management-system.html"]}, {"cve": "CVE-2023-3277", "desc": "The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address. We are disclosing this issue as the developer has not yet released a patch, but continues to release updates and we escalated this issue to the plugin's team 30 days ago.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39536", "desc": "AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.", "poc": ["https://github.com/another1024/another1024"]}, {"cve": "CVE-2023-49460", "desc": "libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image.", "poc": ["https://github.com/strukturag/libheif/issues/1046"]}, {"cve": "CVE-2023-44260", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Mikk Mihkel Nurges, Rebing O\u00dc Woocommerce ESTO plugin <=\u00a02.23.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7142", "desc": "A vulnerability was found in code-projects Client Details System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/clientview.php. The manipulation of the argument ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249145 was assigned to this vulnerability.", "poc": ["https://github.com/h4md153v63n/CVEs/blob/main/Client_Details_System/Client_Details_System-SQL_Injection_6.md", "https://github.com/h4md153v63n/CVEs", "https://github.com/h4md153v63n/h4md153v63n"]}, {"cve": "CVE-2023-24050", "desc": "Cross Site Scripting (XSS) vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to run arbitrary code via crafted string when setting the Wi-Fi password in the admin panel.", "poc": ["https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/"]}, {"cve": "CVE-2023-6040", "desc": "An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.", "poc": ["http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46764", "desc": "Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliciously.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28531", "desc": "ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.", "poc": ["https://github.com/GitHubForSnap/openssh-server-gael", "https://github.com/drg3nz0/gpt-analyzer", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/morpheuslord/GPT_Vuln-analyzer"]}, {"cve": "CVE-2023-36752", "desc": "A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The upgrade-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.", "poc": ["https://github.com/sudo-jtcsec/CVE"]}, {"cve": "CVE-2023-33987", "desc": "An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which\u00a0may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate\u00a0messages. This can result in the back-end server executing a malicious payload which can be used to read or\u00a0modify information on the server or make it temporarily unavailable.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-6384", "desc": "The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar", "poc": ["https://wpscan.com/vulnerability/fbdefab4-614b-493b-a9ae-c5aeff8323ef/"]}, {"cve": "CVE-2023-39801", "desc": "A lack of exception handling in the Renault Easy Link Multimedia System Software Version 283C35519R allows attackers to cause a Denial of Service (DoS) via supplying crafted WMA files when connecting a device to the vehicle's USB plug and play feature.", "poc": ["https://github.com/socsecresearch/SoC_Vulnerability_Benchmarks"]}, {"cve": "CVE-2023-6255", "desc": "Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable.This issue affects SoliPay Mobile App: before 5.0.8.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44709", "desc": "PlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discovered to contain an integer overflow via the component plutosvg_load_from_memory.", "poc": ["https://github.com/sammycage/plutosvg/issues/7"]}, {"cve": "CVE-2023-39350", "desc": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrrv-3w42-pffh"]}, {"cve": "CVE-2023-34365", "desc": "A stack-based buffer overflow vulnerability exists in the libutils.so nvram_restore functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a buffer overflow. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1763"]}, {"cve": "CVE-2023-36541", "desc": "Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34372", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <=\u00a02.22 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-36924", "desc": "While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-4922", "desc": "The WPB Show Core WordPress plugin through 2.2 is vulnerable to a local file inclusion via the `path` parameter.", "poc": ["https://wpscan.com/vulnerability/968d87c0-af60-45ea-b34e-8551313cc8df"]}, {"cve": "CVE-2023-27065", "desc": "Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the picName parameter in the formDelWewifiPi function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.", "poc": ["https://github.com/didi-zhiyuan/vuln/blob/main/iot/Tenda/W15EV1/formDelWewifiPic.md"]}, {"cve": "CVE-2023-46604", "desc": "The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.", "poc": ["http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html", "https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html", "https://github.com/20142995/sectool", "https://github.com/Anekant-Singhai/Exploits", "https://github.com/Arlenhiack/ActiveMQ-RCE-Exploit", "https://github.com/Awrrays/FrameVul", "https://github.com/JaneMandy/ActiveMQ_RCE_Pro_Max", "https://github.com/Jereanny14/jereanny14.github.io", "https://github.com/LiritoShawshark/CVE-2023-46604_ActiveMQ_RCE_Recurrence", "https://github.com/Mudoleto/Broker_ApacheMQ", "https://github.com/NKeshawarz/CVE-2023-46604-RCE", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/ST3G4N05/ExploitScript-CVE-2023-46604", "https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ", "https://github.com/T0ngMystic/Vulnerability_List", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/Vulhub-Reproduce", "https://github.com/X1r0z/ActiveMQ-RCE", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/afonsovitorio/cve_sandbox", "https://github.com/aneasystone/github-trending", "https://github.com/anqorithm/Saudi-CERT-API", "https://github.com/bakery312/Vulhub-Reproduce", "https://github.com/dcm2406/CVE-2023-46604", "https://github.com/dcm2406/CVE-Lab", "https://github.com/duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell", "https://github.com/evkl1d/CVE-2023-46604", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up", "https://github.com/hackyou1432/brokerfile.php", "https://github.com/infokek/activemq-honeypot", "https://github.com/johe123qwe/github-trending", "https://github.com/justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp", "https://github.com/k8gege/Ladon", "https://github.com/linuskoester/writeups", "https://github.com/minhangxiaohui/ActiveMQ_CVE-2023-46604", "https://github.com/mrpentst/CVE-2023-46604", "https://github.com/muneebaashiq/MBProjects", "https://github.com/nitzanoligo/CVE-2023-46604-demo", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ph-hitachi/CVE-2023-46604", "https://github.com/sampsonv/github-trending", "https://github.com/seal-community/patches", "https://github.com/sule01u/CVE-2023-46604", "https://github.com/tanjiti/sec_profile", "https://github.com/thinkycx/activemq-rce-cve-2023-46604", "https://github.com/tomasmussi-mulesoft/activemq-cve-2023-46604", "https://github.com/trganda/ActiveMQ-RCE", "https://github.com/venkycs/cy8", "https://github.com/vjayant93/CVE-2023-46604-POC", "https://github.com/vulncheck-oss/cve-2023-46604", "https://github.com/whitfieldsdad/cisa_kev", "https://github.com/zengzzzzz/golang-trending-archive"]}, {"cve": "CVE-2023-29983", "desc": "Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog tab in the admin panel.", "poc": ["https://packetstormsecurity.com/files/172075/CompanyMaps-8.0-Cross-Site-Scripting.html", "https://www.exploit-db.com/exploits/51417", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zPrototype/CVE-2023-29983"]}, {"cve": "CVE-2023-2550", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.", "poc": ["https://huntr.dev/bounties/840c8d91-c97e-4116-a9f8-4ab1a38d239b"]}, {"cve": "CVE-2023-31941", "desc": "File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP file to the employee_insert.php.", "poc": ["https://github.com/DiliLearngent/BugReport"]}, {"cve": "CVE-2023-48201", "desc": "Cross Site Scripting (XSS) vulnerability in Sunlight CMS v.8.0.1, allows remote authenticated attackers to execute arbitrary code and escalate privileges via a crafted script to the Content text editor component.", "poc": ["https://mechaneus.github.io/CVE-2023-48201.html", "https://github.com/mechaneus/mechaneus.github.io"]}, {"cve": "CVE-2023-2731", "desc": "A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/548"]}, {"cve": "CVE-2023-31490", "desc": "An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.", "poc": ["https://github.com/FRRouting/frr/issues/13099"]}, {"cve": "CVE-2023-38606", "desc": "This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.", "poc": ["https://github.com/Danie10/Danie10", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-27574", "desc": "ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of CODE_SIGNING_INJECT_BASE_ENTITLEMENTS.", "poc": ["https://github.com/NSEcho/vos"]}, {"cve": "CVE-2023-5193", "desc": "Mattermost fails to properly check permissions when retrieving a post allowing for\u00a0a System Role with the permission to manage channels to read the posts of a DM conversation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25289", "desc": "Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1_rtm.101119-1850 6.1.7601.1.0.65792 in embedded web server, allows attacker to gain sensitive information via a crafted GET request.", "poc": ["https://www.exploit-db.com/exploits/51142"]}, {"cve": "CVE-2023-5459", "desc": "A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. VDB-241582 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6902", "desc": "A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. This vulnerability affects unknown code of the file /file-manager/upload.php. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248260.", "poc": ["https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20upload%20getshell.md"]}, {"cve": "CVE-2023-52457", "desc": "In the Linux kernel, the following vulnerability has been resolved:serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failedReturning an error code from .remove() makes the driver core emit thelittle helpful error message:\tremove callback returned a non-zero value. This will be ignored.and then remove the device anyhow. So all resources that were not freedare leaked in this case. Skipping serial8250_unregister_port() has thepotential to keep enough of the UART around to trigger a use-after-free.So replace the error return (and with it the little helpful errormessage) by a more useful error message and continue to cleanup.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35800", "desc": "Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved to administrators.", "poc": ["https://advisories.stormshield.eu/2023-021/"]}, {"cve": "CVE-2023-37477", "desc": "1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. 1Panel firewall functionality `/hosts/firewall/ip` endpoint read user input without validation, the attacker extends the default functionality of the application, which execute system commands. An attacker can execute arbitrary code on the target system, which can lead to a complete compromise of the system. This issue has been addressed in commit `e17b80cff49` which is included in release version `1.4.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-p9xf-74xh-mhw5"]}, {"cve": "CVE-2023-31907", "desc": "Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via the component scanner_literal_is_created at /jerry-core/parser/js/js-scanner-util.c.", "poc": ["https://github.com/jerryscript-project/jerryscript/issues/5073", "https://github.com/EJueon/EJueon"]}, {"cve": "CVE-2023-49293", "desc": "Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (``), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in vite@5.0.5, vite@4.5.1, and vite@4.4.12. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/vitejs/vite/security/advisories/GHSA-92r3-m2mg-pj97", "https://github.com/d0r4-hackers/dora-hacking", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-49554", "desc": "Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the do_directive function in the modules/preprocs/nasm/nasm-pp.c component.", "poc": ["https://github.com/yasm/yasm/issues/249", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52339", "desc": "In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.", "poc": ["https://github.com/Matroska-Org/libebml/issues/147", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5644", "desc": "The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.", "poc": ["https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e"]}, {"cve": "CVE-2023-4074", "desc": "Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51786", "desc": "An issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privileges and obtain sensitive information via Incorrect Access Control.", "poc": ["https://github.com/EGI-Federation/SVG-advisories"]}, {"cve": "CVE-2023-3761", "desc": "A vulnerability was found in Intergard SGS 8.7.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Password Change Handler. The manipulation leads to cleartext transmission of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-234446 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.234446", "https://youtu.be/bMJwSCps0Lc"]}, {"cve": "CVE-2023-51010", "desc": "An issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering or checking.", "poc": ["https://github.com/firmianay/security-issues/tree/main/app/com.sdjictec.qdmetro", "https://github.com/firmianay/security-issues"]}, {"cve": "CVE-2023-2780", "desc": "Path Traversal: '\\..\\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.", "poc": ["https://huntr.dev/bounties/b12b0073-0bb0-4bd1-8fc2-ec7f17fd7689", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-46748", "desc": "An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-36271", "desc": "LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_wcs2nlen at bits.c.", "poc": ["https://github.com/LibreDWG/libredwg/issues/681#BUG2"]}, {"cve": "CVE-2023-23004", "desc": "In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19"]}, {"cve": "CVE-2023-32783", "desc": "** DISPUTED ** The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a \"$\" symbol suffix. NOTE: the vendor states \"We do not consider this as a security bug and it's an expected behaviour.\"", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50740", "desc": "In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module.\u00a0We recommend users upgrade the version of Linkis to version 1.5.0", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4868", "desc": "A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file add.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239353 was assigned to this vulnerability.", "poc": ["https://skypoc.wordpress.com/2023/09/05/vuln1/"]}, {"cve": "CVE-2023-36970", "desc": "A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function.", "poc": ["https://okankurtulus.com.tr/2023/06/27/cms-made-simple-v2-2-17-stored-cross-site-scripting-xss-authenticated/"]}, {"cve": "CVE-2023-1947", "desc": "A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225330 is the identifier assigned to this vulnerability.", "poc": ["https://gitee.com/misak7in/cve/blob/master/taocms.md"]}, {"cve": "CVE-2023-29583", "desc": "** DISPUTED ** yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr5 at /nasm/nasm-parse.c. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.", "poc": ["https://github.com/yasm/yasm/issues/218", "https://github.com/z1r00/fuzz_vuln/blob/main/yasm/stack-overflow/parse_expr5/readme.md", "https://github.com/z1r00/fuzz_vuln"]}, {"cve": "CVE-2023-41599", "desc": "An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.", "poc": ["http://www.so1lupus.ltd/2023/08/28/Directory-traversal-in-JFinalCMS/", "https://github.com/Marco-zcl/POC", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-"]}, {"cve": "CVE-2023-4199", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file catagory_data.php. The manipulation of the argument columns[1][data] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-236289 was assigned to this vulnerability.", "poc": ["https://github.com/Yesec/Inventory-Management-System/blob/main/SQL%20Injection%20in%20catagory_data.php/vuln.md"]}, {"cve": "CVE-2023-4148", "desc": "The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/aa39de78-55b3-4237-84db-6fdf6820c58d"]}, {"cve": "CVE-2023-4811", "desc": "The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/7f9271f2-4de4-4be3-8746-2a3f149eb1d1"]}, {"cve": "CVE-2023-40852", "desc": "SQL Injection vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to obtain sensitive information via crafted string in the admin user name field on the admin log in page.", "poc": ["https://www.exploit-db.com/exploits/51695"]}, {"cve": "CVE-2023-36259", "desc": "Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27855", "desc": "In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. The attacker could overwrite existing executable files with attacker-controlled, malicious contents, potentially causing remote code execution.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-36183", "desc": "Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function.", "poc": ["https://github.com/OpenImageIO/oiio/issues/3871"]}, {"cve": "CVE-2023-2154", "desc": "A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/?page=reminders/view_reminder. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226275.", "poc": ["https://youtu.be/teK82KkWtdA"]}, {"cve": "CVE-2023-21878", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-2779", "desc": "The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["http://packetstormsecurity.com/files/173053/WordPress-Super-Socializer-7.13.52-Cross-Site-Scripting.html", "https://wpscan.com/vulnerability/fe9b7696-3b0e-42e2-9dbc-55167605f5c5", "https://github.com/40826d/advisories"]}, {"cve": "CVE-2023-31944", "desc": "SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp_id parameter at employee_edit.php.", "poc": ["https://github.com/DiliLearngent/BugReport"]}, {"cve": "CVE-2023-3041", "desc": "The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack.", "poc": ["https://wpscan.com/vulnerability/93cad990-b6be-4ee1-9cdf-0211a7fe6c96"]}, {"cve": "CVE-2023-52612", "desc": "In the Linux kernel, the following vulnerability has been resolved:crypto: scomp - fix req->dst buffer overflowThe req->dst buffer size should be checked before copying from thescomp_scratch->dst to avoid req->dst buffer overflow problem.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-6378", "desc": "A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.", "poc": ["https://github.com/Lyrafll/DAI-Practical-Work-4", "https://github.com/chainguard-dev/pombump", "https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9", "https://github.com/vaikas/pombump"]}, {"cve": "CVE-2023-39578", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.", "poc": ["https://panda002.hashnode.dev/a-stored-cross-site-scripting-xss-vulnerability-in-the-create-the-function-of-zenario-cms-v94"]}, {"cve": "CVE-2023-36754", "desc": "A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The SCEP server configuration URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.", "poc": ["https://github.com/sudo-jtcsec/CVE"]}, {"cve": "CVE-2023-1634", "desc": "A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016.", "poc": ["https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.md", "https://vuldb.com/?id.224016"]}, {"cve": "CVE-2023-52161", "desc": "The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36864", "desc": "An integer overflow vulnerability exists in the fstReaderIterBlocks2 temp_signal_value_buf allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1797", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1797"]}, {"cve": "CVE-2023-33640", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/S1twOtyrh"]}, {"cve": "CVE-2023-37261", "desc": "OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. This issue affects every version of OpenComputers with the Internet Card feature enabled; that is, OpenComputers 1.2.0 until 1.8.3 in their most common, default configurations. If the OpenComputers mod is installed as part of a Minecraft server hosted on a popular cloud hosting provider, such as AWS, GCP and Azure, those metadata services' API endpoints are not forbidden (aka \"blacklisted\") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider. In addition, IPv6 addresses are not correctly filtered at all, allowing broader access into the local IPv6 network. This can allow a player on a server using an OpenComputers computer to access parts of the private IPv4 address space, as well as the whole IPv6 address space, in order to retrieve sensitive information.OpenComputers v1.8.3 for Minecraft 1.7.10 and 1.12.2 contains a patch for this issue. Some workarounds are also available. One may disable the Internet Card feature completely. If using OpenComputers 1.3.0 or above, using the allow list (`opencomputers.internet.whitelist` option) will prohibit connections to any IP addresses and/or domains not listed; or one may add entries to the block list (`opencomputers.internet.blacklist` option). More information about mitigations is available in the GitHub Security Advisory.", "poc": ["https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24135", "desc": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a command injection vulnerability in the function formWriteFacMac. This vulnerability allows attackers to execute arbitrary commands via manipulation of the mac parameter.", "poc": ["https://oxnan.com/posts/WriteFacMac-Command-Injection"]}, {"cve": "CVE-2023-2233", "desc": "An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak the owner's Sentry instance projects.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/408359", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29542", "desc": "A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.*This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox\u00a0and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1810793", "https://bugzilla.mozilla.org/show_bug.cgi?id=1815062"]}, {"cve": "CVE-2023-41109", "desc": "SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection.", "poc": ["http://packetstormsecurity.com/files/175945/SmartNode-SN200-3.21.2-23021-OS-Command-Injection.html", "http://seclists.org/fulldisclosure/2023/Nov/12", "https://www.syss.de/", "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-019.txt"]}, {"cve": "CVE-2023-27779", "desc": "AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form.", "poc": ["https://docs.google.com/document/d/1kGzmc6AOCfRzJf9mDz4emkhQj84Y1XemmAMZjYK32-o/edit?usp=sharing"]}, {"cve": "CVE-2023-4320", "desc": "An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32275", "desc": "An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1753"]}, {"cve": "CVE-2023-7057", "desc": "A vulnerability, which was classified as problematic, has been found in code-projects Faculty Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/pages/yearlevel.php. The manipulation of the argument Year Level/Section leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248744.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21292", "desc": "In openContentUri of ActivityManagerService.java, there is a possible way for a third party app to obtain restricted files due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://android.googlesource.com/platform/frameworks/base/+/d10b27e539f7bc91c2360d429b9d05f05274670d"]}, {"cve": "CVE-2023-7175", "desc": "A vulnerability was found in Campcodes Online College Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/borrow_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249362 is the identifier assigned to this vulnerability.", "poc": ["https://medium.com/@heishou/libsystem-sql-injection-bb74915175fe"]}, {"cve": "CVE-2023-40115", "desc": "In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-27249", "desc": "swfdump v0.9.2 was discovered to contain a heap buffer overflow in the function swf_GetPlaceObject at swfobject.c.", "poc": ["https://github.com/keepinggg/poc/blob/main/poc_of_swfdump/poc", "https://github.com/keepinggg/poc/tree/main/poc_of_swfdump", "https://github.com/matthiaskramm/swftools/issues/197"]}, {"cve": "CVE-2023-27578", "desc": "Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insufficient permission check. Unsupported versions are likely affected as far back as the functionality of Visualizations/Pages exists. Due to this issue, an attacker can modify or delete any Galaxy Visualization or Galaxy Page given they know the encoded ID of it. Additionally, they can copy or import any Galaxy Visualization given they know the encoded ID of it. Patches are available for versions 22.01, 22.05, and 23.0. For the changes to take effect, you must restart all Galaxy server processes. There are no supported workarounds.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-0562", "desc": "A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716.", "poc": ["https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md", "https://github.com/ctflearner/ctflearner"]}, {"cve": "CVE-2023-42298", "desc": "An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of file src/bifs/unquantize.c.", "poc": ["https://github.com/gpac/gpac/issues/2567"]}, {"cve": "CVE-2023-33972", "desc": "Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37205", "desc": "The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox < 115.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1704420"]}, {"cve": "CVE-2023-5651", "desc": "The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts", "poc": ["https://wpscan.com/vulnerability/a365c050-96ae-4266-aa87-850ee259ee2c"]}, {"cve": "CVE-2023-29112", "desc": "The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-2143", "desc": "The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.", "poc": ["https://wpscan.com/vulnerability/91898762-aa7d-4fbc-a016-3de48901e5de"]}, {"cve": "CVE-2023-39808", "desc": "N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password which allows attackers to login with root privileges via the SSH service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21918", "desc": "Vulnerability in the Oracle Database Recovery Manager component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows high privileged attacker having Local SYSDBA privilege with network access via Oracle Net to compromise Oracle Database Recovery Manager. While the vulnerability is in Oracle Database Recovery Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Database Recovery Manager. CVSS 3.1 Base Score 6.8 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-34565", "desc": "Netbox 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the \"Create Wireless LAN Groups\" function.", "poc": ["https://github.com/grayfullbuster0804/netbox/issues/1"]}, {"cve": "CVE-2023-0498", "desc": "The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/8fa051ad-5b35-46d8-be95-0ac4e73d5eff"]}, {"cve": "CVE-2023-26605", "desc": "In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/cmu-pasta/linux-kernel-enriched-corpus"]}, {"cve": "CVE-2023-33642", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/Skg0zOsVh"]}, {"cve": "CVE-2023-5590", "desc": "NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.", "poc": ["https://huntr.dev/bounties/e268cd68-4f34-49bd-878b-82b96dcc0c99"]}, {"cve": "CVE-2023-40583", "desc": "libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node\u2019s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0500", "desc": "The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/95a6a11e-da5d-4fac-aff6-a3f7624682b7"]}, {"cve": "CVE-2023-34568", "desc": "Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet.", "poc": ["https://hackmd.io/@0dayResearch/ryR8IzMH2"]}, {"cve": "CVE-2023-2337", "desc": "The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/e5a6f834-80a4-406b-acae-57ffeec2e689"]}, {"cve": "CVE-2023-52439", "desc": "In the Linux kernel, the following vulnerability has been resolved:uio: Fix use-after-free in uio_opencore-1\t\t\t\tcore-2-------------------------------------------------------uio_unregister_device\t\tuio_open\t\t\t\tidev = idr_find()device_unregister(&idev->dev)put_device(&idev->dev)uio_device_release\t\t\t\tget_device(&idev->dev)kfree(idev)uio_free_minor(minor)\t\t\t\tuio_release\t\t\t\tput_device(&idev->dev)\t\t\t\tkfree(idev)-------------------------------------------------------In the core-1 uio_unregister_device(), the device_unregister will kfreeidev when the idev->dev kobject ref is 1. But after core-1device_unregister, put_device and before doing kfree, the core-2 mayget_device. Then:1. After core-1 kfree idev, the core-2 will do use-after-free for idev.2. When core-2 do uio_release and put_device, the idev will be double freed.To address this issue, we can get idev atomic & inc idev reference withminor_lock.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31069", "desc": "An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML source code of the login page.", "poc": ["http://packetstormsecurity.com/files/174271/TSPlus-16.0.0.0-Insecure-Credential-Storage.html", "https://www.exploit-db.com/exploits/51681"]}, {"cve": "CVE-2023-28885", "desc": "The MyLink infotainment system (build 2021.3.26) in General Motors Chevrolet Equinox 2021 vehicles allows attackers to cause a denial of service (temporary failure of Media Player functionality) via a crafted MP3 file.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-37791", "desc": "D-Link DIR-619L v2.04(TW) was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin.", "poc": ["https://github.com/naihsin/IoT/tree/main/D-Link/DIR-619L/overflow", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1407", "desc": "A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223111.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-51017", "desc": "TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanIp parameter\u2019 of the setLanConfig interface of the cstecgi .cgi.", "poc": ["https://815yang.github.io/2023/12/11/EX1800T/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setLanConfig-lanIp/"]}, {"cve": "CVE-2023-39508", "desc": "Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The \"Run Task\" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The \"Run Task\" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0This issue affects Apache Airflow: before 2.6.0.", "poc": ["http://seclists.org/fulldisclosure/2023/Jul/43"]}, {"cve": "CVE-2023-49598", "desc": "Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.", "poc": ["https://github.com/mute1008/mute1008", "https://github.com/mute1997/mute1997"]}, {"cve": "CVE-2023-5495", "desc": "A vulnerability was found in QDocs Smart School 6.4.1. It has been classified as critical. This affects an unknown part of the file /course/filterRecords/ of the component HTTP POST Request Handler. The manipulation of the argument searchdata[0][title]/searchdata[0][searchfield]/searchdata[0][searchvalue] leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-241647. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/175071/Smart-School-6.4.1-SQL-Injection.html"]}, {"cve": "CVE-2023-45145", "desc": "Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26359", "desc": "Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/netlas-io/netlas-cookbook", "https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-34478", "desc": "Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.Mitigation:\u00a0Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+", "poc": ["https://github.com/Threekiii/CVE"]}, {"cve": "CVE-2023-29861", "desc": "An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the device.", "poc": ["https://github.com/Duke1410/CVE"]}, {"cve": "CVE-2023-20858", "desc": "VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Threekiii/CVE"]}, {"cve": "CVE-2023-45748", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch plugin <=\u00a03.1.4 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39639", "desc": "LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs.", "poc": ["https://security.friendsofpresta.org/modules/2023/08/31/leoblog.html"]}, {"cve": "CVE-2023-40810", "desc": "OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.", "poc": ["https://www.esecforte.com/cve-2023-40810-html-injection-product-creation/"]}, {"cve": "CVE-2023-39001", "desc": "A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.", "poc": ["https://logicaltrust.net/blog/2023/08/opnsense.html"]}, {"cve": "CVE-2023-46026", "desc": "Cross Site Scripting (XSS) vulnerability in profile.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary code via the 'adminname' and 'email' parameters.", "poc": ["https://github.com/ersinerenler/phpgurukul-Teacher-Subject-Allocation-Management-System-1.0/blob/main/CVE-2023-46026-PHPGurukul-Teacher-Subject-Allocation-Management-System-1.0-Stored-Cross-Site-Scripting-Vulnerability.md", "https://github.com/ersinerenler/PHPGurukul-Teacher-Subject-Allocation-Management-System-1.0"]}, {"cve": "CVE-2023-31144", "desc": "Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-5943", "desc": "The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.", "poc": ["https://wpscan.com/vulnerability/18fbe9d5-4829-450b-988c-8ba4becd032a/"]}, {"cve": "CVE-2023-3389", "desc": "A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer.We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and\u00a00e388fce7aec40992eadee654193cad345d62663 for 5.15 stable).", "poc": ["http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-46756", "desc": "Permission control vulnerability in the window management module. Successful exploitation of this vulnerability may cause malicious pop-up windows.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21244", "desc": "In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://android.googlesource.com/platform/frameworks/base/+/3a448067ac9ebdf669951e90678c2daa592a81d3", "https://android.googlesource.com/platform/frameworks/base/+/5a3d0c131175d923cf35c7beb3ee77a9e6485dad"]}, {"cve": "CVE-2023-52445", "desc": "In the Linux kernel, the following vulnerability has been resolved:media: pvrusb2: fix use after free on context disconnectionUpon module load, a kthread is created targeting thepvr2_context_thread_func function, which may call pvr2_context_destroyand thus call kfree() on the context object. However, that might happenbefore the usb hub_event handler is able to notify the driver. Thispatch adds a sanity check before the invalid read reported by syzbot,within the context disconnection call stack.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20235", "desc": "A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to access the underlying operating system as the root user.\nThis vulnerability exists because Docker containers with the privileged runtime option are not blocked when they are in application development mode. An attacker could exploit this vulnerability by using the Docker CLI to access an affected device. The application development workflow is meant to be used only on development systems and not in production systems.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rdocker-uATbukKn"]}, {"cve": "CVE-2023-52622", "desc": "In the Linux kernel, the following vulnerability has been resolved:ext4: avoid online resizing failures due to oversized flex bgWhen we online resize an ext4 filesystem with a oversized flexbg_size, mkfs.ext4 -F -G 67108864 $dev -b 4096 100M mount $dev $dir resize2fs $dev 16Gthe following WARN_ON is triggered:==================================================================WARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550Modules linked in: sg(E)CPU: 0 PID: 427 Comm: resize2fs Tainted: G E 6.6.0-rc5+ #314RIP: 0010:__alloc_pages+0x411/0x550Call Trace: __kmalloc_large_node+0xa2/0x200 __kmalloc+0x16e/0x290 ext4_resize_fs+0x481/0xd80 __ext4_ioctl+0x1616/0x1d90 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0xf0/0x150 do_syscall_64+0x3b/0x90==================================================================This is because flexbg_size is too large and the size of the new_group_dataarray to be allocated exceeds MAX_ORDER. Currently, the minimum value ofMAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the correspondingmaximum number of groups that can be allocated is: (PAGE_SIZE << MAX_ORDER) / sizeof(struct ext4_new_group_data) \u2248 21845And the value that is down-aligned to the power of 2 is 16384. Therefore,this value is defined as MAX_RESIZE_BG, and the number of groups addedeach time does not exceed this value during resizing, and is added multipletimes to complete the online resizing. The difference is that the metadatain a flex_bg may be more dispersed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4433", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.", "poc": ["https://huntr.dev/bounties/64f3253d-6852-4b9f-b870-85e896007b1a"]}, {"cve": "CVE-2023-35943", "desc": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decodeHeaders`and `encodeHeaders`. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, do not remove the `origin` header in the Envoy configuration.", "poc": ["https://github.com/envoyproxy/envoy/security/advisories/GHSA-mc6h-6j9x-v3gq"]}, {"cve": "CVE-2023-3633", "desc": "An out-of-bounds write\u00a0vulnerability in Bitdefender Engines on Windows causes the engine to crash.\u00a0This issue affects Bitdefender Engines version 7.94791 and lower.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5951", "desc": "The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/81dc093a-545d-4bcd-ab85-ee9472d709e5"]}, {"cve": "CVE-2023-48615", "desc": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29218", "desc": "** DISPUTED ** The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arranging for multiple Twitter accounts to coordinate negative signals regarding a target account, such as unfollowing, muting, blocking, and reporting, as exploited in the wild in March and April 2023. NOTE: Vendor states that allowing users to unfollow, mute, block, and report tweets and accounts and the impact of these negative engagements on Twitter\u2019s ranking algorithm is a conscious design decision, rather than a security vulnerability.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/igorbrigadir/awesome-twitter-algo"]}, {"cve": "CVE-2023-39933", "desc": "Insufficient verification vulnerability exists in Broadcast Mail CGI (pmc.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a user who can upload files through the product may execute an arbitrary executable file with the web server's execution privilege.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3374", "desc": "Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation.This issue affects Bookreen: before 3.0.0.", "poc": ["https://github.com/ccelikanil/ccelikanil"]}, {"cve": "CVE-2023-40134", "desc": "In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"]}, {"cve": "CVE-2023-2730", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.", "poc": ["https://huntr.dev/bounties/6c6f5c26-d545-4e7b-82bb-1fe28006c885"]}, {"cve": "CVE-2023-31421", "desc": "It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.", "poc": ["https://www.elastic.co/community/security"]}, {"cve": "CVE-2023-5681", "desc": "A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_addr_fwresource_ip.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243057 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Wsecpro/cve1/blob/main/NS-ASG-sql-list_addr_fwresource_ip.md"]}, {"cve": "CVE-2023-26309", "desc": "A remote code execution vulnerability in the webview component of OnePlus Store app.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41817", "desc": "An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorized information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49105", "desc": "An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.", "poc": ["https://github.com/ambionics/owncloud-exploits", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-44997", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha plugin <=\u00a04.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31287", "desc": "An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can thus use the token again to change the password in order to take over the account.", "poc": ["http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html", "http://seclists.org/fulldisclosure/2023/May/14"]}, {"cve": "CVE-2023-37621", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/MY0723/CNVD-2022-27366__CVE-2023-37621", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-20052", "desc": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\n\nA vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device.\n\nThis vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/cY83rR0H1t/CVE-2023-20052", "https://github.com/cbk914/clamav-scan", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/halon/changelog", "https://github.com/nokn0wthing/CVE-2023-20052", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-33800", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create Regions (/dcim/regions/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.", "poc": ["https://github.com/anhdq201/netbox/issues/11"]}, {"cve": "CVE-2023-6038", "desc": "A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.", "poc": ["https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c"]}, {"cve": "CVE-2023-3936", "desc": "The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/6d09a5d3-046d-47ef-86b4-c024ea09dc0f"]}, {"cve": "CVE-2023-40533", "desc": "** REJECT ** This CVE ID is a duplicate of CVE-2022-40468", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36812", "desc": "OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.", "poc": ["http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html", "https://github.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9", "https://github.com/ErikWynter/opentsdb_key_cmd_injection", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-45735", "desc": "A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52192", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through 1.0.11.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46935", "desc": "eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in users.", "poc": ["https://github.com/weng-xianhu/eyoucms/issues/55"]}, {"cve": "CVE-2023-46181", "desc": "IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 269686.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36177", "desc": "An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.", "poc": ["https://oxnan.com/posts/Snapcast_jsonrpc_rce"]}, {"cve": "CVE-2023-23367", "desc": "An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2376 build 20230421 and laterQuTS hero h5.0.1.2376 build 20230421 and laterQuTScloud c5.1.0.2498 and later", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/yikesoftware/yikesoftware"]}, {"cve": "CVE-2023-36854", "desc": "The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. Processing a file may lead to unexpected app termination or arbitrary code execution.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-3213", "desc": "The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to disclose potentially sensitive email information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49555", "desc": "An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c component.", "poc": ["https://github.com/yasm/yasm/issues/248"]}, {"cve": "CVE-2023-38381", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Cyle Conoly WP-FlyBox plugin <=\u00a06.46 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22458", "desc": "Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/redis-windows/redis-windows"]}, {"cve": "CVE-2023-6353", "desc": "Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload.aspx 'enky' parameter.", "poc": ["https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/", "https://github.com/qwell/disorder-in-the-court"]}, {"cve": "CVE-2023-37600", "desc": "Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=profile.", "poc": ["https://packetstormsecurity.com/files/173143/Office-Suite-Premium-10.9.1.42602-Cross-Site-Scripting.html", "https://github.com/capture0x/My-CVE"]}, {"cve": "CVE-2023-4897", "desc": "Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.", "poc": ["https://huntr.dev/bounties/0631af48-84a3-4019-85db-f0f8b12cb0ab"]}, {"cve": "CVE-2023-6710", "desc": "A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.", "poc": ["https://github.com/DedSec-47/CVE-2023-6710", "https://github.com/DedSec-47/Metasploit-Exploits-CVE-2023-6710", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27270", "desc": "SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-45074", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter \u2013 Most Wanted Analytics Plugin for WordPress allows SQL Injection.This issue affects Advanced Page Visit Counter \u2013 Most Wanted Analytics Plugin for WordPress: from n/a through 7.1.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0656", "desc": "A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.", "poc": ["https://github.com/BishopFox/CVE-2022-22274_CVE-2023-0656", "https://github.com/karimhabush/cyberowl", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-29051", "desc": "User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users and contexts. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/176422/OX-App-Suite-7.10.6-Access-Control-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47063", "desc": "Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47074", "desc": "Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27711", "desc": "Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component.", "poc": ["https://github.com/typecho/typecho/issues/1539", "https://srpopty.github.io/2023/03/02/Typecho-V1.2.0-Backend-Reflected-XSS-cid/", "https://github.com/Srpopty/Corax"]}, {"cve": "CVE-2023-25051", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Denishua Comment Reply Notification plugin <=\u00a01.4 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52302", "desc": "Nullptr in paddle.nextafter\u00a0in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-011.md"]}, {"cve": "CVE-2023-20906", "desc": "In onPackageAddedInternal of PermissionManagerService.java, there is a possible way to silently grant a permission after a Target SDK update due to a permissions bypass. This could lead to local escalation of privilege after updating an app to a higher Target SDK with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-221040577", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Ch0pin/related_work"]}, {"cve": "CVE-2023-32183", "desc": "Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to rootThis issue affects openSUSE Tumbleweed.", "poc": ["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32183", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33989", "desc": "An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can be over-written leading to system compromise.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-3848", "desc": "A vulnerability, which was classified as problematic, has been found in mooSocial mooDating 1.2. This issue affects some unknown processing of the file /users/view of the component URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-235199. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.", "poc": ["http://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23698", "desc": "Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in the installer component. A local malicious user may potentially exploit this vulnerability leading to arbitrary file delete.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/ycdxsb/ycdxsb"]}, {"cve": "CVE-2023-27894", "desc": "SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-2309", "desc": "The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.", "poc": ["https://wpscan.com/vulnerability/1b3f4558-ea41-4749-9aa2-d3971fc9ca0d", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52822", "desc": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42886", "desc": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2. A user may be able to cause unexpected app termination or arbitrary code execution.", "poc": ["https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-29909", "desc": "H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/r1FC0AAy2"]}, {"cve": "CVE-2023-1241", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.", "poc": ["https://huntr.dev/bounties/e0e9b1bb-3025-4b9f-acb4-16a5da28aa3c"]}, {"cve": "CVE-2023-43993", "desc": "An issue in smaregi_app_market mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39641", "desc": "Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent().", "poc": ["https://security.friendsofpresta.org/modules/2023/08/31/psaffiliate.html"]}, {"cve": "CVE-2023-26103", "desc": "Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.", "poc": ["https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970", "https://github.com/dellalibera/dellalibera"]}, {"cve": "CVE-2023-45641", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Caret Inc. Caret Country Access Limit plugin <=\u00a01.0.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5687", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3.", "poc": ["https://huntr.com/bounties/33f95510-cdee-460e-8e61-107874962f2d"]}, {"cve": "CVE-2023-20217", "desc": "A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate privileges on an affected device.\nThis vulnerability is due to insufficient input validation by the operating system CLI. An attacker could exploit this vulnerability by issuing certain commands using sudo. A successful exploit could allow the attacker to view arbitrary files as root on the underlying operating system. The attacker must have valid credentials on the affected device.", "poc": ["http://packetstormsecurity.com/files/174232/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Read.html", "http://seclists.org/fulldisclosure/2023/Aug/19"]}, {"cve": "CVE-2023-1444", "desc": "A vulnerability was found in Filseclab Twister Antivirus 8. It has been rated as critical. This issue affects the function 0x8011206B in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223289 was assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1444", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-40175", "desc": "Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/narfindustries/http-garden"]}, {"cve": "CVE-2023-24121", "desc": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.", "poc": ["https://oxnan.com/posts/WifiBasic_security_5g_DoS"]}, {"cve": "CVE-2023-4816", "desc": "A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action (Accept, Release, and Clear) for another user and entering an arbitrary password in the holder action confirmation dialog box. Despite entering an arbitrary password in the confirmation box, the system will execute the selected holder action.", "poc": ["https://images.go.hitachienergy.com/Web/ABBEnterpriseSoftware/%7B70b3d323-4866-42e1-8a75-58996729c1d4%7D_8DBD000172-VU-2023-23_Asset_Suite_Tagout_vulnerability_Rev1.pdf"]}, {"cve": "CVE-2023-3390", "desc": "A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.We recommend upgrading past commit\u00a01240eb93f0616b21c675416516ff3d74798fdc97.", "poc": ["http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html", "https://github.com/c0m0r1/c0m0r1", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-40461", "desc": "The ACEManagercomponent of ALEOS 4.16 and earlier allows anauthenticated userwith Administrator privileges to access a fileupload field whichdoes not fully validate the file name, creating aStored Cross-SiteScripting condition.", "poc": ["https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs"]}, {"cve": "CVE-2023-3456", "desc": "Vulnerability of kernel raw address leakage in the hang detector module. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1160", "desc": "Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.", "poc": ["https://huntr.dev/bounties/3ce480dc-1b1c-4230-9287-0dc3b31c2f87"]}, {"cve": "CVE-2023-43785", "desc": "A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system.", "poc": ["https://github.com/AWSXXF/xorg_mirror_libx11", "https://github.com/LingmoOS/libx11", "https://github.com/deepin-community/libx11", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33405", "desc": "Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.", "poc": ["https://github.com/hacip/CVE-2023-33405", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0733", "desc": "The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/fed1e184-ff56-44fe-9876-d17c0156447a"]}, {"cve": "CVE-2023-51612", "desc": "Kofax Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of JP2 files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21837.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42629", "desc": "Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3224", "desc": "Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.", "poc": ["https://huntr.dev/bounties/1eb74fd8-0258-4c1f-a904-83b52e373a87", "https://github.com/RuiZha0/TCP1PCTF_2023", "https://github.com/izj007/wechat", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-30777", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <=\u00a06.1.5 versions.", "poc": ["https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cve", "https://github.com/Alucard0x1/CVE-2023-30777", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/xu-xiang/awesome-security-vul-llm"]}, {"cve": "CVE-2023-43477", "desc": "The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device.", "poc": ["https://www.tenable.com/security/research/tra-2023-19"]}, {"cve": "CVE-2023-32102", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Pexle Chris Library Viewer plugin <=\u00a02.0.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5941", "desc": "In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not correctly update FILE objects' write space members for write-buffered streams when the write(2) system call returns an error. \u00a0Depending on the nature of an application that calls libc's stdio functions and the presence of errors returned from the write(2) system call (or an overridden stdio write routine) a heap buffer overflow may occur. Such overflows may lead to data corruption or the execution of arbitrary code at the privilege level of the calling program.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49807", "desc": "Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.", "poc": ["https://github.com/mute1008/mute1008", "https://github.com/mute1997/mute1997"]}, {"cve": "CVE-2023-48732", "desc": "Mattermost fails to scope the WebSocket response around notified users\u00a0to a each user separately resulting in the\u00a0WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41136", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laurence/OhMyBox.Info Simple Long Form allows Stored XSS.This issue affects Simple Long Form: from n/a through 2.2.2.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-3608", "desc": "A vulnerability was found in Ruijie BCR810W 2.5.10. It has been rated as critical. This issue affects some unknown processing of the component Tracert Page. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233477 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33634", "desc": "H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm.", "poc": ["https://hackmd.io/@0dayResearch/r1g5bl-Mn"]}, {"cve": "CVE-2023-38583", "desc": "A stack-based buffer overflow vulnerability exists in the LXT2 lxt2_rd_expand_integer_to_bits function of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38222", "desc": "Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/markyason/markyason.github.io"]}, {"cve": "CVE-2023-6484", "desc": "A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2566", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.", "poc": ["https://huntr.dev/bounties/47d6fc2a-989a-44eb-9cb7-ab4f8bd44496"]}, {"cve": "CVE-2023-40749", "desc": "PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the \"column\" parameter of index.php.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20025", "desc": "A vulnerability in the web-based management interface of Cisco Small Business RV042 Series Routers could allow an unauthenticated, remote attacker to bypass authentication on the affected device.\nThis vulnerability is due to incorrect user input validation of incoming HTTP packets. An attacker could exploit this vulnerability by sending crafted requests to the web-based management interface. A successful exploit could allow the attacker to gain root privileges on the affected device.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5", "https://github.com/lnversed/CVE-2023-20025", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-39010", "desc": "BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploited by loading a crafted camera calibration file.", "poc": ["https://github.com/lessthanoptimal/BoofCV/issues/406"]}, {"cve": "CVE-2023-23163", "desc": "Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter.", "poc": ["http://packetstormsecurity.com/files/171643/Art-Gallery-Management-System-Project-1.0-SQL-Injection.html"]}, {"cve": "CVE-2023-0943", "desc": "A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects the function save_settings of the file index.php?page=site_settings of the component Image Handler. The manipulation of the argument img with the input ../../shell.php leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221591.", "poc": ["https://vuldb.com/?id.221591", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21984", "desc": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-41503", "desc": "Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.", "poc": ["https://github.com/ASR511-OO7/CVE-2023-41503", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-45723", "desc": "HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. \u00a0Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21246", "desc": "In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Trinadh465/frameworks_base_AOSP10_r33_CVE-2023-21246", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-36880", "desc": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24684", "desc": "ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.", "poc": ["https://github.com/blakduk/Advisories/blob/main/ChurchCRM/README.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/blakduk/Advisories"]}, {"cve": "CVE-2023-48387", "desc": "TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49453", "desc": "Reflected cross-site scripting (XSS) vulnerability in Racktables v0.22.0 and before, allows local attackers to execute arbitrary code and obtain sensitive information via the search component in index.php.", "poc": ["https://nitipoom-jar.github.io/CVE-2023-49453/", "https://github.com/nitipoom-jar/CVE-2023-49453", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2008", "desc": "A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.", "poc": ["https://github.com/CVEDB/awesome-cve-repo", "https://github.com/IdanBanani/Linux-Kernel-VR-Exploitation", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/bluefrostsecurity/CVE-2023-2008", "https://github.com/em1ga3l/cve-msrc-extractor", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-47456", "desc": "Tenda AX1806 V1.0.0.1 contains a stack overflow vulnerability in function sub_455D4, called by function fromSetWirelessRepeat.", "poc": ["https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1806/fromSetWirelessRepeat.md"]}, {"cve": "CVE-2023-36212", "desc": "File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page function.", "poc": ["https://packetstormsecurity.com/files/172687/Total-CMS-1.7.4-Shell-Upload.html", "https://www.exploit-db.com/exploits/51500", "https://github.com/capture0x/My-CVE"]}, {"cve": "CVE-2023-34939", "desc": "Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.", "poc": ["https://github.com/firsov/onlyoffice", "https://github.com/firsov/onlyoffice/blob/main/CVE-2023-34939-PoC.md", "https://github.com/20142995/sectool", "https://github.com/firsov/onlyoffice"]}, {"cve": "CVE-2023-41451", "desc": "Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.", "poc": ["https://gist.github.com/RNPG/062cfca2e293a0e7d24f5d55f8db3fde", "https://github.com/RNPG/CVEs", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51073", "desc": "An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code via the Firmware Update Script at /etc/init.d/update_notifications.sh.", "poc": ["https://github.com/christopher-pace/CVE-2023-51073", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-21945", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-21975", "desc": "Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Customers Plugin: 18.2-22.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Application Express Customers Plugin. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express Customers Plugin, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Application Express Customers Plugin. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-6585", "desc": "The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server", "poc": ["https://wpscan.com/vulnerability/757412f4-e4f8-4007-8e3b-639a72b33180/"]}, {"cve": "CVE-2023-6132", "desc": "The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by tricking AVEVA Edge to load an unsafe DLL.", "poc": ["https://www.aveva.com/en/support-and-success/cyber-security-updates/"]}, {"cve": "CVE-2023-1702", "desc": "Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.", "poc": ["https://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19"]}, {"cve": "CVE-2023-44336", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44846", "desc": "An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component.", "poc": ["https://blog.csdn.net/2301_79997870/article/details/133365547?spm=1001.2014.3001.5501", "https://blog.csdn.net/2301_79997870/article/details/133661890?spm=1001.2014.3001.5502"]}, {"cve": "CVE-2023-33201", "desc": "Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.", "poc": ["https://github.com/muneebaashiq/MBProjects"]}, {"cve": "CVE-2023-35628", "desc": "Windows MSHTML Platform Remote Code Execution Vulnerability", "poc": ["https://github.com/myseq/ms_patch_tuesday"]}, {"cve": "CVE-2023-52309", "desc": "Heap buffer overflow in paddle.repeat_interleave\u00a0in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-018.md"]}, {"cve": "CVE-2023-46581", "desc": "SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the registration.php component.", "poc": ["https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46581-Code-Projects-Inventory-Management-1.0-SQL-Injection-Vulnerability.md", "https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0"]}, {"cve": "CVE-2023-49920", "desc": "Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation.\u00a0As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent.Users are advised to upgrade to version 2.8.0 or later which is not affected", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2383", "desc": "A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. This affects an unknown part of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.fromAddr leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227661 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.227661"]}, {"cve": "CVE-2023-0512", "desc": "Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.", "poc": ["http://seclists.org/fulldisclosure/2023/Mar/21", "https://huntr.dev/bounties/de83736a-1936-4872-830b-f1e9b0ad2a74"]}, {"cve": "CVE-2023-6620", "desc": "The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/ab5c42ca-ee7d-4344-bd88-0d727ed3d9c4"]}, {"cve": "CVE-2023-38657", "desc": "An out-of-bounds write vulnerability exists in the LXT2 zlib block decompression functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37683", "desc": "Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Profile Page of the Admin.", "poc": ["https://github.com/rt122001/CVES/blob/main/CVE-2023-37683.txt", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31035", "desc": "NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may cause an SMI callout vulnerability that could be used to execute arbitrary code at the SMM level. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31923", "desc": "Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with \"User Operator\" privileges to create a highly privileged user account. The vulnerability is caused by missing server-side validation, which can be exploited to gain full administrator privileges on the system.", "poc": ["https://nobugescapes.com/blog/creating-a-new-user-with-admin-privilege/"]}, {"cve": "CVE-2023-25706", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Pagup WordPress Robots.Txt optimization plugin <=\u00a01.4.5 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/yaudahbanh/CVE-Archive"]}, {"cve": "CVE-2023-27490", "desc": "NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to **log in as the victim**, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-47997", "desc": "An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of service.", "poc": ["https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47997", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/thelastede/FreeImage-cve-poc"]}, {"cve": "CVE-2023-6120", "desc": "The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27727", "desc": "Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_function.h.", "poc": ["https://github.com/nginx/njs/issues/617"]}, {"cve": "CVE-2023-4910", "desc": "A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31893", "desc": "Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.", "poc": ["https://medium.com/@shooterRX/dns-recursion-leads-to-dos-attack-vivo-play-iptv-cve-2023-31893-b5ac45f38f"]}, {"cve": "CVE-2023-20758", "desc": "In cmdq, there is a possible memory corruption due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07636133; Issue ID: ALPS07636130.", "poc": ["https://github.com/Resery/Resery", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47252", "desc": "An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6. There is a possible out-of-bounds access in the SMM communication buffer, leading to tampering. The PNP-related SMI sub-functions do not verify data size before getting it from the communication buffer, which could lead to possible circumstances where the data immediately following the command buffer could be destroyed with a fixed value. This is fixed in kernel 5.2 v05.28.45, kernel 5.3 v05.37.45, kernel 5.4 v05.45.45, kernel 5.5 v05.53.45, and kernel 5.6 v05.60.45.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51694", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epiphyt Embed Privacy allows Stored XSS.This issue affects Embed Privacy: from n/a through 1.8.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52358", "desc": "Vulnerability of configuration defects in some APIs of the audio module.Successful exploitation of this vulnerability may affect availability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46010", "desc": "An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.", "poc": ["https://blog.csdn.net/DGS666/article/details/133795200?spm=1001.2014.3001.5501"]}, {"cve": "CVE-2023-0410", "desc": "Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.", "poc": ["https://huntr.dev/bounties/2da583f0-7f66-4ba7-9bed-8e7229aa578e"]}, {"cve": "CVE-2023-0585", "desc": "The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-3565", "desc": "Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.", "poc": ["https://huntr.dev/bounties/fcf46e1f-2ab6-4057-9d25-cf493ab09530"]}, {"cve": "CVE-2023-43233", "desc": "A stored cross-site scripting (XSS) vulnerability in the cms/content/edit component of YZNCMS v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6376", "desc": "Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents.", "poc": ["https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/", "https://github.com/qwell/disorder-in-the-court"]}, {"cve": "CVE-2023-44961", "desc": "SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. component.", "poc": ["https://github.com/ggb0n/CVE-2023-44961", "https://github.com/ggb0n/CVE-2023-44961", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-28143", "desc": "Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7)installer allows a local escalation of privilege bounded only to the time ofinstallation and only on older macOSX (macOS 10.15 and older) versions.Attackers may exploit incorrect file permissions to give them ROOT commandexecution privileges on the host. During the install of the PKG, a step in theprocess involves extracting the package and copying files to severaldirectories. Attackers may gain writable access to files during the install ofPKG when extraction of the package and copying files to several directories,enabling a local escalation of privilege.", "poc": ["https://qualys.com/security-advisories"]}, {"cve": "CVE-2023-51464", "desc": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1798", "desc": "A vulnerability, which was classified as problematic, has been found in EyouCMS up to 1.5.4. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument typename leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-224750 is the identifier assigned to this vulnerability.", "poc": ["https://gitee.com/wkstestete/cve/blob/master/xss/eyoucms%20xss.md"]}, {"cve": "CVE-2023-39743", "desc": "lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c.", "poc": ["https://gist.github.com/huanglei3/ec9090096aa92445cf0a8baa8e929084", "https://github.com/huanglei3/lrzip-next-poc/tree/main", "https://github.com/pete4abw/lrzip-next/issues/132"]}, {"cve": "CVE-2023-49910", "desc": "A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `ssid` parameter at offset `0x42247c` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45606", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Lasso Simple URLs plugin <=\u00a0120 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3857", "desc": "A vulnerability, which was classified as problematic, was found in phpscriptpoint Ecommerce 1.15. This affects an unknown part of the file /product.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235209 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7176", "desc": "A vulnerability classified as critical has been found in Campcodes Online College Library System 1.0. This affects an unknown part of the file /admin/return_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249363.", "poc": ["https://medium.com/@heishou/libsystem-foreground-sql-injection-vulnerability-3-d02f0ce78fe3", "https://vuldb.com/?id.249363"]}, {"cve": "CVE-2023-30188", "desc": "Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.", "poc": ["https://github.com/merrychap/POC-onlyoffice"]}, {"cve": "CVE-2023-39420", "desc": "The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an \"admin\" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the daily password and connect to application customers. Given that this is an administrative account, anyone logging into a customer deployment has full, unrestricted access to the application.", "poc": ["https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained/"]}, {"cve": "CVE-2023-28506", "desc": "Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow, where a string is copied into a buffer using a memcpy-like function and a user-provided length. This requires a valid login to exploit.", "poc": ["https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed/"]}, {"cve": "CVE-2023-22102", "desc": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", "poc": ["https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9"]}, {"cve": "CVE-2023-43906", "desc": "Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.", "poc": ["https://github.com/Playful-CR/CVE-paddle-/blob/main/CVE-2023-43906"]}, {"cve": "CVE-2023-1560", "desc": "A vulnerability, which was classified as problematic, has been found in TinyTIFF 3.0.0.0. This issue affects some unknown processing of the file tinytiffreader.c of the component File Handler. The manipulation leads to buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-223553 was assigned to this vulnerability.", "poc": ["https://github.com/10cksYiqiyinHangzhouTechnology/Security-Issue-Report-of-TinyTIFF", "https://github.com/10cksYiqiyinHangzhouTechnology/Security-Issue-Report-of-TinyTIFF/blob/main/id8", "https://vuldb.com/?id.223553", "https://github.com/10cks/10cks", "https://github.com/10cksYiqiyinHangzhouTechnology/10cksYiqiyinHangzhouTechnology", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-4721", "desc": "Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.", "poc": ["https://huntr.dev/bounties/f457dc62-3cff-47bd-8fd2-1cb2b4a832fc"]}, {"cve": "CVE-2023-0899", "desc": "The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins.", "poc": ["https://wpscan.com/vulnerability/e95f925f-118e-4fa1-8e8f-9dc1bc698f12"]}, {"cve": "CVE-2023-4113", "desc": "A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-235960. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/173931/PHPJabbers-Service-Booking-Script-1.0-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-24728", "desc": "Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the contact parameter in the user profile update function.", "poc": ["https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip"]}, {"cve": "CVE-2023-23618", "desc": "Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's \"Visualize History\" functionality) in clones of untrusted repositories.", "poc": ["https://github.com/9069332997/session-1-full-stack", "https://github.com/ARPSyndicate/cvemon", "https://github.com/KK-Designs/UpdateHub", "https://github.com/ycdxsb/ycdxsb"]}, {"cve": "CVE-2023-47453", "desc": "An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges through the version.dll file in the current working directory.", "poc": ["https://github.com/xieqiang11/poc-2/tree/main"]}, {"cve": "CVE-2023-3553", "desc": "Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.", "poc": ["https://huntr.dev/bounties/857f002a-2794-4807-aa5d-2f340de01870", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25220", "desc": "Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the add_white_node function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC5/7/7.md"]}, {"cve": "CVE-2023-38046", "desc": "A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.", "poc": ["https://github.com/kaje11/CVEs"]}, {"cve": "CVE-2023-6888", "desc": "A vulnerability classified as critical was found in PHZ76 RtspServer 1.0.0. This vulnerability affects the function ParseRequestLine of the file RtspMesaage.cpp. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248248. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://www.huiyao.love/2023/12/08/rtspserver-stackoverflow-vulnerability/"]}, {"cve": "CVE-2023-40110", "desc": "In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-46724", "desc": "Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.", "poc": ["https://github.com/MegaManSec/Squid-Security-Audit", "https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0020", "desc": "SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality and limited impact on integrity of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-25282", "desc": "A heap overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the config.log_to_syslog and log_opt_dropPackets parameters to mydlink_api.ccp.", "poc": ["https://github.com/migraine-sudo/D_Link_Vuln/tree/main/Permanent%20DDOS%20vulnerability%20in%20emailInfo"]}, {"cve": "CVE-2023-1455", "desc": "A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file admin/ajax.php?action=login2 of the component Login Page. The manipulation of the argument email with the input abc%40qq.com' AND (SELECT 9110 FROM (SELECT(SLEEP(5)))XSlc) AND 'jFNl'='jFNl leads to sql injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223300.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-4767", "desc": "A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.csv.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30860", "desc": "WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert malicious scripts. Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts. Version 12.4 contains a patch for this issue.", "poc": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-xr9h-p2rc-rpqm"]}, {"cve": "CVE-2023-36899", "desc": "ASP.NET Elevation of Privilege Vulnerability", "poc": ["https://github.com/20142995/sectool", "https://github.com/d0rb/CVE-2023-36899", "https://github.com/hktalent/bug-bounty", "https://github.com/midisec/CVE-2023-36899", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/w181496/Web-CTF-Cheatsheet"]}, {"cve": "CVE-2023-2592", "desc": "The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/d4298960-eaba-4185-a730-3e621d9680e1"]}, {"cve": "CVE-2023-24127", "desc": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet.", "poc": ["https://oxnan.com/posts/WifiBasic_wepkey1_DoS"]}, {"cve": "CVE-2023-4222", "desc": "Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.", "poc": ["https://starlabs.sg/advisories/23/23-4222"]}, {"cve": "CVE-2023-6379", "desc": "Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-43569", "desc": "A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-46137", "desc": "Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.", "poc": ["https://github.com/instana/envoy-tracing", "https://github.com/instana/nginx-tracing", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-39075", "desc": "Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) allows attackers to crash the infotainment system by sending arbitrary USB data via a USB device.", "poc": ["https://blog.dhjeong.kr/posts/automotive/2023/12/how-to-fuzzing-realcars/", "https://blog.dhjeong.kr/posts/vuln/202307/renault-zoe/", "https://blog.jhyeon.dev/posts/vuln/202307/renault-zoe/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6385", "desc": "The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as clearing logs.", "poc": ["https://wpscan.com/vulnerability/362c56ff-85eb-480f-a825-9670d4c0e3d0/"]}, {"cve": "CVE-2023-21213", "desc": "In initiateTdlsTeardownInternal of sta_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the wifi server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262235951", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37191", "desc": "A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sahiloj/CVE-2023-37191"]}, {"cve": "CVE-2023-2320", "desc": "The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/f17ccbaa-2fcd-4f17-a4da-73f2bc8a4fe9"]}, {"cve": "CVE-2023-49907", "desc": "A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `band` parameter at offset `0x0045aad8` of the `httpd_portal` binary shipped with v5.1.0 Build 20220926 of the EAP225.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49246", "desc": "Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3733", "desc": "Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45464", "desc": "Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.", "poc": ["https://github.com/adhikara13/CVE/blob/main/netis_N3/buffer%20overflow%20in%20servDomain%20parameter%20leads%20to%20DOS.md", "https://github.com/Luwak-IoT-Security/CVEs"]}, {"cve": "CVE-2023-47066", "desc": "Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5893", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.", "poc": ["https://huntr.com/bounties/a965aa16-79ce-4185-8f58-3d3b0d74a71e"]}, {"cve": "CVE-2023-30195", "desc": "In the module \"Detailed Order\" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without restriction formatted in json.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1149", "desc": "Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.", "poc": ["https://huntr.dev/bounties/2e734209-d7b0-4f57-a8be-c65c82208f2f"]}, {"cve": "CVE-2023-6199", "desc": "Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.", "poc": ["https://fluidattacks.com/advisories/imagination/"]}, {"cve": "CVE-2023-51655", "desc": "In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24009", "desc": "Auth. (subscriber+) Reflected Cross-site Scripting (XSS) vulnerability in Wpazure Themes Upfrontwp theme <=\u00a01.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46661", "desc": "Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"]}, {"cve": "CVE-2023-49911", "desc": "A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `band` parameter at offset `0x422420` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1090", "desc": "The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://github.com/youki992/youki992.github.io/blob/master/others/apply.md", "https://wpscan.com/vulnerability/d470dd6c-dcac-4a3e-b42a-2489a31aca45"]}, {"cve": "CVE-2023-6478", "desc": "A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46671", "desc": "An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users. The issue occurs infrequently, only if an error is returned from an Elasticsearch cluster, in cases where there is user interaction and an unhealthy cluster (for example, when returning circuit breaker or no shard exceptions).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31407", "desc": "SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.", "poc": ["https://launchpad.support.sap.com/#/notes/3312892", "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-21734", "desc": "Microsoft Office Remote Code Execution Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-38598", "desc": "A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-4818", "desc": "PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be used.\u00a0The attacker must have physical USB access to the device in order to exploit this vulnerability.", "poc": ["https://blog.stmcyber.com/pax-pos-cves-2023/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3627", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.", "poc": ["https://huntr.dev/bounties/558b3dce-db03-47ba-b60b-c6eb578e04f1"]}, {"cve": "CVE-2023-30383", "desc": "TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Archer_C2_US__V1_170228 were discovered to contain a buffer overflow which may lead to a Denial of Service (DoS) when parsing crafted data.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-52229", "desc": "Missing Authorization vulnerability in Save as PDF plugin by Pdfcrowd Word Replacer Pro.This issue affects Word Replacer Pro: from n/a through 1.0.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-0146", "desc": "The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/d1218c69-4f6a-4b2d-a537-5cc16a46ba7b"]}, {"cve": "CVE-2023-51510", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Atlas Gondal Export Media URLs.This issue affects Export Media URLs: from n/a through 1.0.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5761", "desc": "The Burst Statistics \u2013 Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 (free) and versions 1.4.0 to 1.5.0 (pro) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2091", "desc": "A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function adjust_cpufreq_scaling_governer. The manipulation leads to os command injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.4.13 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226099.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-34251", "desc": "Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.", "poc": ["https://github.com/getgrav/grav/security/advisories/GHSA-f9jf-4cp4-4fq5"]}, {"cve": "CVE-2023-35874", "desc": "SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs improper authentication checks for functionalities that require user identity. An attacker can perform malicious actions over the network, extending the scope of impact, causing a limited impact on confidentiality, integrity and availability.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-32365", "desc": "The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, iOS 16.5 and iPadOS 16.5. Shake-to-undo may allow a deleted photo to be re-surfaced without authentication.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-51606", "desc": "Kofax Power PDF U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.. Was ZDI-CAN-21759.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0274", "desc": "The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/4f6197b6-6d4c-4986-b54c-453b17e94812"]}, {"cve": "CVE-2023-49129", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43655", "desc": "Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25582", "desc": "Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch that manages an already existing vlan configuration.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1723"]}, {"cve": "CVE-2023-0014", "desc": "SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-49257", "desc": "An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41055", "desc": "LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side Request Forgery (SSRF) vulnerability in the `engines/google/text.php` and `engines/duckduckgo/text.php` files in versions before commit be59098abd119cda70b15bf3faac596dfd39a744. This vulnerability allows remote attackers to request the server to send HTTP GET requests to arbitrary targets and conduct Denial-of-Service (DoS) attacks via the `wikipedia_language` cookie. Remote attackers can request the server to download large files to reduce the performance of the server or even deny access from legitimate users. This issue has been patched in https://github.com/Ahwxorg/LibreY/pull/9. LibreY hosters are advised to use the latest commit. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/Ahwxorg/LibreY/security/advisories/GHSA-xfj6-4vp9-8rgc"]}, {"cve": "CVE-2023-27453", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <=\u00a02.3.1 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/yaudahbanh/CVE-Archive"]}, {"cve": "CVE-2023-1816", "desc": "Incorrect security UI in Picture In Picture in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially perform navigation spoofing via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-26918", "desc": "Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSystem. This occurs because %ProgramFiles%\\FileReplicationPro allows Everyone:(F) access.", "poc": ["http://packetstormsecurity.com/files/171879/File-Replication-Pro-7.5.0-Insecure-Permissions-Privilege-Escalation.html"]}, {"cve": "CVE-2023-42818", "desc": "JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0889", "desc": "Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator", "poc": ["https://wpscan.com/vulnerability/c39473a7-47fc-4bce-99ad-28d03f41e74e"]}, {"cve": "CVE-2023-5137", "desc": "The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).", "poc": ["https://wpscan.com/vulnerability/79b79e9c-ea4f-4188-a1b5-61dda0b5d434"]}, {"cve": "CVE-2023-31297", "desc": "An issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718. There is XSS via the Name field when modifying a client.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0058/"]}, {"cve": "CVE-2023-2808", "desc": "Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-20708", "desc": "In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07581655; Issue ID: ALPS07581655.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Resery/Resery"]}, {"cve": "CVE-2023-43776", "desc": "Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).", "poc": ["https://github.com/SySS-Research/easy-password-recovery", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-23192", "desc": "IS Decisions UserLock MFA 11.01 is vulnerable to authentication bypass using scheduled task.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/hktalent/TOP", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/pinarsadioglu/CVE-2023-23192"]}, {"cve": "CVE-2023-34124", "desc": "The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.", "poc": ["http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html", "https://github.com/getdrive/PoC"]}, {"cve": "CVE-2023-3746", "desc": "The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/c15a6032-6495-47a8-828c-37e55ed9665a"]}, {"cve": "CVE-2023-27895", "desc": "SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-7170", "desc": "The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/218fb3af-3a40-486f-8ea9-80211a986fb3/"]}, {"cve": "CVE-2023-31852", "desc": "Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the iface parameter.", "poc": ["https://github.com/CalfCrusher/CVE-2023-31852", "https://github.com/CalfCrusher/CVE-2023-31852", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4958", "desc": "In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46387", "desc": "LOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 firmware 7.2.4 are vulnerable to Incorrect Access Control via dpal_config.zml file. This vulnerability allows remote attackers to disclose sensitive information on Loytec device data point configuration.", "poc": ["http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html"]}, {"cve": "CVE-2023-43353", "desc": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component.", "poc": ["https://github.com/sromanhu/CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra"]}, {"cve": "CVE-2023-37571", "desc": "Softing TH SCOPE through 3.70 allows XSS.", "poc": ["https://github.com/cxosmo/CVEs"]}, {"cve": "CVE-2023-51392", "desc": "Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0793", "desc": "Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.", "poc": ["https://huntr.dev/bounties/b3881a1f-2f1e-45cb-86f3-735f66e660e9", "https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-29336", "desc": "Win32k Elevation of Privilege Vulnerability", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/ayhan-dev/CVE-LIST", "https://github.com/ayhan-dev/p0ropc", "https://github.com/immortalp0ny/mypocs", "https://github.com/leonov-av/vulristics", "https://github.com/m-cetin/CVE-2023-29336", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-45654", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <=\u00a01.1.7 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26104", "desc": "All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.", "poc": ["https://gist.github.com/lirantal/637520812da06fffb91dd86d02ff6bde", "https://security.snyk.io/vuln/SNYK-JS-LITEWEBSERVER-3153703"]}, {"cve": "CVE-2023-5044", "desc": "Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.", "poc": ["https://github.com/4ARMED/cve-2023-5044", "https://github.com/KubernetesBachelor/CVE-2023-5044", "https://github.com/cloud-Xolt/CVE", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/r0binak/CVE-2023-5044", "https://github.com/tanjiti/sec_profile", "https://github.com/tarihub/offlinepost", "https://github.com/tarimoe/offlinepost"]}, {"cve": "CVE-2023-2657", "desc": "A vulnerability classified as problematic was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functionality of the file products.php. The manipulation of the argument search leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228799.", "poc": ["https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Online-Computer-and-Laptop-Store---Multiple-vulnerabilities.md#1xss-vulnerability-in-productsphp"]}, {"cve": "CVE-2023-52132", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26325", "desc": "The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterValue' and 'selectedColumns' parameters.", "poc": ["https://www.tenable.com/security/research/tra-2023-2", "https://github.com/ARPSyndicate/cvemon", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-51491", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Averta Depicter Slider.This issue affects Depicter Slider: from n/a through 2.0.6.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50893", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution Impreza \u2013 WordPress Website and WooCommerce Builder allows Reflected XSS.This issue affects Impreza \u2013 WordPress Website and WooCommerce Builder: from n/a through 8.17.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37464", "desc": "OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).", "poc": ["https://github.com/EGI-Federation/SVG-advisories", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0082", "desc": "The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/e1ba5047-0c39-478f-89c7-b0bb638efdff"]}, {"cve": "CVE-2023-6485", "desc": "The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins", "poc": ["https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81"]}, {"cve": "CVE-2023-37306", "desc": "MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.", "poc": ["https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle"]}, {"cve": "CVE-2023-1305", "desc": "An authenticated attacker can leverage an exposed \u201cbox\u201d object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.", "poc": ["https://docs.divvycloud.com/changelog/23321-release-notes"]}, {"cve": "CVE-2023-33404", "desc": "An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.", "poc": ["https://github.com/hacip/CVE-2023-33404", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5991", "desc": "The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server", "poc": ["https://wpscan.com/vulnerability/e9d35e36-1e60-4483-b8b3-5cbf08fcd49e"]}, {"cve": "CVE-2023-32219", "desc": "A Mazda model (2015-2016) can be unlocked via an unspecified method.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-0770", "desc": "Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.", "poc": ["https://huntr.dev/bounties/e0fdeee5-7909-446e-9bd0-db80fd80e8dd"]}, {"cve": "CVE-2023-40956", "desc": "A SQL injection vulnerability in Cloudroits Website Job Search v.15.0 allows a remote authenticated attacker to execute arbitrary code via the name parameter in controllers/main.py component.", "poc": ["https://github.com/luvsn/OdZoo/tree/main/exploits/website_job_search"]}, {"cve": "CVE-2023-0662", "desc": "In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-31678", "desc": "Incorrect access control in Videogo v6.8.1 allows attackers to bind shared devices after the connection has been ended.", "poc": ["https://github.com/zzh-newlearner/record/blob/main/yingshi_devicekey.md"]}, {"cve": "CVE-2023-52221", "desc": "Unrestricted Upload of File with Dangerous Type vulnerability in UkrSolution Barcode Scanner and Inventory manager.This issue affects Barcode Scanner and Inventory manager: from n/a through 1.5.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38487", "desc": "HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1 can be used to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by the new one.When the freeURL feature is enabled (by setting the `allowFreeURL` config option or the `CMD_ALLOW_FREEURL` environment variable to `true`), any user with the appropriate permissions can create a note by making a POST request to the `/new/` API endpoint. The `` parameter can be set to the ID of an existing note. HedgeDoc did not verify whether the provided `` value corresponds to a valid ID of an existing note and always allowed creation of the new note. When a visitor tried to access the existing note, HedgeDoc will first search for a note with a matching alias before it searches using the ID, therefore only the new note can be accessed.Depending on the permission settings of the HedgeDoc instance, the issue can be exploited only by logged-in users or by all (including non-logged-in) users. The exploit requires knowledge of the ID of the target note. Attackers could use this issue to present a manipulated copy of the original note to the user, e.g. by replacing the links with malicious ones. Attackers can also use this issue to prevent access to the original note, causing a denial of service. No data is lost, as the original content of the affected notes is still present in the database.This issue was fixed in version 1.9.9. As a workaround, disabling freeURL mode prevents the exploitation of this issue. The impact can be limited by restricting freeURL note creation to trusted, logged-in users by enabling `requireFreeURLAuthentication`/`CMD_REQUIRE_FREEURL_AUTHENTICATION`.", "poc": ["https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-7494-7hcf-vxpg"]}, {"cve": "CVE-2023-38181", "desc": "Microsoft Exchange Server Spoofing Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31799", "desc": "Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter.", "poc": ["https://github.com/msegoviag/discovered-vulnerabilities", "https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-40551", "desc": "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52360", "desc": "Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34634", "desc": "Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened.", "poc": ["http://packetstormsecurity.com/files/173825/GreenShot-1.2.10-Arbitrary-Code-Execution.html", "http://packetstormsecurity.com/files/174222/Greenshot-1.3.274-Deserialization-Command-Execution.html", "https://greenshot.atlassian.net/browse/BUG-3061", "https://www.exploit-db.com/exploits/51633", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/radman404/CVE-2023-34634"]}, {"cve": "CVE-2023-42222", "desc": "WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.", "poc": ["http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-Execution-Code-Execution.html", "https://github.com/itssixtyn3in/CVE-2023-42222", "https://github.com/itssixtyn3in/CVE-2023-42222", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31450", "desc": "A path traversal vulnerability was identified in the SQL v2 sensors in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the SQL v2 sensors into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33876", "desc": "A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15332 handles destroying annotations. Specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1796"]}, {"cve": "CVE-2023-36005", "desc": "Windows Telephony Server Elevation of Privilege Vulnerability", "poc": ["https://github.com/myseq/ms_patch_tuesday"]}, {"cve": "CVE-2023-26840", "desc": "A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator.", "poc": ["https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26840", "https://github.com/10splayaSec/CVE-Disclosures", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-0263", "desc": "The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.", "poc": ["https://wpscan.com/vulnerability/2b4a6459-3e49-4048-8a9f-d7bb350aa2f6"]}, {"cve": "CVE-2023-1645", "desc": "A vulnerability was found in IObit Malware Fighter 9.4.0.776. It has been classified as problematic. This affects the function 0x8018E008 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-224025 was assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1645", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-27918", "desc": "Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-25708", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR \u2013 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions.", "poc": ["https://github.com/karimhabush/cyberowl", "https://github.com/yaudahbanh/CVE-Archive"]}, {"cve": "CVE-2023-4293", "desc": "The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5738", "desc": "The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/7f935916-9a1a-40c7-b6d8-efcc46eb8eaf"]}, {"cve": "CVE-2023-24347", "desc": "D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formSetWanDhcpplus.", "poc": ["https://github.com/1160300418/Vuls/tree/main/D-Link/DIR-605L/webpage_Vuls/02"]}, {"cve": "CVE-2023-22039", "desc": "Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: WebClient). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-30790", "desc": "MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/relationships` endpoint and first_name and last_name parameter.", "poc": ["https://fluidattacks.com/advisories/napoli"]}, {"cve": "CVE-2023-50072", "desc": "A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS.", "poc": ["https://github.com/ahrixia/CVE-2023-50072", "https://github.com/ahrixia/CVE-2023-50072", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-24151", "desc": "A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.", "poc": ["https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/recvSlaveCloudCheckStatus_ip/recvSlaveCloudCheckStatus_ip.md", "https://github.com/fullwaywang/QlRules"]}, {"cve": "CVE-2023-33660", "desc": "A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function copyn_str() in the file mqtt_parser.c. An attacker could exploit this vulnerability to cause a denial of service attack.", "poc": ["https://github.com/emqx/nanomq/issues/1155"]}, {"cve": "CVE-2023-32439", "desc": "A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/em1ga3l/cve-msrc-extractor", "https://github.com/home-gihub/w3bkn0t"]}, {"cve": "CVE-2023-2698", "desc": "A vulnerability classified as critical was found in SourceCodester Lost and Found Information System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=items/manage_item of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228979.", "poc": ["https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-34181", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in WP-Cirrus plugin <=\u00a00.6.11 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-31190", "desc": "DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an\u00a0Improper Authentication vulnerability during the firmware update procedure.Specifically, the firmware update procedure ignores and does not check the validity of the TLS certificate of the HTTPS endpoint from which the firmware update package (.tar.bz2 file) is downloaded.An attacker with the ability to put himself in a Man-in-the-Middle situation (e.g., DNS poisoning, ARP poisoning, control of a node on the route to the endpoint, etc.) can trick the DroneScout ds230 to install a crafted malicious firmware update containing arbitrary files (e.g., executable and configuration) and gain administrative (root) privileges on the underlying Linux operating system.This issue affects DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22031", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows high privileged attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-3845", "desc": "A vulnerability was found in mooSocial mooDating 1.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /friends/ajax_invite of the component URL Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235196. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.", "poc": ["http://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-45666", "desc": "stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn\u2019t give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn\u2019t do it in case the image is not recognized as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `*delays` without resetting it to zero. Thus it would be fair to say the caller of `stbi__load_gif_main` is responsible to free the allocated memory in `*delays` only if `stbi__load_gif_main` returns a non null value. However at the same time the function may return null value, but fail to free the memory in `*delays` if internally `stbi__convert_format` is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didn\u2019t fail or to a double-free if the `delays` is always freed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36727", "desc": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37407", "desc": "IBM Aspera Orchestrator 4.0.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 260116.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47223", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Map Plugins Basic Interactive World Map plugin <=\u00a02.0 versions.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-37759", "desc": "Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request.", "poc": ["https://packetstormsecurity.com/files/174240/Crypto-Currency-Tracker-CCT-9.5-Add-Administrator.html"]}, {"cve": "CVE-2023-32873", "desc": "In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08583919; Issue ID: ALPS08304227.", "poc": ["https://github.com/Resery/Resery", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52118", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS.This issue affects WP User Profile Avatar: from n/a through 1.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0102", "desc": "LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files.", "poc": ["https://github.com/goheea/goheea"]}, {"cve": "CVE-2023-33797", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.", "poc": ["https://github.com/anhdq201/netbox/issues/12"]}, {"cve": "CVE-2023-44302", "desc": "Dell DM5500 5.14.0.0 and prior contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access of resources or functionality that could possibly lead to execute arbitrary code.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1644", "desc": "A vulnerability was found in IObit Malware Fighter 9.4.0.776 and classified as problematic. Affected by this issue is the function 0x8018E010 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224024.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1644", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-43783", "desc": "Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even if it has been created by a local adversary before Cadence started. The adversary can leverage this to create or overwrite files via a symlink attack. In some kernel configurations, code injection into the Wine registry is possible.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37918", "desc": "Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj"]}, {"cve": "CVE-2023-43547", "desc": "Memory corruption while invoking IOCTLs calls in Automotive Multimedia.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24736", "desc": "PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure_act.php.", "poc": ["https://github.com/AetherBlack/CVE/tree/main/PMB"]}, {"cve": "CVE-2023-24052", "desc": "An issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via the change password functionality as it does not prompt for the current password.", "poc": ["https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/"]}, {"cve": "CVE-2023-4414", "desc": "A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237517 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30544", "desc": "Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.", "poc": ["https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/"]}, {"cve": "CVE-2023-6242", "desc": "The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or incorrect nonce validation on the evo_eventpost_update_meta function. This makes it possible for unauthenticated attackers to update arbitrary post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25572", "desc": "react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and using the `` are affected. `` outputs the field value using `dangerouslySetInnerHTML` without client-side sanitization. If the data isn't sanitized server-side, this opens a possible cross-site scripting (XSS) attack. Versions 3.19.12 and 4.7.6 now use `DOMPurify` to escape the HTML before outputting it with React and `dangerouslySetInnerHTML`. Users who already sanitize HTML data server-side do not need to upgrade. As a workaround, users may replace the `` by a custom field doing sanitization by hand.", "poc": ["https://github.com/marmelab/react-admin/pull/8644", "https://github.com/marmelab/react-admin/security/advisories/GHSA-5jcr-82fh-339v"]}, {"cve": "CVE-2023-29505", "desc": "An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking.", "poc": ["https://excellium-services.com/cert-xlm-advisory/CVE-2023-29505", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29441", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robert Heller WebLibrarian plugin <=\u00a03.5.8.1 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-6566", "desc": "Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.", "poc": ["https://huntr.com/bounties/cf4b68b5-8d97-4d05-9cde-e76b1a414fd6", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49785", "desc": "NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using HTTP POST, PUT, and other methods. Attackers can also use this vulnerability to mask their source IP by forwarding malicious traffic intended for other Internet targets through these open proxies. As of time of publication, no patch is available, but other mitigation strategies are available. Users may avoid exposing the application to the public internet or, if exposing the application to the internet, ensure it is an isolated network with no access to any other internal resources.", "poc": ["https://github.com/XRSec/AWVS-Update", "https://github.com/nvn1729/advisories", "https://github.com/seyrenus/trace-release", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-22319", "desc": "A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a malicious packet to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1701"]}, {"cve": "CVE-2023-45484", "desc": "Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGuestBasic.", "poc": ["https://github.com/l3m0nade/IOTvul/blob/master/fromSetWifiGusetBasic.md"]}, {"cve": "CVE-2023-41885", "desc": "Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not also enforce strong passwords, these lists of valid accounts are likely to be used in a password spray attack with the outcome being attempted takeover of user accounts on the platform. The impact of this vulnerability is minor as it requires chaining with other attack vectors in order to gain more then simply a list of valid users on the underlying platform. The likelihood of this vulnerability is possible as it requires minimal skills to pull off, especially given the underlying login functionality for Piccolo based sites is open source. This issue has been patched in version 0.121.0.", "poc": ["https://github.com/piccolo-orm/piccolo/security/advisories/GHSA-h7cm-mrvq-wcfr"]}, {"cve": "CVE-2023-2333", "desc": "The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/13c4e065-fde6-41a4-a22b-bca1b10e0d30", "https://github.com/codeb0ss/CVE-2023-2333-EXP", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3705", "desc": "The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.Successful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targeted device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40104", "desc": "In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-31622", "desc": "An issue in the sqlc_make_policy_trig component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1135"]}, {"cve": "CVE-2023-40163", "desc": "An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1836"]}, {"cve": "CVE-2023-34752", "desc": "bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.", "poc": ["https://ndmcyb.hashnode.dev/bloofox-v0521-was-discovered-to-contain-many-sql-injection-vulnerability"]}, {"cve": "CVE-2023-37144", "desc": "Tenda AC10 v15.03.06.26 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac.", "poc": ["https://github.com/DaDong-G/Vulnerability_info/blob/main/ac10_command_injection/Readme.md"]}, {"cve": "CVE-2023-37688", "desc": "Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page.", "poc": ["https://github.com/rt122001/CVES/blob/main/CVE-2023-37688.txt", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26151", "desc": "Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.", "poc": ["https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0174", "desc": "The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/6b53d0e6-def9-4907-bd2b-884b2afa52b3"]}, {"cve": "CVE-2023-5257", "desc": "A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest of the file src/main/java/com/feihong/ldap/HTTPServer.java. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. VDB-240866 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39341", "desc": "\"FFRI yarai\", \"FFRI yarai Home and Business Edition\" and their OEM products handle exceptional conditions improperly, which may lead to denial-of-service (DoS) condition. \nAffected products and versions are as follows: FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0, FFRI yarai Home and Business Edition version 1.4.0, InfoTrace Mark II Malware Protection (Mark II Zerona) versions 3.0.1 to 3.2.2, Zerona / Zerona PLUS versions 3.2.32 to 3.2.36, ActSecure \u03c7 versions 3.4.0 to 3.4.6 and 3.5.0, Dual Safe Powered by FFRI yarai version 1.4.1, EDR Plus Pack (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0), and EDR Plus Pack Cloud (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0).", "poc": ["https://www.sourcenext.com/support/i/2023/230718_01", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51787", "desc": "An issue was discovered in Wind River VxWorks 7 22.09 and 23.03. If a VxWorks task or POSIX thread that uses OpenSSL exits, limited per-task memory is not freed, resulting in a memory leak.", "poc": ["https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4829", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.", "poc": ["https://huntr.dev/bounties/babd73ca-6c80-4145-8c7d-33a883fe606b"]}, {"cve": "CVE-2023-39711", "desc": "Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Subtotal and Paidbill parameters under the Add New Put section.", "poc": ["https://github.com/Arajawat007/CVE-2023-39711", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5046", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection.This issue affects Procost: before 1390.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25104", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_ike_profile function with the username and the password variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-2908", "desc": "A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service.", "poc": ["https://gitlab.com/libtiff/libtiff/-/merge_requests/479"]}, {"cve": "CVE-2023-36917", "desc": "SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim\u2019s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impact on integrity loss or system availability, this could lead to an attacker to completely takeover a victim\u2019s account.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-28934", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <=\u00a01.6.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4900", "desc": "Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/btklab/posh-mocks"]}, {"cve": "CVE-2023-33730", "desc": "Privilege Escalation in the \"GetUserCurrentPwd\" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retrieve password of any admin or normal user in plain text format.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sahiloj/CVE-2023-33730"]}, {"cve": "CVE-2023-3067", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.", "poc": ["https://huntr.dev/bounties/4772ceb7-1594-414d-9b20-5b82029da7b6"]}, {"cve": "CVE-2023-41131", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <=\u00a02.10 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25802", "desc": "Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename` sequences, such as `/etc/nginx/../passwd`, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue.", "poc": ["https://github.com/Sim4n6/Sim4n6"]}, {"cve": "CVE-2023-34644", "desc": "Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series business VPN routers EG_3.0(1)B11P216, EAP and RAP series wireless access points AP_3.0(1)B11P218, NBC series wireless controllers AC_3.0(1)B11P86 allows unauthorized remote attackers to gain the highest privileges via crafted POST request to /cgi-bin/luci/api/auth.", "poc": ["https://www.ruijie.com.cn/gy/xw-aqtg-gw/91389/", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-25096", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_qos function with the rule_name variable with two possible format strings.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-2256", "desc": "The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.", "poc": ["https://wpscan.com/vulnerability/1187e041-3be2-4613-8d56-c2394fcc75fb"]}, {"cve": "CVE-2023-51257", "desc": "An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code.", "poc": ["https://github.com/jasper-software/jasper/issues/367"]}, {"cve": "CVE-2023-45317", "desc": "The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08", "https://www.sielco.org/en/contacts"]}, {"cve": "CVE-2023-27581", "desc": "github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.", "poc": ["https://securitylab.github.com/research/github-actions-untrusted-input/"]}, {"cve": "CVE-2023-27729", "desc": "Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njs_vmcode_return at src/njs_vmcode.c.", "poc": ["https://github.com/nginx/njs/issues/619"]}, {"cve": "CVE-2023-0051", "desc": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.", "poc": ["https://huntr.dev/bounties/1c8686db-baa6-42dc-ba45-aed322802de9", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-3752", "desc": "A vulnerability was found in Creativeitem Academy LMS 5.15. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /home/courses. The manipulation of the argument sort_by leads to cross site scripting. The attack may be launched remotely. VDB-234422 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.234422"]}, {"cve": "CVE-2023-52455", "desc": "In the Linux kernel, the following vulnerability has been resolved:iommu: Don't reserve 0-length IOVA regionWhen the bootloader/firmware doesn't setup the framebuffers, theiraddress and size are 0 in \"iommu-addresses\" property. If IOVA region isreserved with 0 length, then it ends up corrupting the IOVA rbtree withan entry which has pfn_hi < pfn_lo.If we intend to use display driver in kernel without framebuffer thenit's causing the display IOMMU mappings to fail as entire valid IOVAspace is reserved when address and length are passed as 0.An ideal solution would be firmware removing the \"iommu-addresses\"property and corresponding \"memory-region\" if display is not present.But the kernel should be able to handle this by checking for size ofIOVA region and skipping the IOVA reservation if size is 0. Also, adda warning if firmware is requesting 0-length IOVA region reservation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45613", "desc": "In JetBrains Ktor before 2.3.5 server certificates were not verified", "poc": ["https://github.com/password123456/cve-collector"]}, {"cve": "CVE-2023-38965", "desc": "Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI.", "poc": ["http://packetstormsecurity.com/files/175077/Lost-And-Found-Information-System-1.0-Insecure-Direct-Object-Reference.html"]}, {"cve": "CVE-2023-33984", "desc": "SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to Cross-Site Scripting vulnerability.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-26319", "desc": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.", "poc": ["https://github.com/H4lo/awesome-IoT-security-article"]}, {"cve": "CVE-2023-32307", "desc": "Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification.Referring to [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54), several other potential heap-over-flow and integer-overflow in stun_parse_attr_error_code and stun_parse_attr_uint32 were found because the lack of attributes length check when Sofia-SIP handles STUN packets. The previous patch of [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54) fixed the vulnerability when attr_type did not match the enum value, but there are also vulnerabilities in the handling of other valid cases. The OOB read and integer-overflow made by attacker may lead to crash, high consumption of memory or even other more serious consequences. These issue have been addressed in version 1.13.15. Users are advised to upgrade.", "poc": ["https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-rm4c-ccvf-ff9c", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24583", "desc": "Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injection is triggered through a UDP packet.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1710"]}, {"cve": "CVE-2023-37177", "desc": "SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via the query parameter in the /admin/convert/export_z3950.php endpoint.", "poc": ["https://nexacybersecurity.blogspot.com/2024/02/journey-finding-vulnerabilities-in-pmb-library-management-system.html"]}, {"cve": "CVE-2023-21910", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-44008", "desc": "File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.", "poc": ["https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/tree/main/2023/CVE-2023-44008", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2384", "desc": "A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument dhcp.SecDnsIPByte2 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227662 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.227662"]}, {"cve": "CVE-2023-6399", "desc": "A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and\u00a0USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the \u201cdeviceid\u201d daemon by sending a crafted hostname to an affected device if it has the \u201cDevice Insight\u201d feature enabled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32741", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows SQL Injection.This issue affects Contact Form to Any API: from n/a through 1.1.2.", "poc": ["http://packetstormsecurity.com/files/175654/WordPress-Contact-Form-To-Any-API-1.1.2-SQL-Injection.html"]}, {"cve": "CVE-2023-0455", "desc": "Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.", "poc": ["http://packetstormsecurity.com/files/172674/Bumsys-Business-Management-System-1.0.3-beta-Shell-Upload.html", "https://huntr.dev/bounties/b5e9c578-1a33-4745-bf6b-e7cdb89793f7", "https://github.com/ctflearner/ctflearner"]}, {"cve": "CVE-2023-52271", "desc": "The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via an IOCTL (which will be named at a later time).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51656", "desc": "Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4.Users are recommended to upgrade to version 1.2.2, which fixes the issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49373", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.", "poc": ["https://github.com/li-yu320/cms/blob/main/There%20is%20a%20CSRF%20at%20the%20deletion%20point%20of%20the%20broadcast%20image.md"]}, {"cve": "CVE-2023-3425", "desc": "Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23826", "desc": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Arsham Mirshah Add Posts to Pages plugin <=\u00a01.4.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32292", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GetButton Chat Button by GetButton.Io plugin <=\u00a01.8.9.4 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30013", "desc": "TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the \"command\" parameter.", "poc": ["http://packetstormsecurity.com/files/174799/TOTOLINK-Wireless-Routers-Remote-Command-Execution.html", "https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/2", "https://github.com/h00die-gr3y/Metasploit"]}, {"cve": "CVE-2023-24797", "desc": "D-Link DIR882 DIR882A1_FW110B02 was discovered to contain a stack overflow in the sub_48AC20 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/D-link/blob/main/Dir882/1/1.md"]}, {"cve": "CVE-2023-41887", "desc": "OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.", "poc": ["https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-p3r5-x3hr-gpg5", "https://github.com/nbxiglk0/nbxiglk0"]}, {"cve": "CVE-2023-20860", "desc": "Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using \"**\" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/DrC0okie/HEIG_SLH_Labo1", "https://github.com/Dzmitry-Basiachenka/dist-foreign-aliakh", "https://github.com/Threekiii/Awesome-POC", "https://github.com/Threekiii/CVE", "https://github.com/ax1sX/SpringSecurity", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/fernandoreb/dependency-check-springboot", "https://github.com/hinat0y/Dataset1", "https://github.com/hinat0y/Dataset10", "https://github.com/hinat0y/Dataset11", "https://github.com/hinat0y/Dataset12", "https://github.com/hinat0y/Dataset2", "https://github.com/hinat0y/Dataset3", "https://github.com/hinat0y/Dataset4", "https://github.com/hinat0y/Dataset5", "https://github.com/hinat0y/Dataset6", "https://github.com/hinat0y/Dataset7", "https://github.com/hinat0y/Dataset8", "https://github.com/hinat0y/Dataset9", "https://github.com/limo520/CVE-2023-20860", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5047", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DRD Fleet Leasing DRDrive allows SQL Injection.This issue affects DRDrive: before 20231006.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45753", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Gilles Dumas which template file plugin <=\u00a04.6.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6159", "desc": "An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a `Cargo.toml` containing maliciously crafted input.", "poc": ["https://github.com/0xfschott/CVE-search"]}, {"cve": "CVE-2023-21891", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). Supported versions that are affected are 5.9.0.0.0 and 6.4.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-34153", "desc": "A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.", "poc": ["https://github.com/ImageMagick/ImageMagick/issues/6338"]}, {"cve": "CVE-2023-35863", "desc": "In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.", "poc": ["https://ctrl-c.club/~blue/nfsdk.html", "https://www.michaelrowley.dev/research/posts/nfsdk/nfsdk.html"]}, {"cve": "CVE-2023-22047", "desc": "Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-27571", "desc": "An issue was discovered in DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10. The troubleshooting_logs_download.php log file download functionality does not check the session cookie. Thus, an attacker can download all log files.", "poc": ["https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-arris-dg3450-cable-gateway/"]}, {"cve": "CVE-2023-37771", "desc": "Art Gallery Management System v1.0 contains a SQL injection vulnerability via the cid parameter at /agms/product.php.", "poc": ["https://github.com/anky-123/CVE-2023-37771", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4297", "desc": "The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.", "poc": ["https://wpscan.com/vulnerability/9ff85b06-819c-459e-90a9-6151bfd70978"]}, {"cve": "CVE-2023-1107", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.", "poc": ["https://huntr.dev/bounties/4b880868-bd28-4fd0-af56-7686e55d3762"]}, {"cve": "CVE-2023-27892", "desc": "Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the hardware wallet.", "poc": ["https://blog.inhq.net/posts/keepkey-CVE-2023-27892/"]}, {"cve": "CVE-2023-33787", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.", "poc": ["https://github.com/anhdq201/netbox/issues/6"]}, {"cve": "CVE-2023-27781", "desc": "jpegoptim v1.5.2 was discovered to contain a heap overflow in the optimize function at jpegoptim.c.", "poc": ["https://github.com/tjko/jpegoptim/issues/132"]}, {"cve": "CVE-2023-43123", "desc": "On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems.The method File.createTempFile on unix-like systems creates a file with predefined name (so easily identifiable) and by default will create this file with the permissions -rw-r--r--. Thus, if sensitive information is written to this file, other local users can read this information.File.createTempFile(String, String) will create a temporary file in the system temporary directory if the 'java.io.tmpdir' system property is not explicitly set. This affects the class\u00a0 https://github.com/apache/storm/blob/master/storm-core/src/jvm/org/apache/storm/utils/TopologySpoutLag.java#L99 \u00a0and was introduced by\u00a0 https://issues.apache.org/jira/browse/STORM-3123 In practice, this has a very limited impact as this class is used only if\u00a0ui.disable.spout.lag.monitoring is set to false, but its value is true by default.Moreover, the temporary file gets deleted soon after its creation.The solution is to use\u00a0 Files.createTempFile https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/nio/file/Files.html#createTempFile(java.lang.String,java.lang.String,java.nio.file.attribute.FileAttribute...) \u00a0instead.We recommend that all users upgrade to the latest version of Apache Storm.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6271", "desc": "The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups.", "poc": ["https://research.cleantalk.org/cve-2023-6271-backup-migration-unauth-sensitive-data-exposure-to-full-control-of-the-site-poc-exploit", "https://wpscan.com/vulnerability/7ac217db-f332-404b-a265-6dc86fe747b9"]}, {"cve": "CVE-2023-40124", "desc": "In multiple locations, there is a possible cross-user read due to a confused deputy. This could lead to local information disclosure of photos or other images with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-4430", "desc": "Use after free in Vulkan in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36485", "desc": "The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1384", "desc": "The setMediaSource function on the amzn.thin.pl service does not sanitize the \"source\" parameter allowing for arbitrary javascript code to be runThis issue affects:Amazon Fire TV Stick 3rd gen\u00a0versions prior to 6.2.9.5.Insignia TV with FireOS\u00a0versions prior to 7.6.3.3.", "poc": ["https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/"]}, {"cve": "CVE-2023-2507", "desc": "CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker.This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.", "poc": ["https://fluidattacks.com/advisories/maiden/"]}, {"cve": "CVE-2023-1086", "desc": "The Preview Link Generator WordPress plugin before 1.0.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/e2bda716-76dc-4a26-b26a-7a2a764757b0"]}, {"cve": "CVE-2023-24523", "desc": "An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted ConfigureOutsideDiscovery request with an operating system command which will be executed with administrator privileges.\u00a0 The OS command can read or modify any user or system data and can make the system unavailable.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-0336", "desc": "The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.", "poc": ["https://wpscan.com/vulnerability/ac74df9a-6fbf-4411-a501-97eba1ad1895"]}, {"cve": "CVE-2023-5297", "desc": "A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beifen. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240927.", "poc": ["https://vuldb.com/?id.240927"]}, {"cve": "CVE-2023-43877", "desc": "Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fields in the Administration menu.", "poc": ["https://github.com/sromanhu/CVE-2023-43878-RiteCMS-Stored-XSS---MainMenu/blob/main/README.md", "https://github.com/sromanhu/RiteCMS-Stored-XSS---Home", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43877-RiteCMS-Stored-XSS---Home"]}, {"cve": "CVE-2023-27014", "desc": "Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_46AC38 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC10/10/10.md"]}, {"cve": "CVE-2023-6014", "desc": "An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.", "poc": ["https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4"]}, {"cve": "CVE-2023-28819", "desc": "Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40137", "desc": "In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"]}, {"cve": "CVE-2023-45273", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Matt McKenny Stout Google Calendar plugin <=\u00a01.2.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36121", "desc": "Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project.", "poc": ["https://www.chtsecurity.com/news/0a4743a5-491e-4685-95ee-df8316ab5284", "https://www.exploit-db.com/exploits/51449"]}, {"cve": "CVE-2023-46350", "desc": "SQL injection vulnerability in InnovaDeluxe \"Manufacturer or supplier alphabetical search\" (idxrmanufacturer) module for PrestaShop versions 2.0.4 and before, allows remote attackers to escalate privileges and obtain sensitive information via the methods IdxrmanufacturerFunctions::getCornersLink, IdxrmanufacturerFunctions::getManufacturersLike and IdxrmanufacturerFunctions::getSuppliersLike.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44365", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25136", "desc": "OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\"", "poc": ["http://www.openwall.com/lists/oss-security/2023/02/13/1", "http://www.openwall.com/lists/oss-security/2023/02/22/1", "https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/", "https://news.ycombinator.com/item?id=34711565", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Business1sg00d/CVE-2023-25136", "https://github.com/CVEDB/PoC-List", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/Christbowel/CVE-2023-25136", "https://github.com/H4K6/CVE-2023-25136", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/adhikara13/CVE-2023-25136", "https://github.com/aneasystone/github-trending", "https://github.com/axylisdead/CVE-2023-25136_POC", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hktalent/TOP", "https://github.com/jfrog/jfrog-CVE-2023-25136-OpenSSH_Double-Free", "https://github.com/k0mi-tg/CVE-POC", "https://github.com/malvika-thakur/CVE-2023-25136", "https://github.com/manas3c/CVE-POC", "https://github.com/nhakobyan685/CVE-2023-25136", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile", "https://github.com/ticofookfook/CVE-2023-25136", "https://github.com/whoforget/CVE-POC", "https://github.com/youwizard/CVE-POC", "https://github.com/zacharimayer/ssh-exploit"]}, {"cve": "CVE-2023-6538", "desc": "SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or combined Server+Storage administrative roles are able to access SMU configuration backup, that would normally be barred to those specific administrative roles.", "poc": ["https://github.com/Arszilla/CVE-2023-5808", "https://github.com/Arszilla/CVE-2023-6538", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5714", "desc": "The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data key specs.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45182", "desc": "IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow gaining access to the encrypted password, a local attacker could exploit this vulnerability to obtain the password to other systems. IBM X-Force ID: 268265.", "poc": ["https://github.com/DojoSecurity/DojoSecurity", "https://github.com/afine-com/CVE-2023-45182", "https://github.com/afine-com/research", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-52474", "desc": "In the Linux kernel, the following vulnerability has been resolved:IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requestshfi1 user SDMA request processing has two bugs that can cause datacorruption for user SDMA requests that have multiple payload iovecswhere an iovec other than the tail iovec does not run up to the pageboundary for the buffer pointed to by that iovec.aHere are the specific bugs:1. user_sdma_txadd() does not use struct user_sdma_iovec->iov.iov_len. Rather, user_sdma_txadd() will add up to PAGE_SIZE bytes from iovec to the packet, even if some of those bytes are past iovec->iov.iov_len and are thus not intended to be in the packet.2. user_sdma_txadd() and user_sdma_send_pkts() fail to advance to the next iovec in user_sdma_request->iovs when the current iovec is not PAGE_SIZE and does not contain enough data to complete the packet. The transmitted packet will contain the wrong data from the iovec pages.This has not been an issue with SDMA packets from hfi1 Verbs or PSM2because they only produce iovecs that end short of PAGE_SIZE as the tailiovec of an SDMA request.Fixing these bugs exposes other bugs with the SDMA pin cache(struct mmu_rb_handler) that get in way of supporting user SDMA requestswith multiple payload iovecs whose buffers do not end at PAGE_SIZE. Sothis commit fixes those issues as well.Here are the mmu_rb_handler bugs that non-PAGE_SIZE-end multi-iovecpayload user SDMA requests can hit:1. Overlapping memory ranges in mmu_rb_handler will result in duplicate pinnings.2. When extending an existing mmu_rb_handler entry (struct mmu_rb_node), the mmu_rb code (1) removes the existing entry under a lock, (2) releases that lock, pins the new pages, (3) then reacquires the lock to insert the extended mmu_rb_node. If someone else comes in and inserts an overlapping entry between (2) and (3), insert in (3) will fail. The failure path code in this case unpins _all_ pages in either the original mmu_rb_node or the new mmu_rb_node that was inserted between (2) and (3).3. In hfi1_mmu_rb_remove_unless_exact(), mmu_rb_node->refcount is incremented outside of mmu_rb_handler->lock. As a result, mmu_rb_node could be evicted by another thread that gets mmu_rb_handler->lock and checks mmu_rb_node->refcount before mmu_rb_node->refcount is incremented.4. Related to #2 above, SDMA request submission failure path does not check mmu_rb_node->refcount before freeing mmu_rb_node object. If there are other SDMA requests in progress whose iovecs have pointers to the now-freed mmu_rb_node(s), those pointers to the now-freed mmu_rb nodes will be dereferenced when those SDMA requests complete.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4068", "desc": "Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33888", "desc": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4537", "desc": "Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.This issue affects ERP XL: from 2020.2.2 through 2023.2.", "poc": ["https://github.com/defragmentator/mitmsqlproxy"]}, {"cve": "CVE-2023-29162", "desc": "Improper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a privileged user to potentially enable escalation of privilege via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23490", "desc": "The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json' action.", "poc": ["https://www.tenable.com/security/research/tra-2023-2", "https://github.com/ARPSyndicate/cvemon", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-49994", "desc": "Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.", "poc": ["https://github.com/espeak-ng/espeak-ng/issues/1823"]}, {"cve": "CVE-2023-36281", "desc": "An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a template.", "poc": ["https://github.com/miguelc49/CVE-2023-36281-1", "https://github.com/miguelc49/CVE-2023-36281-2", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tagomaru/CVE-2023-36281"]}, {"cve": "CVE-2023-52341", "desc": "In Plaintext COUNTER CHECK message accepted before AS security activation, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29839", "desc": "A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function.", "poc": ["https://github.com/jichngan/CVE-2023-29839", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-36460", "desc": "Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51388", "desc": "Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/luelueking/luelueking"]}, {"cve": "CVE-2023-41710", "desc": "User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/176422/OX-App-Suite-7.10.6-Access-Control-Cross-Site-Scripting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49982", "desc": "Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Administrative actions, including adding and deleting user accounts.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49982", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-37635", "desc": "UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.", "poc": ["https://github.com/mokrani-zahir/stock"]}, {"cve": "CVE-2023-31071", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yannick Lefebvre Modal Dialog plugin <=\u00a03.5.14 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-2164", "desc": "An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/407783"]}, {"cve": "CVE-2023-5892", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.", "poc": ["https://huntr.com/bounties/16719252-d88d-43cc-853a-24ff75a067d8"]}, {"cve": "CVE-2023-23128", "desc": "** DISPUTED **Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and that there is no risk from this behavior. The vulnerability report is thus not valid.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hktalent/TOP", "https://github.com/l00neyhacker/CVE-2023-23128"]}, {"cve": "CVE-2023-38773", "desc": "SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the /QueryView.php.", "poc": ["https://github.com/0x72303074/CVE-Disclosures"]}, {"cve": "CVE-2023-2874", "desc": "A vulnerability, which was classified as problematic, has been found in Twister Antivirus 8. This issue affects the function 0x804f2158/0x804f2154/0x804f2150/0x804f215c/0x804f2160/0x80800040/0x804f214c/0x804f2148/0x804f2144/0x801120e4/0x804f213c/0x804f2140 in the library filppd.sys of the component IoControlCode Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-229853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2874", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-37929", "desc": "The buffer overflow vulnerability in the CGI program of the VMG3625-T50B firmware version V5.50(ABPM.8)C0 could allow an authenticated remote attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.", "poc": ["https://github.com/xxy1126/Vuln"]}, {"cve": "CVE-2023-3247", "desc": "In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.", "poc": ["https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw"]}, {"cve": "CVE-2023-6260", "desc": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Brivo ACS100, ACS300 allows OS Command Injection, Bypassing Physical Security.This issue affects ACS100 (Network Adjacent Access), ACS300 (Physical Access): from 5.2.4 before 6.2.4.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24330", "desc": "Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbitrary commands via crafted POST request to /HNAP1/.", "poc": ["https://github.com/caoyebo/CVE/tree/main/dlink%20882%20-%20CVE-2023-24330"]}, {"cve": "CVE-2023-4781", "desc": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.", "poc": ["https://github.com/vim/vim/commit/f6d28fe2c95c678cc3202cc5dc825a3fcc709e93", "https://huntr.dev/bounties/c867eb0a-aa8b-4946-a621-510350673883"]}, {"cve": "CVE-2023-21889", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3777", "desc": "A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.", "poc": ["http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html", "http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html", "https://github.com/kylebuch8/vite-project-pfereact"]}, {"cve": "CVE-2023-21948", "desc": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: Core). The supported version that is affected is 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-5825", "desc": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path and cause the server to exhaust all available memory through an infinite loop and cause Denial of Service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38546", "desc": "This flaw allows an attacker to insert cookies at will into a running programusing libcurl, if the specific series of conditions are met.libcurl performs transfers. In its API, an application creates \"easy handles\"that are the individual handles for single transfers.libcurl provides a function call that duplicates en easy handle called[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).If a transfer has cookies enabled when the handle is duplicated, thecookie-enable state is also cloned - but without cloning the actualcookies. If the source handle did not read any cookies from a specific file ondisk, the cloned version of the handle would instead store the file name as`none` (using the four ASCII letters, no quotes).Subsequent use of the cloned handle that does not explicitly set a source toload cookies from would then inadvertently load cookies from a file named`none` - if such a file exists and is readable in the current directory of theprogram using libcurl. And if using the correct file format of course.", "poc": ["https://github.com/alex-grandson/docker-python-example", "https://github.com/fokypoky/places-list", "https://github.com/malinkamedok/devops_sandbox"]}, {"cve": "CVE-2023-43357", "desc": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component.", "poc": ["https://github.com/sromanhu/CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut"]}, {"cve": "CVE-2023-51091", "desc": "Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler.", "poc": ["https://github.com/GD008/TENDA/blob/main/M3/cookie/M3_cookie.md"]}, {"cve": "CVE-2023-42633", "desc": "In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41080", "desc": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.The vulnerability is limited to the ROOT (default) web application.", "poc": ["https://github.com/muneebaashiq/MBProjects", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/seal-community/patches", "https://github.com/shiomiyan/CVE-2023-41080"]}, {"cve": "CVE-2023-20760", "desc": "In apu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629578; Issue ID: ALPS07629578.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5217", "desc": "Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/Jereanny14/jereanny14.github.io", "https://github.com/Keeper-Security/gitbook-release-notes", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Threekiii/CVE", "https://github.com/Trinadh465/platform_external_libvpx_v1.4.0_CVE-2023-5217", "https://github.com/Trinadh465/platform_external_libvpx_v1.8.0_CVE-2023-5217", "https://github.com/UT-Security/cve-2023-5217-poc", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/wrv/cve-2023-5217-poc"]}, {"cve": "CVE-2023-51767", "desc": "OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41640", "desc": "An improper error handling vulnerability in the component ErroreNonGestito.aspx of GruppoSCAI RealGimm 1.1.37p38 allows attackers to obtain sensitive technical information via a crafted SQL query.", "poc": ["https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41640%20%7C%20RealGimm%20-%20Information%20disclosure.md", "https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20Information%20disclosure.md"]}, {"cve": "CVE-2023-39523", "desc": "ScanCode.io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible command injection vulnerability in the docker fetch process as it allows to append malicious commands in the `docker_reference` parameter.In the function `scanpipe/pipes/fetch.py:fetch_docker_image` the parameter `docker_reference` is user controllable. The `docker_reference` variable is then passed to the vulnerable function `get_docker_image_platform`. However, the `get_docker_image_plaform` function constructs a shell command with the passed `docker_reference`. The `pipes.run_command` then executes the shell command without any prior sanitization, making the function vulnerable to command injections. A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of `docker://;`, it would allow appending malicious commands.Version 32.5.1 contains a patch for this issue. The `docker_reference` input should be sanitized to avoid command injections and, as a workaround, one may avoid creating commands with user controlled input directly.", "poc": ["https://github.com/nexB/scancode.io/security/advisories/GHSA-2ggp-cmvm-f62f"]}, {"cve": "CVE-2023-5473", "desc": "Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36632", "desc": "** DISPUTED ** The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.", "poc": ["https://github.com/Daybreak2019/PoC_python3.9_Vul/blob/main/RecursionError-email.utils.parseaddr.py", "https://github.com/toxyl/lscve"]}, {"cve": "CVE-2023-34795", "desc": "xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.", "poc": ["https://github.com/brechtsanders/xlsxio/issues/121", "https://github.com/xf1les/cve-advisories"]}, {"cve": "CVE-2023-7250", "desc": "A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-47628", "desc": "DataHub is an open-source metadata platform. DataHub Frontend's sessions are configured using Play Framework's default settings for stateless session which do not set an expiration time for a cookie. Due to this, if a session cookie were ever leaked, it would be valid forever. DataHub uses a stateless session cookie that is not invalidated on logout, it is just removed from the browser forcing the user to login again. However, if an attacker extracted a cookie from an authenticated user it would continue to be valid as there is no validation on a time window the session token is valid for due to a combination of the usage of LegacyCookiesModule from Play Framework and using default settings which do not set an expiration time. All DataHub instances prior to the patch that have removed the datahub user, but not the default policies applying to that user are affected. Users are advised to update to version 0.12.1 which addresses the issue. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/datahub-project/datahub/security/advisories/GHSA-75p8-rgh2-r9mx"]}, {"cve": "CVE-2023-38857", "desc": "Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stcoin function in mp4read.c.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3294", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.", "poc": ["https://huntr.dev/bounties/9d308ebb-4289-411f-ac22-990383d98932"]}, {"cve": "CVE-2023-26435", "desc": "It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read permissions of the open-xchange system user. This was limited to specific file-types, like images. We have improved existing content filters and validators to avoid including any local resources. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html"]}, {"cve": "CVE-2023-21753", "desc": "Event Tracing for Windows Information Disclosure Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-47257", "desc": "ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.", "poc": ["https://web.archive.org/web/20240208140218/https://gotham-security.com/screenconnect-cve-2023-47256"]}, {"cve": "CVE-2023-1934", "desc": "The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerability. Present within the hitlogcsv.jsp endpoint, this security flaw permits unauthenticated attackers to engage with the underlying database seamlessly and passively. Consequently, malicious actors could gain access to vital information, such as Industrial Control System (ICS) and OT data, alongside other sensitive records like SMS and SMS Logs. The unauthorized database access exposes compromised systems to potential manipulation or breach of essential infrastructure data, highlighting the severity of this vulnerability.", "poc": ["http://packetstormsecurity.com/files/172511/PnPSCADA-2.x-SQL-Injection.html"]}, {"cve": "CVE-2023-1277", "desc": "A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222600.", "poc": ["https://github.com/cn-lwj/vuldb/blob/master/kylin-system-updater_vuln.md", "https://vuldb.com/?id.222600"]}, {"cve": "CVE-2023-35133", "desc": "An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.", "poc": ["https://github.com/kip93/kip93"]}, {"cve": "CVE-2023-20180", "desc": "A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\nThis vulnerability is due to insufficient CSRF protections for the web interface on an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions. These actions could include joining meetings and scheduling training sessions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27396", "desc": "FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues -- (1)Plaintext communication, and (2)No authentication required. When FINS messages are intercepted, the contents may be retrieved. When arbitrary FINS messages are injected, any commands may be executed on, or the system information may be retrieved from, the affected device. Affected products and versions are as follows: SYSMAC CS-series CPU Units, all versions, SYSMAC CJ-series CPU Units, all versions, SYSMAC CP-series CPU Units, all versions, SYSMAC NJ-series CPU Units, all versions, SYSMAC NX1P-series CPU Units, all versions, SYSMAC NX102-series CPU Units, all versions, and SYSMAC NX7 Database Connection CPU Units (Ver.1.16 or later)", "poc": ["https://www.fa.omron.co.jp/product/vulnerability/OMSR-2023-003_ja.pdf", "https://www.ia.omron.com/product/vulnerability/OMSR-2023-003_en.pdf"]}, {"cve": "CVE-2023-34111", "desc": "The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of `${{ github.event.pull_request.title }}` in a bash command within the GitHub workflow. Attackers can inject malicious commands which will be executed by the workflow. This happens because `${{ github.event.pull_request.title }}` is directly passed to bash command on like 25 of the workflow. This may allow an attacker to gain access to secrets which the github action has access to or to otherwise make use of the compute resources.", "poc": ["https://github.com/taosdata/grafanaplugin/security/advisories/GHSA-23wp-p848-hcgr", "https://securitylab.github.com/research/github-actions-untrusted-input/"]}, {"cve": "CVE-2023-25110", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_gre function with the remote_virtual_ip variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-4538", "desc": "The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations. This could allow an attacker with access to that table to retrieve plain text passwords.This issue affects ERP XL: from 2020.2.2 through 2023.2.", "poc": ["https://github.com/defragmentator/mitmsqlproxy"]}, {"cve": "CVE-2023-1524", "desc": "The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's password.", "poc": ["https://wpscan.com/vulnerability/3802d15d-9bfd-4762-ab8a-04475451868e"]}, {"cve": "CVE-2023-52139", "desc": "Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).", "poc": ["https://github.com/misskey-dev/misskey/security/advisories/GHSA-7pxq-6xx9-xpgm"]}, {"cve": "CVE-2023-1274", "desc": "The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks", "poc": ["https://wpscan.com/vulnerability/267acb2c-1a95-487f-a714-516de05d2b2f"]}, {"cve": "CVE-2023-33281", "desc": "** DISPUTED ** The remote keyfob system on Nissan Sylphy Classic 2021 sends the same RF signal for each door-open request, which allows for a replay attack. NOTE: the vendor's position is that this cannot be reproduced with genuine Nissan parts: for example, the combination of keyfob and door handle shown in the exploit demonstration does not match any technology that Nissan provides to customers.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves"]}, {"cve": "CVE-2023-28393", "desc": "A stack-based buffer overflow vulnerability exists in the tif_processing_dng_channel_count functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1742"]}, {"cve": "CVE-2023-23302", "desc": "The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.", "poc": ["https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23302.md"]}, {"cve": "CVE-2023-31973", "desc": "** DISPUTED ** yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.", "poc": ["https://github.com/yasm/yasm/issues/207"]}, {"cve": "CVE-2023-6833", "desc": "Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator allows local users to gain sensitive information.This issue affects Hitachi Ops Center Administrator: before 11.0.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1774", "desc": "When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-52880", "desc": "In the Linux kernel, the following vulnerability has been resolved:tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldiscAny unprivileged user can attach N_GSM0710 ldisc, but it requiresCAP_NET_ADMIN to create a GSM network anyway.Require initial namespace CAP_NET_ADMIN to do that.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32669", "desc": "Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5481", "desc": "Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49546", "desc": "Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49546", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2760", "desc": "An SQL injection vulnerability exists in TapHome core HandleMessageUpdateDevicePropertiesRequest function before version 2023.2, allowing low privileged users to inject arbitrary SQL directives into an SQL query and execute arbitrary SQL commands and get full reading access. This may also lead to limited write access and temporary Denial-of-Service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44400", "desc": "Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.", "poc": ["https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g"]}, {"cve": "CVE-2023-26121", "desc": "All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062", "https://github.com/exoad/ProgrammingDisc"]}, {"cve": "CVE-2023-50881", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager \u2013 Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager \u2013 Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36665", "desc": "\"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.", "poc": ["https://www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665", "https://github.com/JGedff/Firebase-NodeJs", "https://github.com/git-kick/ioBroker.e3dc-rscp", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-39002", "desc": "A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.", "poc": ["https://logicaltrust.net/blog/2023/08/opnsense.html"]}, {"cve": "CVE-2023-29048", "desc": "A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26564", "desc": "The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker can list files within a directory, download any file, or upload any file to any directory accessible by the web server.", "poc": ["https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565"]}, {"cve": "CVE-2023-36439", "desc": "Microsoft Exchange Server Remote Code Execution Vulnerability", "poc": ["https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-31059", "desc": "Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php.", "poc": ["https://cybir.com/2023/cve/poc-repetier-server-140/"]}, {"cve": "CVE-2023-45879", "desc": "GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.", "poc": ["https://herolab.usd.de/security-advisories/usd-2023-0019/"]}, {"cve": "CVE-2023-50358", "desc": "An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.We have already fixed the vulnerability in the following versions:QTS 5.1.5.2645 build 20240116 and laterQTS 4.5.4.2627 build 20231225 and laterQTS 4.3.6.2665 build 20240131 and laterQTS 4.3.4.2675 build 20240131 and laterQTS 4.3.3.2644 build 20240131 and laterQTS 4.2.6 build 20240131 and laterQuTS hero h5.1.5.2647 build 20240118 and laterQuTS hero h4.5.4.2626 build 20231225 and laterQuTScloud c5.1.5.2651 and later", "poc": ["https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2024/2024-213941-1032", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/greandfather/CVE-2023-50358-POC", "https://github.com/greandfather/CVE-2023-50358-POC-RCE", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-46580", "desc": "Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php component.", "poc": ["https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46580-Code-Projects-Inventory-Management-1.0-Stored-Cross-Site-Scripting-Vulnerability.md", "https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0"]}, {"cve": "CVE-2023-1389", "desc": "TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.", "poc": ["http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.html", "https://www.tenable.com/security/research/tra-2023-11", "https://github.com/Co5mos/nuclei-tps", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Terminal1337/CVE-2023-1389", "https://github.com/Voyag3r-Security/CVE-2023-1389", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/timb-machine/linux-malware"]}, {"cve": "CVE-2023-6013", "desc": "H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.", "poc": ["https://huntr.com/bounties/9881569f-dc2a-437e-86b0-20d4b70ae7af"]}, {"cve": "CVE-2023-32795", "desc": "Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49188", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.This issue affects Track Geolocation Of Users Using Contact Form 7: from n/a through 1.4.", "poc": ["https://github.com/parkttule/parkttule"]}, {"cve": "CVE-2023-3262", "desc": "The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database.A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records.", "poc": ["https://github.com/PuguhDy/CVE-Root-Ubuntu", "https://github.com/SanjayRagavendar/Ubuntu-GameOver-Lay", "https://github.com/SanjayRagavendar/UbuntuPrivilegeEscalationV1"]}, {"cve": "CVE-2023-28287", "desc": "Microsoft Publisher Remote Code Execution Vulnerability", "poc": ["https://github.com/em1ga3l/cve-msrc-extractor"]}, {"cve": "CVE-2023-36816", "desc": "2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3.", "poc": ["https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q"]}, {"cve": "CVE-2023-22306", "desc": "An OS command injection vulnerability exists in the libzebra.so bridge_group functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1698"]}, {"cve": "CVE-2023-29574", "desc": "Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component.", "poc": ["https://github.com/axiomatic-systems/Bento4/issues/841", "https://github.com/z1r00/fuzz_vuln/blob/main/Bento4/mp42avc/readme.md", "https://github.com/z1r00/fuzz_vuln"]}, {"cve": "CVE-2023-31497", "desc": "Incorrect access control in Quick Heal Technologies Limited Seqrite Endpoint Security (EPS) all versions prior to v8.0 allows attackers to escalate privileges to root via supplying a crafted binary to the target system.", "poc": ["https://github.com/0xInfection/EPScalate", "https://github.com/0xInfection/EPScalate", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-43746", "desc": "When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system.\u00a0 A successful exploit can allow the attacker to cross a security boundary.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38022", "desc": "An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a local attacker to access unauthorized information. This relates to strlen and sgx_is_within_user.", "poc": ["https://jovanbulck.github.io/files/ccs19-tale.pdf"]}, {"cve": "CVE-2023-27321", "desc": "OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20505.", "poc": ["https://github.com/claroty/opcua-exploit-framework"]}, {"cve": "CVE-2023-0503", "desc": "The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/3cb148fb-1f30-4316-a421-10da51d849f3"]}, {"cve": "CVE-2023-2812", "desc": "The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/7de4c313-359e-4450-85f5-d29f3c2f046a"]}, {"cve": "CVE-2023-43770", "desc": "Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/knight0x07/CVE-2023-43770-PoC", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/s3cb0y/CVE-2023-43770-POC"]}, {"cve": "CVE-2023-48393", "desc": "Kaifa Technology WebITR is an online attendance system. A remote attacker with regular user privilege can obtain partial sensitive system information from error message.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21707", "desc": "Microsoft Exchange Server Remote Code Execution Vulnerability", "poc": ["https://github.com/FDlucifer/Proxy-Attackchain", "https://github.com/N1k0la-T/CVE-2023-21707", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/f0ur0four/Insecure-Deserialization", "https://github.com/hktalent/bug-bounty", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-46179", "desc": "IBM Sterling Secure Proxy 6.0.3 and 6.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 269683.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21963", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 5.7.40 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-1881", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.", "poc": ["https://huntr.dev/bounties/d5ebc2bd-8638-41c4-bf72-7c906c601344", "https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-31474", "desc": "An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name.", "poc": ["https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md"]}, {"cve": "CVE-2023-27785", "desc": "An issue found in TCPreplay TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the parse endpoints function.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Marsman1996/pocs"]}, {"cve": "CVE-2023-21105", "desc": "In multiple functions of ChooserActivity.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261036568", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-48611", "desc": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35743", "desc": "D-Link DAP-2622 DDP Configuration Restore Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.. Was ZDI-CAN-20070.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0783", "desc": "A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220641 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.220641"]}, {"cve": "CVE-2023-0314", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.", "poc": ["https://huntr.dev/bounties/eac0a9d7-9721-4191-bef3-d43b0df59c67"]}, {"cve": "CVE-2023-29360", "desc": "Microsoft Streaming Service Elevation of Privilege Vulnerability", "poc": ["https://github.com/Nero22k/cve-2023-29360", "https://github.com/Ostorlab/KEV", "https://github.com/cvefeed/cvefeed.io", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-36631", "desc": "** DISPUTED ** Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Windows Firewall restrictions via the user interface's rules tab. NOTE: the vendor's perspective is \"this is intended behavior as the application can be locked using a password.\"", "poc": ["https://www.bencteux.fr/posts/malwarebytes_wfc/"]}, {"cve": "CVE-2023-30185", "desc": "CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \\attachment\\SystemAttachmentServices.php.", "poc": ["https://github.com/c7w1n/CVE-2023-30185/blob/main/CVE-2023-30185.md", "https://github.com/c7w1n/CVE-2023-30185", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-32309", "desc": "PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `--8<--\"/etc/passwd\"` or `--8<--\"/proc/self/environ\"` the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to render the content of a file outside the specified base paths: `--8<-- \"../../../../etc/passwd\"`. Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to Directory Traversal. The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in snippets.py. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. It is never recommended to use Snippets to process user-facing, dynamic content. It is designed to process known content on the backend under the control of the host, but if someone were to accidentally enable it for user-facing content, undesired information could be exposed. This issue has been addressed in version 10.0. Users are advised to upgrade. Users unable to upgrade may restrict relative paths by filtering input.", "poc": ["https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-jh85-wwv9-24hv", "https://github.com/MaxymVlasov/renovate-vuln-alerts", "https://github.com/k3vg3n/MDN", "https://github.com/renovate-reproductions/22747"]}, {"cve": "CVE-2023-0271", "desc": "The WP Font Awesome WordPress plugin before 1.7.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/fd7aaf06-4be7-48d6-83a1-cd5cd6c3d9c2"]}, {"cve": "CVE-2023-2654", "desc": "The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/506ecee9-8e42-46de-9c5c-fc252ab2646e"]}, {"cve": "CVE-2023-5754", "desc": "Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"]}, {"cve": "CVE-2023-43642", "desc": "snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.", "poc": ["https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv"]}, {"cve": "CVE-2023-1391", "desc": "A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/ab.php. The manipulation of the argument img leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222978 is the identifier assigned to this vulnerability.", "poc": ["https://blog.csdn.net/Dwayne_Wade/article/details/129526901"]}, {"cve": "CVE-2023-41291", "desc": "A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.We have already fixed the vulnerability in the following version:QuFirewall 2.4.1 ( 2024/02/01 ) and later", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26841", "desc": "A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in.", "poc": ["https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26841", "https://github.com/10splayaSec/CVE-Disclosures", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-4128", "desc": "** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record is a duplicate of CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Notes: All CVE users should reference CVE-2023-4206, CVE-2023-4207, CVE-2023-4208 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.", "poc": ["http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html", "https://github.com/Trinadh465/linux-4.1.15_CVE-2023-4128", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nidhi7598/linux-4.19.72_CVE-2023-4128", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3967", "desc": "Allocation of Resources Without Limits or Throttling vulnerability in Hitachi Ops Center Common Services on Linux allows DoS.This issue affects Hitachi Ops Center Common Services: before 10.9.3-00.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43354", "desc": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component.", "poc": ["https://github.com/sromanhu/CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension"]}, {"cve": "CVE-2023-50914", "desc": "A Privilege Escalation issue in the inter-process communication procedure from GOG Galaxy (Beta) 2.0.67.2 through v2.0.71.2 allows authentictaed users to change the DACL of arbitrary system directories to include Everyone full control permissions by modifying the FixDirectoryPrivileges instruction parameters sent from GalaxyClient.exe to GalaxyClientService.exe.", "poc": ["https://www.positronsecurity.com/blog/2020-08-13-gog-galaxy_client-local-privilege-escalation_deuce/", "https://github.com/anvilsecure/gog-galaxy-app-research", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28430", "desc": "OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues (types: [closed]) (i.e., when an Issue is closed). The workflow starts with full write-permissions GitHub repository token since the default workflow permissions on Organization/Repository level are set to read-write. This workflow runs the following step with data controlled by the comment `(${{ github.event.issue.title }} \u2013 the full title of the Issue)`, allowing an attacker to take over the GitHub Runner and run custom commands, potentially stealing any secret (if used), or altering the repository. This issue was found with CodeQL using javascript\u2019s Expression injection in Actions query. This issue has been addressed in the repositories github action. No actions are required by users. This issue is also tracked as `GHSL-2023-051`.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-051_React_Native_OneSignal_SDK/"]}, {"cve": "CVE-2023-27405", "desc": "A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20432)", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/dhn/dhn"]}, {"cve": "CVE-2023-36473", "desc": "Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0644", "desc": "The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/08f5089c-36f3-4d12-bca5-99cd3ae78f67"]}, {"cve": "CVE-2023-40797", "desc": "In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authentication stack overflow vulnerability.", "poc": ["https://github.com/lst-oss/Vulnerability/tree/main/Tenda/AC23/sub_4781A4"]}, {"cve": "CVE-2023-41445", "desc": "Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the index.php component.", "poc": ["https://gist.github.com/RNPG/84cac1b949bab0e4c587a668385b052d", "https://github.com/RNPG/CVEs", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1463", "desc": "Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.", "poc": ["https://huntr.dev/bounties/f6683c3b-a0f2-4615-b639-1920c8ae12e6"]}, {"cve": "CVE-2023-5917", "desc": "A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.", "poc": ["https://github.com/CP04042K/CVE", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1377", "desc": "The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/c346ff80-c16b-4219-8983-708c64fa4a61"]}, {"cve": "CVE-2023-49046", "desc": "Stack Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the devName parameter in the function formAddMacfilterRule.", "poc": ["https://github.com/Anza2001/IOT_VULN/blob/main/Tenda/AX1803/formAddMacfilterRule.md"]}, {"cve": "CVE-2023-48711", "desc": "google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the `google-translate-api-browser` package and exposing the `translateOptions` to the end user. An attacker can set a malicious `tld`, causing the application to return unsafe URLs pointing towards local resources. The `translateOptions.tld` field is not properly sanitized before being placed in the Google translate URL. This can allow an attacker with control over the `translateOptions` to set the `tld` to a payload such as `@127.0.0.1`. This causes the full URL to become `https://translate.google.@127.0.0.1/...`, where `translate.google.` is the username used to connect to localhost. An attacker can send requests within internal networks and the local host. Should any HTTPS application be present on the internal network with a vulnerability exploitable via a GET call, then it would be possible to exploit this using this vulnerability. This issue has been addressed in release version 4.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/cjvnjde/google-translate-api-browser/security/advisories/GHSA-4233-7q5q-m7p6"]}, {"cve": "CVE-2023-36936", "desc": "Cross-Site Scripting (XSS) vulnerability in PHPGurukul Online Security Guards Hiring System using PHP and MySQL 1.0 allows attackers to execute arbitrary code via a crafted payload to the search booking box.", "poc": ["https://packetstormsecurity.com"]}, {"cve": "CVE-2023-50919", "desc": "An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.", "poc": ["http://packetstormsecurity.com/files/176708/GL.iNet-Unauthenticated-Remote-Command-Execution.html"]}, {"cve": "CVE-2023-21946", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-25463", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy WP tell a friend popup form plugin <=\u00a07.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1614", "desc": "The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/56abd1e2-0ea9-47f7-9a1b-2093ac15d39c", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-5198", "desc": "An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/416957", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39317", "desc": "Multiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `string_lens` array.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31466", "desc": "An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the \"Configuration -> Compliance -> Add a new compliance report\" and \"Configuration -> Timekeeper Configuration -> Add a new source there\" screens, there are entry points to inject JavaScript code.", "poc": ["https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-31466.md"]}, {"cve": "CVE-2023-36317", "desc": "Cross Site Scripting (XSS) vulnerability in sourcecodester Student Study Center Desk Management System 1.0 allows attackers to run arbitrary code via crafted GET request to web application URL.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42138", "desc": "Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and earlier and KV REPLAY VIEWER Ver. 2.62 and earlier. If this vulnerability is exploited, information may be disclosed or arbitrary code may be executed by having a user of KV STUDIO PLAYER open a specially crafted file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45662", "desc": "stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn\u2019t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger `memcpy` out-of-bounds read because `bytes_per_pixel` used to calculate `bytes_per_row` doesn\u2019t match the real image array dimensions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1420", "desc": "The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/a9a54ee5-2b80-4f55-894c-1047030eea7f"]}, {"cve": "CVE-2023-51084", "desc": "hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method.", "poc": ["https://github.com/PoppingSnack/VulReport/issues/12"]}, {"cve": "CVE-2023-5212", "desc": "The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosting account. Version 4.9.1 originally addressed the issue, but it was reintroduced in 4.9.2 and fixed again in 4.9.3.", "poc": ["http://packetstormsecurity.com/files/175371/WordPress-AI-ChatBot-4.8.9-SQL-Injection-Traversal-File-Deletion.html"]}, {"cve": "CVE-2023-30264", "desc": "CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update.", "poc": ["https://github.com/HuBenLab/HuBenVulList/blob/main/CLTPHP6.0%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type%202.md"]}, {"cve": "CVE-2023-47039", "desc": "A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:\\ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42278", "desc": "hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().", "poc": ["https://github.com/dromara/hutool/issues/3289"]}, {"cve": "CVE-2023-1535", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.", "poc": ["https://huntr.dev/bounties/4d4b0caa-6d8c-4574-ae7e-e9ef5e2e1a40"]}, {"cve": "CVE-2023-37170", "desc": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.", "poc": ["https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_1", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48034", "desc": "An issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to both decrypt wireless keystrokes and inject arbitrary keystrokes via use of weak encryption.", "poc": ["https://github.com/aprkr/CVE-2023-48034", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1891", "desc": "The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting", "poc": ["https://wpscan.com/vulnerability/4e5d993f-cc20-4b5f-b4c8-c13004151828", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-6246", "desc": "A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.", "poc": ["http://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.html", "http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html", "http://seclists.org/fulldisclosure/2024/Feb/3", "https://www.openwall.com/lists/oss-security/2024/01/30/6", "https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt", "https://github.com/20142995/sectool", "https://github.com/YtvwlD/ele", "https://github.com/elpe-pinillo/CVE-2023-6246", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/krishnamk00/Top-10-OpenSource-News-Weekly", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5345", "desc": "A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation.In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free.We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705.", "poc": ["http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/shakyaraj9569/Documentation"]}, {"cve": "CVE-2023-0914", "desc": "Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.", "poc": ["https://huntr.dev/bounties/54d5fd76-e038-4eda-9e03-d5e95e09c0ec", "https://github.com/ARPSyndicate/cvemon", "https://github.com/bAuh0lz/Vulnerabilities"]}, {"cve": "CVE-2023-24893", "desc": "Visual Studio Code Remote Code Execution Vulnerability", "poc": ["https://github.com/gbdixg/PSMDE"]}, {"cve": "CVE-2023-1861", "desc": "The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810"]}, {"cve": "CVE-2023-51717", "desc": "Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.", "poc": ["https://dataiku.com"]}, {"cve": "CVE-2023-32629", "desc": "Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernels", "poc": ["http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html", "https://github.com/0xWhoami35/root-kernel", "https://github.com/0xsyr0/OSCP", "https://github.com/Ev3rPalestine/Analytics-HTB-Walkthrough", "https://github.com/Kiosec/Linux-Exploitation", "https://github.com/Nkipohcs/CVE-2023-2640-CVE-2023-32629", "https://github.com/OllaPapito/gameoverlay", "https://github.com/PuguhDy/CVE-Root-Ubuntu", "https://github.com/SanjayRagavendar/Ubuntu-GameOver-Lay", "https://github.com/SanjayRagavendar/UbuntuPrivilegeEscalationV1", "https://github.com/SirElmard/ethical_hacking", "https://github.com/Snoopy-Sec/Localroot-ALL-CVE", "https://github.com/ThrynSec/CVE-2023-32629-CVE-2023-2640---POC-Escalation", "https://github.com/Umutkgz/CVE-2023-32629-CVE-2023-2640-Ubuntu-Privilege-Escalation-POC", "https://github.com/brimstone/stars", "https://github.com/churamanib/p0wny-shell", "https://github.com/cyberexpertsng/Cyber-Advisory", "https://github.com/druxter-x/PHP-CVE-2023-2023-2640-POC-Escalation", "https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629", "https://github.com/giterlizzi/secdb-feeds", "https://github.com/ilviborici/ubuntu-privesc", "https://github.com/johnlettman/juju-patch-gameoverlay", "https://github.com/johnlettman/juju-scripts", "https://github.com/k4but0/Ubuntu-LPE", "https://github.com/kaotickj/Check-for-CVE-2023-32629-GameOver-lay", "https://github.com/kgwanjala/oscp-cheatsheet", "https://github.com/luanoliveira350/GameOverlayFS", "https://github.com/musorblyat/CVE-2023-2640-CVE-2023-32629", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/oscpname/OSCP_cheat", "https://github.com/revanmalang/OSCP", "https://github.com/txuswashere/OSCP", "https://github.com/vinetsuicide/CVE-2023-2640-CVE-2023-32629", "https://github.com/xS9NTX/CVE-2023-32629-CVE-2023-2640-Ubuntu-Privilege-Escalation-POC", "https://github.com/xairy/linux-kernel-exploitation", "https://github.com/xhref/OSCP"]}, {"cve": "CVE-2023-50001", "desc": "Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.", "poc": ["https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_upgradeMeshOnline/w30e_upgradeMeshOnline.md"]}, {"cve": "CVE-2023-52434", "desc": "In the Linux kernel, the following vulnerability has been resolved:smb: client: fix potential OOBs in smb2_parse_contexts()Validate offsets and lengths before dereferencing create contexts insmb2_parse_contexts().This fixes following oops when accessing invalid create contexts fromserver: BUG: unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 4a01067 P4D 4a01067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs] Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00 00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00 RSP: 0018:ffffc900007939e0 EFLAGS: 00010216 RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90 RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000 RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000 R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000 R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22 FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x181/0x480 ? search_module_extables+0x19/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x1b6/0x1c0 ? asm_exc_page_fault+0x26/0x30 ? smb2_parse_contexts+0xa0/0x3a0 [cifs] SMB2_open+0x38d/0x5f0 [cifs] ? smb2_is_path_accessible+0x138/0x260 [cifs] smb2_is_path_accessible+0x138/0x260 [cifs] cifs_is_path_remote+0x8d/0x230 [cifs] cifs_mount+0x7e/0x350 [cifs] cifs_smb3_do_mount+0x128/0x780 [cifs] smb3_get_tree+0xd9/0x290 [cifs] vfs_get_tree+0x2c/0x100 ? capable+0x37/0x70 path_mount+0x2d7/0xb80 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __x64_sys_mount+0x11a/0x150 do_syscall_64+0x47/0xf0 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f8737657b1e", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39654", "desc": "abupy up to v0.4.0 was discovered to contain a SQL injection vulnerability via the component abupy.MarketBu.ABuSymbol.search_to_symbol_dict.", "poc": ["https://github.com/Leeyangee/leeya_bug/blob/main/%5BWarning%5DSQL%20Injection%20in%20abupy%20%3C=%20v0.4.0.md"]}, {"cve": "CVE-2023-22011", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-6373", "desc": "The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the \"id\" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)", "poc": ["https://wpscan.com/vulnerability/afc11c92-a7c5-4e55-8f34-f2235438bd1b/"]}, {"cve": "CVE-2023-0479", "desc": "The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.", "poc": ["https://wpscan.com/vulnerability/50963747-ae8e-42b4-bb42-cc848be7b92e/"]}, {"cve": "CVE-2023-43534", "desc": "Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39352", "desc": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj"]}, {"cve": "CVE-2023-0157", "desc": "The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.", "poc": ["https://wpscan.com/vulnerability/8248b550-6485-4108-a701-8446ffa35f06", "https://github.com/b0marek/CVE-2023-0157", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/xu-xiang/awesome-security-vul-llm"]}, {"cve": "CVE-2023-5841", "desc": "Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX\u00a0image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions\u00a0v3.2.2 and v3.1.12 of the affected library.", "poc": ["https://takeonme.org/cves/CVE-2023-5841.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5322", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sysmanage/edit_manageadmin.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240992. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.", "poc": ["https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000%E5%AD%98%E5%9C%A8sql%E6%B3%A8%E5%85%A5:sysmanage:edit_manageadmin.php.md"]}, {"cve": "CVE-2023-0110", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/emotest1/cve_2023_0110", "https://github.com/emotest1/emo_emo"]}, {"cve": "CVE-2023-45078", "desc": "A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-51669", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artios Media Product Code for WooCommerce allows Stored XSS.This issue affects Product Code for WooCommerce: from n/a through 1.4.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2950", "desc": "Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.", "poc": ["https://huntr.dev/bounties/612d13cf-2ef9-44ea-b8fb-e797948a9a86"]}, {"cve": "CVE-2023-5485", "desc": "Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Low)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6549", "desc": "Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and\u00a0Out-Of-Bounds Memory Read", "poc": ["https://github.com/H4lo/awesome-IoT-security-article", "https://github.com/Ostorlab/KEV", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/jake-44/Research"]}, {"cve": "CVE-2023-5250", "desc": "The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.2 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files with arbitrary content can be uploaded and included. This is limited to .php files.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50852", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.This issue affects Booking Calendar | Appointment Booking | BookIt: from n/a through 2.4.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3172", "desc": "Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.", "poc": ["https://huntr.dev/bounties/e50966cd-9222-46b9-aedc-1feb3f2a0b0e"]}, {"cve": "CVE-2023-6117", "desc": "A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the\u00a0M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20856", "desc": "VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user.", "poc": ["https://github.com/thiscodecc/thiscodecc"]}, {"cve": "CVE-2023-1222", "desc": "Heap buffer overflow in Web Audio API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-22486", "desc": "cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.", "poc": ["https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p"]}, {"cve": "CVE-2023-5471", "desc": "A vulnerability, which was classified as critical, was found in codeprojects Farmacia 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument usario/senha leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241608.", "poc": ["https://vuldb.com/?id.241608"]}, {"cve": "CVE-2023-33968", "desc": "Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vulnerability that allows a user with low privileges to create or transfer tasks to any project within the software, even if they have not been invited or the project is personal. The vulnerable features are `Duplicate to project` and `Move to project`, which both utilize the `checkDestinationProjectValues()` function to check his values. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/kanboard/kanboard/security/advisories/GHSA-gf8r-4p6m-v8vr"]}, {"cve": "CVE-2023-4069", "desc": "Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/wh1ant/vulnjs"]}, {"cve": "CVE-2023-3338", "desc": "A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.", "poc": ["https://seclists.org/oss-sec/2023/q2/276", "https://github.com/TurtleARM/CVE-2023-3338-DECPwn", "https://github.com/aneasystone/github-trending", "https://github.com/johe123qwe/github-trending", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-39238", "desc": "It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value\u00a0within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.", "poc": ["https://github.com/ShielderSec/poc"]}, {"cve": "CVE-2023-25178", "desc": "Controller may be loaded with malicious firmware which could enable remote code execution.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3920", "desc": "An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/417481"]}, {"cve": "CVE-2023-32469", "desc": "Dell Precision Tower BIOS contains an Improper Input Validation vulnerability. A locally authenticated malicious user with admin privileges could potentially exploit this vulnerability to perform arbitrary code execution.", "poc": ["https://github.com/another1024/another1024", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0330", "desc": "A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.", "poc": ["https://bugzilla.redhat.com/show_bug.cgi?id=2160151"]}, {"cve": "CVE-2023-6272", "desc": "The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.", "poc": ["https://wpscan.com/vulnerability/a03243ea-fee7-46e4-8037-a228afc5297a"]}, {"cve": "CVE-2023-41362", "desc": "MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.", "poc": ["https://blog.sorcery.ie/posts/mybb_acp_rce/", "https://github.com/SorceryIE/CVE-2023-41362_MyBB_ACP_RCE", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-40877", "desc": "DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_edit.php via the title parameter.", "poc": ["https://github.com/DiliLearngent/BugReport", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31194", "desc": "An improper array index validation vulnerability exists in the GraphPlanar::Write functionality of Diagon v1.0.139. A specially crafted markdown file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1745", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1745"]}, {"cve": "CVE-2023-30743", "desc": "Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5 control allows injection of untrusted CSS. This blocks user\u2019s interaction with the application. Further, in the absence of URL validation by the application, the vulnerability could lead to the attacker reading or modifying user\u2019s information through phishing attack.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-30630", "desc": "Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible.", "poc": ["https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-52251", "desc": "An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.", "poc": ["http://packetstormsecurity.com/files/177214/Kafka-UI-0.7.1-Command-Injection.html", "https://github.com/BobTheShoplifter/CVE-2023-52251-POC", "https://github.com/BobTheShoplifter/CVE-2023-52251-POC", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27077", "desc": "Stack Overflow vulnerability found in 360 D901 allows a remote attacker to cause a Distributed Denial of Service (DDOS) via a crafted HTTP package.", "poc": ["https://github.com/B2eFly/Router/blob/main/360/360D901.md"]}, {"cve": "CVE-2023-4914", "desc": "Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1.", "poc": ["https://huntr.dev/bounties/cdd995b2-c983-428b-a73a-827b61b7c06b"]}, {"cve": "CVE-2023-34247", "desc": "Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the `@keystone-6/auth` package.", "poc": ["https://github.com/scgajge12/scgajge12.github.io"]}, {"cve": "CVE-2023-4004", "desc": "A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.", "poc": ["http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html", "http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html"]}, {"cve": "CVE-2023-1325", "desc": "The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/5f37cbf3-2388-4582-876c-6a7b0943c2a7"]}, {"cve": "CVE-2023-46331", "desc": "WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.", "poc": ["https://github.com/WebAssembly/wabt/issues/2310"]}, {"cve": "CVE-2023-6016", "desc": "An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.", "poc": ["https://huntr.com/bounties/83dd17ec-053e-453c-befb-7d6736bf1836"]}, {"cve": "CVE-2023-21666", "desc": "Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.", "poc": ["http://packetstormsecurity.com/files/172664/Qualcomm-Adreno-KGSL-Data-Leakage.html"]}, {"cve": "CVE-2023-41174", "desc": "The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40955", "desc": "A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the select parameter in models/base_client.py component.", "poc": ["https://github.com/luvsn/OdZoo/tree/main/exploits/pdm/2"]}, {"cve": "CVE-2023-4260", "desc": "Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.", "poc": ["http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html", "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gj27-862r-55wh", "https://github.com/0xdea/advisories", "https://github.com/hnsecurity/vulns"]}, {"cve": "CVE-2023-42661", "desc": "JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40186", "desc": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.", "poc": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hcj4-3c3r-5j3v"]}, {"cve": "CVE-2023-7042", "desc": "A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-2709", "desc": "The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/2504dadb-1086-4fa9-8fc7-b93018423515"]}, {"cve": "CVE-2023-29004", "desc": "hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version of Roxy-WI (6.3.9.0 at the moment of writing this report). The vulnerability can be exploited via an HTTP request to /app/options.py and the config_file_name parameter. Successful exploitation of this vulnerability could allow an attacker with user level privileges to obtain the content of arbitrary files on the file server within the scope of what the server process has access to. The root-cause of the vulnerability lies in the get_config function of the /app/modules/config/config.py file, which only checks for relative path traversal, but still allows to read files from absolute locations passed via the config_file_name parameter.", "poc": ["https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-7qqj-xhvr-46fv"]}, {"cve": "CVE-2023-7054", "desc": "A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /user/add-notes.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248741 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50378", "desc": "Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8\u00a0\u00a0\u00a0Impact : As it will be stored XSS,\u00a0Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads. Users are recommended to upgrade to version 2.7.8 which fixes this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44275", "desc": "OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.", "poc": ["https://www.x41-dsec.de/lab/advisories/x41-2023-001-opnsense"]}, {"cve": "CVE-2023-40201", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in\u00a0FuturioWP Futurio Extra plugin <=\u00a01.8.4 versions leads to\u00a0activation of arbitrary plugin.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4421", "desc": "The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS < 3.61.", "poc": ["https://github.com/alexcowperthwaite/PasskeyScanner"]}, {"cve": "CVE-2023-33764", "desc": "eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component #/de/casting/show/detail/.", "poc": ["https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33764", "https://github.com/rauschecker/CVEs"]}, {"cve": "CVE-2023-2114", "desc": "The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concatenating it to an SQL query.", "poc": ["https://wpscan.com/vulnerability/3d8ab3a5-1bf8-4216-91fa-e89541e5c43d", "https://github.com/ARPSyndicate/cvemon", "https://github.com/SchmidAlex/nex-forms_SQL-Injection", "https://github.com/SchmidAlex/nex-forms_SQL-Injection-CVE-2023-2114", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5900", "desc": "Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.", "poc": ["https://huntr.com/bounties/c3f011d4-9f76-4b2b-b3d4-a5e2ecd2e354"]}, {"cve": "CVE-2023-4037", "desc": "Blind SQL injection vulnerability in the Conacwin 3.7.1.2 web interface, the exploitation of which could allow a local attacker to obtain sensitive data stored in the database by sending a specially crafted SQL query to the xml parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37210", "desc": "A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1821886"]}, {"cve": "CVE-2023-37986", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange YourMembership Single Sign On \u2013 YM SSO Login plugin <=\u00a01.1.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22971", "desc": "Cross Site Scripting (XSS) vulnerability in Hughes Network Systems Router Terminal for HX200 v8.3.1.14, HX90 v6.11.0.5, HX50L v6.10.0.18, HN9460 v8.2.0.48, and HN7000S v6.9.0.37, allows unauthenticated attackers to misuse frames, include JS/HTML code and steal sensitive information from legitimate users of the application.", "poc": ["https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5743.php"]}, {"cve": "CVE-2023-44080", "desc": "An issue in PGYER codefever v.2023.8.14-2ce4006 allows a remote attacker to execute arbitrary code via a crafted request to the branchList component.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44451", "desc": "Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of EPUB files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21897.", "poc": ["https://github.com/febinrev/slippy-book-exploit", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-33537", "desc": "TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/FixMapCfgRpm.", "poc": ["https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/1/TL-WR940N_TL-WR841N_TL-WR740N_userRpm_FixMapCfgRpm.md"]}, {"cve": "CVE-2023-35388", "desc": "Microsoft Exchange Server Remote Code Execution Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4138", "desc": "Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.", "poc": ["https://huntr.dev/bounties/1b1fa915-d588-4bb1-9e82-6a6be79befed"]}, {"cve": "CVE-2023-4517", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.", "poc": ["https://huntr.dev/bounties/508d1d21-c45d-47ff-833f-50c671882e51"]}, {"cve": "CVE-2023-40816", "desc": "OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.", "poc": ["https://www.esecforte.com/cve-2023-40816-html-injection-activity-milestone/"]}, {"cve": "CVE-2023-7158", "desc": "A vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180.", "poc": ["https://github.com/micropython/micropython/issues/13007", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51946", "desc": "Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary web script or HTML.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39544", "desc": "CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3566", "desc": "A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of resources. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233359. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/ctflearner/Vulnerability/blob/main/WALLABAG/NAME-LIMIT.md", "https://youtu.be/ouwud0PlHkE"]}, {"cve": "CVE-2023-7204", "desc": "The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides", "poc": ["https://wpscan.com/vulnerability/65a8cf83-d6cc-4d4c-a482-288a83a69879/"]}, {"cve": "CVE-2023-50256", "desc": "Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31293", "desc": "An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user's web browser, allowing the journal to be displayed, despite the option being disabled.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0061/"]}, {"cve": "CVE-2023-45228", "desc": "The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08", "https://www.sielco.org/en/contacts"]}, {"cve": "CVE-2023-1972", "desc": "A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.", "poc": ["https://github.com/13579and2468/Wei-fuzz", "https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-31806", "desc": "Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.", "poc": ["https://github.com/msegoviag/discovered-vulnerabilities", "https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-27151", "desc": "openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) via the Name, Description, or Activity Number field.", "poc": ["https://www.esecforte.com/cve-2023-27151-html-injection-activity-tracker/"]}, {"cve": "CVE-2023-41746", "desc": "Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-5873", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.", "poc": ["https://huntr.com/bounties/701cfc30-22a1-4c4b-9b2f-885c77c290ce", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-3356", "desc": "The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping", "poc": ["https://wpscan.com/vulnerability/93faad5b-e1e8-4e49-b19e-b91343d68b51", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1089", "desc": "The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/9787e26f-33fe-4c65-abb3-7f5c76ae8d6f"]}, {"cve": "CVE-2023-37624", "desc": "Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.", "poc": ["https://github.com/benjaminpsinclair/Netdisco-2023-Advisory", "https://github.com/hheeyywweellccoommee/Netdisco-CVE-2023-37624-jawzz", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-20767", "desc": "In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629585; Issue ID: ALPS07629584.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40519", "desc": "A cross-site scripting (XSS) vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management Auth Agent 01.01.00.19219575_ee9195b0, 01.01.01.30097902_fd999e76, and 00.12.01.9565588_1254b459 allows remote attackers to inject arbitrary web script or HTML via the disconnectMessage parameter.", "poc": ["https://medium.com/munchy-bytes/security-disclosure-of-vulnerabilities-cve-2023-40519-2fc319737dfa"]}, {"cve": "CVE-2023-0528", "desc": "A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin/abc.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219597 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.219597"]}, {"cve": "CVE-2023-33387", "desc": "A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link.", "poc": ["https://www.tuv.com/landingpage/de/schwachstelle/"]}, {"cve": "CVE-2023-26109", "desc": "All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-NODEBLUETOOTHSERIALPORT-3311820"]}, {"cve": "CVE-2023-45274", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in SendPulse SendPulse Free Web Push plugin <=\u00a01.3.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1912", "desc": "The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin's settings page. This only works when the plugin prioritizes use of the X-FORWARDED-FOR header, which can be configured in its settings.", "poc": ["http://packetstormsecurity.com/files/171824/WordPress-Limit-Login-Attempts-1.7.1-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-50835", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Praveen Goswami Advanced Category Template.This issue affects Advanced Category Template: from n/a through 0.1.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43777", "desc": "Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauthorized access. This password was being stored insecurely and could be retrieved by skilled adversaries.", "poc": ["https://github.com/SySS-Research/easy-password-recovery", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44089", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).\u00a0It was possible to execute malicious JS code on Visual Consoles.\u00a0This issue affects Pandora FMS: from 700 through 774.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38843", "desc": "An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the incident function.", "poc": ["https://gist.github.com/senzee1984/ff30f0914db39d2741ab17332f0fc6e1"]}, {"cve": "CVE-2023-46744", "desc": "Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Scripting (XSS) vulnerability enables privilege escalation of authenticated users. The SVG element filtering mechanism intended to stop XSS attacks through uploaded SVG images, is insufficient resulting to stored XSS attacks. Squidex allows the CMS contributors to be granted the permission of uploading an SVG asset. When the asset is uploaded, a filtering mechanism is performed to validate that the SVG does not contain malicious code. The validation logic consists of traversing the HTML nodes in the DOM. In order for the validation to succeed, 2 conditions must be met: 1. No HTML tags included in a \"blacklist\" called \"InvalidSvgElements\" are present. This list only contains the element \"script\". and 2. No attributes of HTML tags begin with \"on\" (i.e. onerror, onclick) (line 65). If either of the 2 conditions is not satisfied, validation fails and the file/asset is not uploaded. However it is possible to bypass the above filtering mechanism and execute arbitrary JavaScript code by introducing other HTML elements such as an
inputStream in xpcom the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1804564"]}, {"cve": "CVE-2023-31439", "desc": "** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", "poc": ["https://github.com/systemd/systemd/pull/28885", "https://github.com/GrigGM/05-virt-04-docker-hw", "https://github.com/fokypoky/places-list", "https://github.com/kastel-security/Journald"]}, {"cve": "CVE-2023-41752", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2.Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33135", "desc": ".NET and Visual Studio Elevation of Privilege Vulnerability", "poc": ["https://github.com/ycdxsb/ycdxsb"]}, {"cve": "CVE-2023-6724", "desc": "Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company Hearing Tracking System allows Authentication Abuse.This issue affects Hearing Tracking System: before for IOS 7.0, for Android Latest release 1.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4879", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.", "poc": ["https://huntr.dev/bounties/7df6b167-3c39-4563-9b8a-33613e25cf27"]}, {"cve": "CVE-2023-43574", "desc": "A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privilegesto disclose sensitive information.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-7039", "desc": "A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248688.", "poc": ["https://github.com/Stitch3612/cve/blob/main/rce.md"]}, {"cve": "CVE-2023-22034", "desc": "Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 19.3-19.19 and 21.3-21.10. Easily exploitable vulnerability allows high privileged attacker having SYSDBA privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Unified Audit accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-4450", "desc": "A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-237571.", "poc": ["https://github.com/Threekiii/Awesome-POC", "https://github.com/chennbnbnb/JDoop-release", "https://github.com/hxysaury/saury-vulnhub", "https://github.com/ilikeoyt/CVE-2023-4450-Attack", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-33733", "desc": "Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.", "poc": ["https://github.com/c53elyas/CVE-2023-33733", "https://github.com/buiduchoang24/CVE-2023-33733", "https://github.com/c53elyas/CVE-2023-33733", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/onion2203/CVE-2023-33733", "https://github.com/onion2203/Lab_Reportlab", "https://github.com/sahiloj/CVE-2023-33732", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-46193", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <=\u00a01.2.3 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-6560", "desc": "An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.", "poc": ["http://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7060", "desc": "Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.", "poc": ["https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fjc8-223c-qgqr", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-5826", "desc": "A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/list_onlineuser.php. The manipulation of the argument SessionId leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243716. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.", "poc": ["https://github.com/Cubi123123123/cve/blob/main/NS-ASG-sql-list_onlineuser.md", "https://vuldb.com/?id.243716"]}, {"cve": "CVE-2023-33676", "desc": "Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at \"?page=items/view&id=*\" which can be escalated to the remote command execution.", "poc": ["https://github.com/ASR511-OO7/CVE-2023-33676", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-36029", "desc": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5221", "desc": "A vulnerability classified as critical has been found in ForU CMS. This affects an unknown part of the file /install/index.php. The manipulation of the argument db_name leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-240363. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://vuldb.com/?id.240363"]}, {"cve": "CVE-2023-24027", "desc": "In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.", "poc": ["https://github.com/sixgroup-security/CVE"]}, {"cve": "CVE-2023-2023", "desc": "The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.", "poc": ["https://wpscan.com/vulnerability/8859843a-a8c2-4f7a-8372-67049d6ea317", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/GREENHAT7/Hvv2023", "https://github.com/GREENHAT7/pxplan", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/druxter-x/PHP-CVE-2023-2023-2640-POC-Escalation", "https://github.com/hktalent/TOP", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sampsonv/github-trending", "https://github.com/thatformat/Hvv2023", "https://github.com/zengzzzzz/golang-trending-archive"]}, {"cve": "CVE-2023-2868", "desc": "A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives).\u00a0The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product.\u00a0This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.", "poc": ["https://github.com/IRB0T/IOC", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/PudgyDragon/IOCs", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/cashapp323232/CVE-2023-2868CVE-2023-2868", "https://github.com/cfielding-r7/poc-cve-2023-2868", "https://github.com/getdrive/PoC", "https://github.com/hheeyywweellccoommee/CVE-2023-2868-lchvp", "https://github.com/iluaster/getdrive_PoC", "https://github.com/krmxd/CVE-2023-2868", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5251", "desc": "The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'grid_plus_save_layout_callback' and 'grid_plus_delete_callback' functions in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with subscriber privileges or above, to add, update or delete grid layout.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5164", "desc": "The Bellows Accordion Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42640", "desc": "In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3184", "desc": "A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save. The manipulation of the argument firstname/middlename/lastname/username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231164.", "poc": ["http://packetstormsecurity.com/files/172908/Sales-Tracker-Management-System-1.0-HTML-Injection.html", "https://github.com/ctflearner/Vulnerability/blob/main/Sales_Tracker_Management_System/stms.md", "https://github.com/ctflearner/ctflearner"]}, {"cve": "CVE-2023-50110", "desc": "TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used.", "poc": ["https://github.com/TestLinkOpenSourceTRMS/testlink-code/pull/357"]}, {"cve": "CVE-2023-35362", "desc": "Windows Clip Service Elevation of Privilege Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25428", "desc": "A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leading to code execution.", "poc": ["https://packetstormsecurity.com/files/172259/Soft-o-Free-Password-Manager-1.1.20-DLL-Hijacking.html"]}, {"cve": "CVE-2023-28600", "desc": "Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files potentially causing a loss of integrity and availability to the Zoom Client.", "poc": ["https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-25191", "desc": "AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-update-5.00.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/chnzzh/Redfish-CVE-lib"]}, {"cve": "CVE-2023-44012", "desc": "Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx component.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43696", "desc": "Improper Access Control in SICK APU allows an unprivileged remote attacker todownload as well as upload arbitrary files via anonymous access to the FTP server.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51625", "desc": "D-Link DCS-8300LHV2 ONVIF SetSystemDateAndTime Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the implementation of the ONVIF API, which listens on TCP port 80. When parsing the sch:TZ XML element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21319.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4284", "desc": "The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/1c126869-0afa-456f-94cc-10334964e5f9", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2998", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.", "poc": ["https://huntr.dev/bounties/8282d78e-f399-4bf4-8403-f39103a31e78"]}, {"cve": "CVE-2023-34127", "desc": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.", "poc": ["http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html"]}, {"cve": "CVE-2023-2936", "desc": "Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/173197/Chrome-V8-Type-Confusion.html"]}, {"cve": "CVE-2023-1381", "desc": "The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.", "poc": ["https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/", "https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536"]}, {"cve": "CVE-2023-1590", "desc": "A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the function exec of the file admin/operations/currency.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223655.", "poc": ["https://blog.csdn.net/weixin_43864034/article/details/129730106", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-20854", "desc": "VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed.", "poc": ["https://www.vmware.com/security/advisories/VMSA-2023-0003.html"]}, {"cve": "CVE-2023-31446", "desc": "In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.", "poc": ["https://github.com/Dodge-MPTC/CVE-2023-31446-Remote-Code-Execution", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-43578", "desc": "A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-26428", "desc": "Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitly shared. We improved permission handling when requesting snippets that are not explicitly shared with other users. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html"]}, {"cve": "CVE-2023-30378", "desc": "In Tenda AC15 V15.03.05.19, the function \"sub_8EE8\" contains a stack-based buffer overflow vulnerability.", "poc": ["https://github.com/2205794866/Tenda/blob/main/AC15/5.md"]}, {"cve": "CVE-2023-2092", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Vehicle Service Management System 1.0. Affected by this issue is some unknown functionality of the file view_service.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226100.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-24496", "desc": "Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704"]}, {"cve": "CVE-2023-3460", "desc": "The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.", "poc": ["https://wpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7", "https://github.com/BlackReaperSK/CVE-2023-3460_POC", "https://github.com/EmadYaY/CVE-2023-3460", "https://github.com/Fire-Null/CVE-2023-3460", "https://github.com/Fire-Null/Write-Ups", "https://github.com/LUUANHDUC/KhaiThacLoHongPhanMem", "https://github.com/Rajneeshkarya/CVE-2023-3460", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/diego-tella/CVE-2023-3460", "https://github.com/gbrsh/CVE-2023-3460", "https://github.com/hheeyywweellccoommee/CVE-2023-3460-obgen", "https://github.com/hung1111234/KhaiThacLoHongPhanMem", "https://github.com/julienbrs/exploit-CVE-2023-3460", "https://github.com/motikan2010/blog.motikan2010.com", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/ollie-blue/CVE_2023_3460", "https://github.com/rizqimaulanaa/CVE-2023-3460", "https://github.com/yon3zu/Mass-CVE-2023-3460"]}, {"cve": "CVE-2023-0323", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.", "poc": ["https://huntr.dev/bounties/129d6a4b-0504-4de1-a72c-3f12c4552343"]}, {"cve": "CVE-2023-23513", "desc": "A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution.", "poc": ["https://github.com/houjingyi233/macOS-iOS-system-security"]}, {"cve": "CVE-2023-4864", "desc": "A vulnerability, which was classified as problematic, was found in SourceCodester Take-Note App 1.0. This affects an unknown part of the file index.php. The manipulation of the argument noteContent with the input leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239349 was assigned to this vulnerability.", "poc": ["https://skypoc.wordpress.com/2023/09/05/sourcecodester-take-note-app-v1-0-has-multiple-vulnerabilities/"]}, {"cve": "CVE-2023-52205", "desc": "Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free.This issue affects HTML5 SoundCloud Player with Playlist Free: from n/a through 2.8.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33902", "desc": "In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/uthrasri/CVE-2023-33902_single_file"]}, {"cve": "CVE-2023-46361", "desc": "Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.", "poc": ["https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/jbig2dec-SEGV/jbig2dec-SEGV.md"]}, {"cve": "CVE-2023-48118", "desc": "SQL Injection vulnerability in Quest Analytics LLC IQCRM v.2023.9.5 allows a remote attacker to execute arbitrary code via a crafted request to the Common.svc WSDL page.", "poc": ["https://github.com/el-dud3rino/CVE-Disclosures/blob/main/Quest%20Analytics%20IQCRM/Proof%20of%20Concept", "https://github.com/el-dud3rino/CVE-Disclosures"]}, {"cve": "CVE-2023-52311", "desc": "PaddlePaddle before 2.6.0 has a command injection in _wget_download. This resulted in the ability to execute arbitrary commands on the operating system.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-020.md"]}, {"cve": "CVE-2023-51764", "desc": "Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports *This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1817768"]}, {"cve": "CVE-2023-49844", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Kevin Ohashi WPPerformanceTester.This issue affects WPPerformanceTester: from n/a through 2.0.0.", "poc": ["https://github.com/kevinohashi/WPPerformanceTester"]}, {"cve": "CVE-2023-42320", "desc": "Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter in the GetParentControlInfo function.", "poc": ["https://github.com/aixiao0621/Tenda/blob/main/AC10/0.md", "https://github.com/aixiao0621/Tenda"]}, {"cve": "CVE-2023-41824", "desc": "An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34645", "desc": "jfinal CMS 5.1.0 has an arbitrary file read vulnerability.", "poc": ["https://github.com/jflyfox/jfinal_cms/issues/57"]}, {"cve": "CVE-2023-24730", "desc": "Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the user profile update function.", "poc": ["https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-scrm.zip"]}, {"cve": "CVE-2023-47996", "desc": "An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a denial of service.", "poc": ["https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47996", "https://github.com/thelastede/FreeImage-cve-poc"]}, {"cve": "CVE-2023-3024", "desc": "Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0179", "desc": "A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.", "poc": ["http://packetstormsecurity.com/files/171601/Kernel-Live-Patch-Security-Notice-LNS-0093-1.html", "https://seclists.org/oss-sec/2023/q1/20", "https://github.com/44maker/Linux-Privilege", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Awrrays/Pentest-Tips", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/EGI-Federation/SVG-advisories", "https://github.com/GhostTroops/TOP", "https://github.com/H4K6/CVE-2023-0179-PoC", "https://github.com/Mr-xn/Penetration_Testing_POC", "https://github.com/TurtleARM/CVE-2023-0179-PoC", "https://github.com/aneasystone/github-trending", "https://github.com/h0pe-ay/Vulnerability-Reproduction", "https://github.com/hktalent/TOP", "https://github.com/johe123qwe/github-trending", "https://github.com/k0mi-tg/CVE-POC", "https://github.com/lions2012/Penetration_Testing_POC", "https://github.com/manas3c/CVE-POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/taielab/awesome-hacking-lists", "https://github.com/tanjiti/sec_profile", "https://github.com/whoforget/CVE-POC", "https://github.com/xairy/linux-kernel-exploitation", "https://github.com/youwizard/CVE-POC"]}, {"cve": "CVE-2023-0845", "desc": "Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.", "poc": ["https://github.com/tdunlap607/docker_vs_cg"]}, {"cve": "CVE-2023-4432", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.", "poc": ["https://huntr.dev/bounties/69684663-6822-41ff-aa05-afbdb8f5268f"]}, {"cve": "CVE-2023-34563", "desc": "netgear R6250 Firmware Version 1.0.4.48 is vulnerable to Buffer Overflow after authentication.", "poc": ["https://github.com/D2y6p/CVE/blob/main/Netgear/CVE-2023-34563/EN.md"]}, {"cve": "CVE-2023-21870", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-31048", "desc": "The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely.", "poc": ["https://github.com/claroty/opcua-exploit-framework"]}, {"cve": "CVE-2023-0647", "desc": "A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/kickPlayer. The manipulation of the argument userId leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-220034 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/Ha0Liu/cveAdd/blob/developer/dst-admin%201.5.0%E5%90%8E%E5%8F%B0kickPlayer%E6%8E%A5%E5%8F%A3%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C/Dst-admin%201.5.0%20background%20kickPlayer%20interface%20remote%20command%20execution.md"]}, {"cve": "CVE-2023-36085", "desc": "The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its \"/sisqualIdentityServer/core/\" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to phishing attacks, malware distribution, and unauthorized access to sensitive resources.", "poc": ["http://packetstormsecurity.com/files/176991/SISQUAL-WFM-7.1.319.103-Host-Header-Injection.html", "https://github.com/omershaik0/Handmade_Exploits/tree/main/SISQUALWFM-Host-Header-Injection-CVE-2023-36085"]}, {"cve": "CVE-2023-46182", "desc": "IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 269692.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2640", "desc": "On Ubuntu kernels carrying both c914c0e27eb0 and \"UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs\", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.", "poc": ["https://github.com/0xWhoami35/root-kernel", "https://github.com/0xsyr0/OSCP", "https://github.com/Ev3rPalestine/Analytics-HTB-Walkthrough", "https://github.com/Kiosec/Linux-Exploitation", "https://github.com/Nkipohcs/CVE-2023-2640-CVE-2023-32629", "https://github.com/OllaPapito/gameoverlay", "https://github.com/PuguhDy/CVE-Root-Ubuntu", "https://github.com/SanjayRagavendar/Ubuntu-GameOver-Lay", "https://github.com/SanjayRagavendar/UbuntuPrivilegeEscalationV1", "https://github.com/SirElmard/ethical_hacking", "https://github.com/Snoopy-Sec/Localroot-ALL-CVE", "https://github.com/ThrynSec/CVE-2023-32629-CVE-2023-2640---POC-Escalation", "https://github.com/Umutkgz/CVE-2023-32629-CVE-2023-2640-Ubuntu-Privilege-Escalation-POC", "https://github.com/brimstone/stars", "https://github.com/churamanib/p0wny-shell", "https://github.com/cyberexpertsng/Cyber-Advisory", "https://github.com/druxter-x/PHP-CVE-2023-2023-2640-POC-Escalation", "https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629", "https://github.com/giterlizzi/secdb-feeds", "https://github.com/ilviborici/ubuntu-privesc", "https://github.com/johnlettman/juju-patch-gameoverlay", "https://github.com/johnlettman/juju-scripts", "https://github.com/k4but0/Ubuntu-LPE", "https://github.com/kaotickj/Check-for-CVE-2023-32629-GameOver-lay", "https://github.com/kgwanjala/oscp-cheatsheet", "https://github.com/luanoliveira350/GameOverlayFS", "https://github.com/musorblyat/CVE-2023-2640-CVE-2023-32629", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/oscpname/OSCP_cheat", "https://github.com/revanmalang/OSCP", "https://github.com/txuswashere/OSCP", "https://github.com/vinetsuicide/CVE-2023-2640-CVE-2023-32629", "https://github.com/xS9NTX/CVE-2023-32629-CVE-2023-2640-Ubuntu-Privilege-Escalation-POC", "https://github.com/xairy/linux-kernel-exploitation", "https://github.com/xhref/OSCP"]}, {"cve": "CVE-2023-32645", "desc": "A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1752"]}, {"cve": "CVE-2023-2753", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.", "poc": ["https://huntr.dev/bounties/eca2284d-e81a-4ab8-91bb-7afeca557628"]}, {"cve": "CVE-2023-27164", "desc": "An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.", "poc": ["https://gist.github.com/b33t1e/a1a0d81b1173d0d00de8f4e7958dd867"]}, {"cve": "CVE-2023-6599", "desc": "Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.", "poc": ["https://huntr.com/bounties/6198785c-bf60-422e-9b80-68a6e658a10e"]}, {"cve": "CVE-2023-47890", "desc": "pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.", "poc": ["https://github.com/pyload/pyload/security/advisories/GHSA-h73m-pcfw-25h2", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24520", "desc": "Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the trace tool utility.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1706"]}, {"cve": "CVE-2023-2089", "desc": "A vulnerability was found in SourceCodester Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/userprofile.php of the component GET Parameter Handler. The manipulation of the argument uid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226097 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.226097", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-6184", "desc": "Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting", "poc": ["https://github.com/SohelParashar/.Net-Deserialization-Cheat-Sheet"]}, {"cve": "CVE-2023-3346", "desc": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.", "poc": ["https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdf"]}, {"cve": "CVE-2023-29735", "desc": "An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29735/CVE%20detail.md"]}, {"cve": "CVE-2023-2431", "desc": "A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.", "poc": ["https://github.com/chen-keinan/k8s-vulndb-collector", "https://github.com/noirfate/k8s_debug"]}, {"cve": "CVE-2023-38433", "desc": "Fujitsu Real-time Video Transmission Gear \"IP series\" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as follows: IP-HE950E firmware versions V01L001 to V01L053, IP-HE950D firmware versions V01L001 to V01L053, IP-HE900E firmware versions V01L001 to V01L010, IP-HE900D firmware versions V01L001 to V01L004, IP-900E / IP-920E firmware versions V01L001 to V02L061, IP-900D / IP-900\u2161D / IP-920D firmware versions V01L001 to V02L061, IP-90 firmware versions V01L001 to V01L013, and IP-9610 firmware versions V01L001 to V02L007.", "poc": ["https://github.com/komodoooo/Some-things"]}, {"cve": "CVE-2023-3532", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.", "poc": ["https://huntr.dev/bounties/ebd2428a-e2cb-480e-ba37-dd89ad62cf1b", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21838", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/r00t4dm/r00t4dm"]}, {"cve": "CVE-2023-0439", "desc": "The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.", "poc": ["https://wpscan.com/vulnerability/04cea9aa-b21c-49f8-836b-2d312253e09a"]}, {"cve": "CVE-2023-22487", "desc": "Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@\"
.scf script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-45847", "desc": "Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24269", "desc": "An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file.", "poc": ["https://github.com/s4n-h4xor/CVE-Publications/blob/main/CVE-2023-24269/CVE-2023-24269.md"]}, {"cve": "CVE-2023-26954", "desc": "onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.", "poc": ["https://github.com/keheying/onekeyadmin/issues/11"]}, {"cve": "CVE-2023-25734", "desc": "After downloading a Windows
.url shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1809923", "https://bugzilla.mozilla.org/show_bug.cgi?id=1810143"]}, {"cve": "CVE-2023-27100", "desc": "Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.", "poc": ["http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html", "https://github.com/DarokNET/CVE-2023-27100", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27119", "desc": "WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.", "poc": ["https://github.com/WebAssembly/wabt/issues/1990"]}, {"cve": "CVE-2023-31698", "desc": "** DISPUTED ** Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).", "poc": ["http://packetstormsecurity.com/files/172462/Bludit-CMS-3.14.1-Cross-Site-Scripting.html", "https://github.com/bludit/bludit/issues/1369#issuecomment-940806199", "https://github.com/bludit/bludit/issues/1509"]}, {"cve": "CVE-2023-1091", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpata Licensed Warehousing Automation System allows Command Line Execution through SQL Injection.This issue affects Licensed Warehousing Automation System: through 2023.1.01.", "poc": ["https://github.com/karimhabush/cyberowl", "https://github.com/kolewttd/wtt"]}, {"cve": "CVE-2023-49897", "desc": "An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.", "poc": ["https://github.com/Ostorlab/KEV"]}, {"cve": "CVE-2023-27890", "desc": "** UNSUPPORTED WHEN ASSIGNED ** The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["http://packetstormsecurity.com/files/171421/MyBB-Export-User-2.0-Cross-Site-Scripting.html"]}, {"cve": "CVE-2023-36243", "desc": "FLVMeta v1.2.1 was discovered to contain a buffer overflow via the xml_on_metadata_tag_only function at dump_xml.c.", "poc": ["https://github.com/noirotm/flvmeta/issues/19"]}, {"cve": "CVE-2023-31061", "desc": "Repetier Server through 1.4.10 does not have CSRF protection.", "poc": ["https://cybir.com/2023/cve/poc-repetier-server-140/"]}, {"cve": "CVE-2023-44091", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.\u00a0This ulnerability allowed SQL injections to be made even if authentication failed.This issue affects Pandora FMS: from 700 through <776.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-0982", "desc": "A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Add Class Entry. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-221677 was assigned to this vulnerability.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-4869", "desc": "A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file update.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-239354 is the identifier assigned to this vulnerability.", "poc": ["https://skypoc.wordpress.com/2023/09/05/vuln1/"]}, {"cve": "CVE-2023-3887", "desc": "A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235249 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.235249"]}, {"cve": "CVE-2023-2770", "desc": "A vulnerability classified as critical was found in SourceCodester Online Exam System 1.0. This vulnerability affects unknown code of the file /kelasdosen/data. The manipulation of the argument columns[1][data] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229276.", "poc": ["https://github.com/tht1997/CVE_2023/blob/main/online_exam/kelasdosen.md", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-4314", "desc": "The wpDataTables WordPress plugin before 2.1.66 does not validate the \"Serialized PHP array\" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.", "poc": ["https://wpscan.com/vulnerability/1ab192d7-72ac-4f12-8a51-f28ee4db91bc"]}, {"cve": "CVE-2023-0461", "desc": "There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS\u00a0or CONFIG_XFRM_ESPINTCP\u00a0has to be configured, but the operation does not require any privilege.There is a use-after-free bug of icsk_ulp_data\u00a0of a struct inet_connection_sock.When CONFIG_TLS\u00a0is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.The setsockopt\u00a0TCP_ULP\u00a0operation does not require any privilege.We recommend upgrading past commit\u00a02c02d41d71f90a5168391b6a5f2954112ba2307c", "poc": ["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2c02d41d71f90a5168391b6a5f2954112ba2307c", "https://github.com/ARPSyndicate/cvemon", "https://github.com/EGI-Federation/SVG-advisories", "https://github.com/borzakovskiy/CoolSols", "https://github.com/c0debatya/CoolSols", "https://github.com/hheeyywweellccoommee/linux-4.19.72_CVE-2023-0461-ycnbd", "https://github.com/hshivhare67/kernel_v4.19.72_CVE-2023-0461", "https://github.com/nidhi7598/linux-4.19.72_CVE-2023-0461", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rockrid3r/CoolSols", "https://github.com/sysca11/CoolSols", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-1390", "desc": "A remote denial of service vulnerability was found in the Linux kernel\u2019s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.", "poc": ["https://gist.github.com/netspooky/bee2d07022f6350bb88eaa48e571d9b5"]}, {"cve": "CVE-2023-27532", "desc": "Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/fardeen-ahmed/Bug-bounty-Writeups", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/hktalent/TOP", "https://github.com/horizon3ai/CVE-2023-27532", "https://github.com/karimhabush/cyberowl", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sfewer-r7/CVE-2023-27532"]}, {"cve": "CVE-2023-51026", "desc": "TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the \u2018hour\u2019 parameter of the setRebootScheCfg interface of the cstecgi .cgi.", "poc": ["https://815yang.github.io/2023/12/11/EX1800T/2/TOTOlinkEX1800T_V9.1.0cu.2112_B2022031setRebootScheCfg-hour/"]}, {"cve": "CVE-2023-39981", "desc": "A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authentication measures, potentially leading to the disclosure of device information by a remote attacker.", "poc": ["https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3445", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.", "poc": ["https://huntr.dev/bounties/18a74a9d-4a2d-4bf8-ae62-56a909427070"]}, {"cve": "CVE-2023-21145", "desc": "In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/nidhi7598/frameworks_base_AOSP_10_r33_CVE-2023-21145"]}, {"cve": "CVE-2023-20116", "desc": "A vulnerability in the Administrative XML Web Service (AXL) API of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\nThis vulnerability is due to insufficient validation of user-supplied input to the web UI of the Self Care Portal. An attacker could exploit this vulnerability by sending crafted HTTP input to an affected device. A successful exploit could allow the attacker to cause a DoS condition on the affected device.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-dos-4Ag3yWbD"]}, {"cve": "CVE-2023-2817", "desc": "A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.", "poc": ["https://www.tenable.com/security/research/tra-2023-20,"]}, {"cve": "CVE-2023-21902", "desc": "Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Application). The supported version that is affected is 8.0.8.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Financial Services Behavior Detection Platform accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-6082", "desc": "The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/c3d43aac-66c8-4218-b3f0-5256f895eda3/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25653", "desc": "node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default \"fallback\" crypto back-end, ECC operations in `node-jose` can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input. The issue has been patched in version 2.2.0. Since this issue is only present in the \"fallback\" crypto implementation, it can be avoided by ensuring that either WebCrypto or the Node `crypto` module is available in the JS environment where `node-jose` is being run.", "poc": ["https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-0277", "desc": "The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/69ffb2f1-b291-49bf-80a8-08d03ceca53b"]}, {"cve": "CVE-2023-43201", "desc": "D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ext.asp function.", "poc": ["https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7200GV2/bug2.md"]}, {"cve": "CVE-2023-38865", "desc": "COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.", "poc": ["https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject5"]}, {"cve": "CVE-2023-6595", "desc": "In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sharmashreejaa/CVE-2023-6595"]}, {"cve": "CVE-2023-0063", "desc": "The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/2262f2fc-8122-46ed-8e67-8c34ee35fc97"]}, {"cve": "CVE-2023-47623", "desc": "Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the login page via the `redirect_uri` parameter. By specifying a url with the javascript scheme (`javascript:`), an attacker can run arbitrary JavaScript code after the login.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-218_GHSL-2023-219_scrypted/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21938", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/runner361/CVE-List"]}, {"cve": "CVE-2023-25113", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_l2tp function with the key variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-43790", "desc": "iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22884", "desc": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.", "poc": ["https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/jakabakos/CVE-2023-22884-Airflow-SQLi", "https://github.com/kohnakagawa/kohnakagawa", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1668", "desc": "A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40758", "desc": "User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6941", "desc": "The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).", "poc": ["https://wpscan.com/vulnerability/58f7c9aa-5e59-468f-aba9-b15e7942fd37/"]}, {"cve": "CVE-2023-46755", "desc": "Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerability may cause the launcher to restart.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24181", "desc": "LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.", "poc": ["https://github.com/ABB-EL/external-vulnerability-disclosures/security/advisories/GHSA-9gqg-pp5p-q9hg"]}, {"cve": "CVE-2023-45889", "desc": "A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.8 allows remote attackers to inject JavaScript into any webpage. NOTE: this issue exists because of an incomplete fix for CVE-2022-48612.", "poc": ["https://blog.zerdle.net/classlink/", "https://blog.zerdle.net/classlink2/"]}, {"cve": "CVE-2023-29696", "desc": "H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function version_set.", "poc": ["https://github.com/Stevenbaga/fengsha/blob/main/H3C/GR-1200W/aVersionSet.md"]}, {"cve": "CVE-2023-6811", "desc": "The Language Translate Widget for WordPress \u2013 ConveyThis plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key\u2019 parameter in all versions up to, and including, 223 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41822", "desc": "An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36753", "desc": "A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The uninstall-app App-name parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.", "poc": ["https://github.com/sudo-jtcsec/CVE"]}, {"cve": "CVE-2023-40753", "desc": "There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6574", "desc": "A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php of the component HTTP POST Request Handler. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247154 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-42802", "desc": "GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server.", "poc": ["https://github.com/NH-RED-TEAM/GLPI-PoC"]}, {"cve": "CVE-2023-4596", "desc": "The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.", "poc": ["https://www.exploit-db.com/exploits/51664", "https://github.com/AlabamicHero/caldera_sandcat-usecase", "https://github.com/E1A/CVE-2023-4596", "https://github.com/LUUANHDUC/KhaiThacLoHongPhanMem", "https://github.com/devmehedi101/bugbounty-CVE-Report", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/getdrive/PoC", "https://github.com/hung1111234/KhaiThacLoHongPhanMem", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/securi3ytalent/bugbounty-CVE-Report"]}, {"cve": "CVE-2023-21611", "desc": "Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-6019", "desc": "A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023", "poc": ["https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe", "https://github.com/Clydeston/CVE-2023-6019", "https://github.com/FireWolfWang/CVE-2023-6019", "https://github.com/miguelc49/CVE-2023-6019-1", "https://github.com/miguelc49/CVE-2023-6019-2", "https://github.com/miguelc49/CVE-2023-6019-3", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-33763", "desc": "eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/index.php.", "poc": ["https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33763", "https://github.com/rauschecker/CVEs"]}, {"cve": "CVE-2023-21144", "desc": "In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-252766417", "poc": ["https://github.com/hshivhare67/Framework_base_AOSP10_r33_CVE-2023-21144", "https://github.com/hshivhare67/Framework_base_AOSP10_r33_CVE-2023-21144_new", "https://github.com/hshivhare67/Framework_base_AOSP10_r33_CVE-2023-21144_old", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26557", "desc": "io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. (bnb-chain/tss-lib and thorchain/tss are also affected.)", "poc": ["https://medium.com/@iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b"]}, {"cve": "CVE-2023-43356", "desc": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component.", "poc": ["https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings"]}, {"cve": "CVE-2023-24033", "desc": "The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly check format types specified by the Session Description Protocol (SDP) module, which can lead to a denial of service.", "poc": ["http://packetstormsecurity.com/files/172137/Shannon-Baseband-accept-type-SDP-Attribute-Memory-Corruption.html"]}, {"cve": "CVE-2023-2610", "desc": "Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.", "poc": ["https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d"]}, {"cve": "CVE-2023-27830", "desc": "TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted files when executing a file transfer. This is due to the fact that TightVNC runs in the backend as a high-privileges account.", "poc": ["https://medium.com/nestedif/vulnerability-disclosure-privilege-escalation-tightvnc-8165208cce"]}, {"cve": "CVE-2023-40277", "desc": "An issue was discovered in OpenClinic GA 5.247.01. A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in the login.jsp message parameter.", "poc": ["https://github.com/BugBountyHunterCVE/CVE-2023-40277", "https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31300", "desc": "An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via transmission of unencrypted, cleartext credentials during Password Reset feature.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0057/"]}, {"cve": "CVE-2023-1542", "desc": "Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.", "poc": ["https://huntr.dev/bounties/d947417c-5a12-407a-9a2f-fa696f65126f"]}, {"cve": "CVE-2023-7081", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHS\u0130L Online Payment System allows SQL Injection.This issue affects Online Payment System: before 14.02.2024.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1719", "desc": "Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.", "poc": ["https://starlabs.sg/advisories/23/23-1719/", "https://github.com/20142995/sectool"]}, {"cve": "CVE-2023-26458", "desc": "An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.The disclosed information is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-43871", "desc": "A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).", "poc": ["https://github.com/sromanhu/CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media/blob/main/README.md", "https://github.com/sromanhu/WBCE-File-Upload--XSS---Media/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media"]}, {"cve": "CVE-2023-34434", "desc": "Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.\u00a0The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .", "poc": ["http://seclists.org/fulldisclosure/2023/Jul/43"]}, {"cve": "CVE-2023-38434", "desc": "xHTTP 72f812d has a double free in close_connection in xhttp.c via a malformed HTTP request method.", "poc": ["https://github.com/cozis/xHTTP/issues/1", "https://github.com/Halcy0nic/CVE-2023-38434", "https://github.com/Halcy0nic/Trophies", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/skinnyrad/Trophies"]}, {"cve": "CVE-2023-23560", "desc": "In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Threekiii/CVE"]}, {"cve": "CVE-2023-46866", "desc": "In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-of-bounds indexes.", "poc": ["https://github.com/InternationalColorConsortium/DemoIccMAX/issues/54", "https://github.com/InternationalColorConsortium/DemoIccMAX/pull/53", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/xsscx/DemoIccMAX", "https://github.com/xsscx/xnuimagefuzzer"]}, {"cve": "CVE-2023-5235", "desc": "The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'users_can_register' and 'default_role'. It also unserializes user input in the process, which may lead to Object Injection attacks.", "poc": ["https://wpscan.com/vulnerability/35c9a954-37fc-4818-a71f-34aaaa0fa3db"]}, {"cve": "CVE-2023-1443", "desc": "A vulnerability was found in Filseclab Twister Antivirus 8. It has been declared as problematic. This vulnerability affects the function 0x80112053 in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223288.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1443", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-5090", "desc": "A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47038", "desc": "A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/bartvoet/assignment-ehb-security-review-adamlenez", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/raylivesun/pldo", "https://github.com/raylivesun/ploa"]}, {"cve": "CVE-2023-39184", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1408", "desc": "The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/baf7ef4d-b2ba-48e0-9c17-74fa27e0c15b"]}, {"cve": "CVE-2023-44031", "desc": "Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows attackers to arbitrarily save sensitive files in insecure locations via a crafted POST request.", "poc": ["http://seclists.org/fulldisclosure/2024/Jan/43", "https://packetstormsecurity.com/files/176841/Reprise-License-Manager-15.1-Privilege-Escalation-File-Write.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32725", "desc": "The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.", "poc": ["https://github.com/SAP/cloud-active-defense", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-49985", "desc": "A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cname parameter.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49985", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-25033", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Sumo Social Share Boost plugin <=\u00a04.5 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0368", "desc": "The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/b41e5c09-1034-48a7-ac0f-d4db6e7a3b3e"]}, {"cve": "CVE-2023-31902", "desc": "RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).", "poc": ["https://www.exploit-db.com/exploits/51010", "https://www.redpacketsecurity.com/mobile-mouse-code-execution/", "https://github.com/DevAkabari/Mobile-Mouse-3.6.0.4-RCE", "https://github.com/blue0x1/mobilemouse-exploit"]}, {"cve": "CVE-2023-37770", "desc": "faust commit ee39a19 was discovered to contain a stack overflow via the component boxppShared::print() at /boxes/ppbox.cpp.", "poc": ["https://github.com/grame-cncm/faust/issues/922"]}, {"cve": "CVE-2023-36619", "desc": "Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.", "poc": ["https://packetstormsecurity.com/files/174704/Atos-Unify-OpenScape-Code-Execution-Missing-Authentication.html", "https://sec-consult.com/vulnerability-lab/advisory/authenticated-remote-code-execution-missing-authentication-atos-unify-openscape/"]}, {"cve": "CVE-2023-27943", "desc": "This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Files downloaded from the internet may not have the quarantine flag applied.", "poc": ["https://github.com/houjingyi233/macOS-iOS-system-security"]}, {"cve": "CVE-2023-36266", "desc": "** DISPUTED ** An issue was discovered in Keeper Password Manager for Desktop version 16.10.2, and the KeeperFill Browser Extensions version 16.5.4, allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information).", "poc": ["http://packetstormsecurity.com/files/173809/Keeper-Security-Desktop-16.10.2-Browser-Extension-16.5.4-Password-Dumper.html", "https://github.com/H4rk3nz0/Peeper", "https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2023-38960", "desc": "Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via crafted executable running from the installation directory.", "poc": ["https://rodelllemit.medium.com/insecure-permissions-vulnerability-in-raidenftpd-v2-4-build-4005-2016-04-01-ea7389be3d33", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31445", "desc": "Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnerability that allows read-only users have the ability to enumerate all other users and discover e-mail addresses, phone numbers, and privileges of all other users.", "poc": ["https://blog.kscsc.online/cves/202331445/md.html", "https://github.com/Dodge-MPTC/CVE-2023-31445-Unprivileged-Information-Disclosure", "https://www.swiruhack.online/cves/202331445/md.html", "https://github.com/Dodge-MPTC/CVE-2023-31445-Unprivileged-Information-Disclosure", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26106", "desc": "All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-DOTLENS-3227646"]}, {"cve": "CVE-2023-22060", "desc": "Vulnerability in the Oracle Hyperion Workspace product of Oracle Hyperion (component: UI and Visualization). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Workspace. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Workspace accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Workspace accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Workspace. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-25083", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the firewall_handler_set function with the ip and mac variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-29089", "desc": "An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding SIP multipart messages.", "poc": ["http://packetstormsecurity.com/files/172292/Shannon-Baseband-Negative-Size-Memcpy-Out-Of-Bounds-Read.html"]}, {"cve": "CVE-2023-24349", "desc": "D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetRoute.", "poc": ["https://github.com/1160300418/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/04"]}, {"cve": "CVE-2023-0434", "desc": "Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.", "poc": ["https://huntr.dev/bounties/7d9332d8-6997-483b-9fb9-bcf2ae01dad4"]}, {"cve": "CVE-2023-21971", "desc": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors as well as unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html", "https://www.oracle.com/security-alerts/cpujul2023.html", "https://github.com/Avento/CVE-2023-21971_Analysis", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-29483", "desc": "eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a \"TuDoor\" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.", "poc": ["https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0106", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.", "poc": ["https://huntr.dev/bounties/5c0809cb-f4ff-4447-bed6-b5625fb374bb"]}, {"cve": "CVE-2023-45008", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <=\u00a01.0.3 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36010", "desc": "Microsoft Defender Denial of Service Vulnerability", "poc": ["https://github.com/myseq/ms_patch_tuesday"]}, {"cve": "CVE-2023-4230", "desc": "A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulnerability may enable attackers to gather information for the purpose of assessing vulnerabilities and potential attack vectors.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3683", "desc": "A vulnerability has been found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /items/search. The manipulation of the argument search_term leads to cross site scripting. The attack can be launched remotely. The identifier VDB-234229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20046", "desc": "A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device.\nThis vulnerability is due to insufficient validation of user-supplied credentials. An attacker could exploit this vulnerability by sending a valid low-privileged SSH key to an affected device from a host that has an IP address that is configured as the source for a high-privileged user account. A successful exploit could allow the attacker to log in to the affected device through SSH as a high-privileged user.\nThere are workarounds that address this vulnerability.", "poc": ["https://github.com/orangecertcc/security-research/security/advisories/GHSA-j7p3-gjw6-pp4r", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-ssh-privesc-BmWeJC3h"]}, {"cve": "CVE-2023-52536", "desc": "In faceid service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51098", "desc": "Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .", "poc": ["https://github.com/GD008/TENDA/blob/main/W9/W9_setDiagnoseInfo/W9_setDiagnoseInfo.md"]}, {"cve": "CVE-2023-39264", "desc": "By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users.\u00a0This vulnerability exists in Apache Superset versions up to and including 2.1.0.", "poc": ["https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-32490", "desc": "Dell PowerScale OneFS 8.2x -9.5x contains an improper privilege management vulnerability. A high privilege local attacker could potentially exploit this vulnerability, leading to system takeover.", "poc": ["https://www.dell.com/support/kbdoc/en-us/000216717/dsa-2023-269-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"]}, {"cve": "CVE-2023-0496", "desc": "The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/451b47d5-7bd2-4a82-9c8e-fe6601bcd2ab"]}, {"cve": "CVE-2023-34371", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <=\u00a02.22 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-45862", "desc": "An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.5"]}, {"cve": "CVE-2023-21896", "desc": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-48963", "desc": "Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/wifiSSIDget.", "poc": ["https://github.com/daodaoshao/vul_tenda_i6_1"]}, {"cve": "CVE-2023-0299", "desc": "Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.", "poc": ["https://huntr.dev/bounties/0049774b-1857-46dc-a834-f1fb15138c53"]}, {"cve": "CVE-2023-4415", "desc": "A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/sys/login. The manipulation leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-237518 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/20142995/sectool", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/thedarknessdied/CVE-2023-4169_CVE-2023-3306_CVE-2023-4415", "https://github.com/thedarknessdied/Ruijie_RG-EW1200G_login_bypass-CVE-2023-4415"]}, {"cve": "CVE-2023-4141", "desc": "The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39511", "desc": "Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `reports_admin.php` displays reporting information about graphs, devices, data sources etc. _CENSUS_ found that an adversary that is able to configure a malicious device name, related to a graph attached to a report, can deploy a stored XSS attack against any super user who has privileges of viewing the `reports_admin.php` page, such as administrative accounts. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://
*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 111.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1783561"]}, {"cve": "CVE-2023-4650", "desc": "Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.", "poc": ["https://huntr.dev/bounties/d92e8985-9d9d-4a62-92e8-ada014ee3b17"]}, {"cve": "CVE-2023-33985", "desc": "SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-22483", "desc": "cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.", "poc": ["https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c"]}, {"cve": "CVE-2023-4156", "desc": "A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.", "poc": ["https://github.com/fokypoky/places-list"]}, {"cve": "CVE-2023-33785", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.", "poc": ["https://github.com/anhdq201/netbox/issues/8"]}, {"cve": "CVE-2023-0068", "desc": "The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/4abd1454-380c-4c23-8474-d7da4b2f3b8e"]}, {"cve": "CVE-2023-26431", "desc": "IPv4-mapped IPv6 addresses did not get recognized as \"local\" by the code and a connection attempt is made. Attackers with access to user accounts could use this to bypass existing deny-list functionality and trigger requests to restricted network infrastructure to gain insight about topology and running services. We now respect possible IPV4-mapped IPv6 addresses when checking if contained in a deny-list. No publicly available exploits are known.", "poc": ["http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html"]}, {"cve": "CVE-2023-30145", "desc": "Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.", "poc": ["http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html", "https://github.com/paragbagul111/CVE-2023-30145", "https://github.com/ARPSyndicate/cvemon", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/paragbagul111/CVE-2023-30145"]}, {"cve": "CVE-2023-29656", "desc": "An improper authorization vulnerability in Darktrace mobile app (Android) prior to version 6.0.15 allows disabled and low-privilege users to control \"antigena\" actions(block/unblock traffic) from the mobile application. This vulnerability could create a \"shutdown\", blocking all ingress or egress traffic in the entire infrastructure where darktrace agents are deployed.", "poc": ["https://ramihub.github.io/", "https://github.com/ramihub/ramihub.github.io"]}, {"cve": "CVE-2023-22044", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-38674", "desc": "FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-006.md"]}, {"cve": "CVE-2023-5852", "desc": "Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3626", "desc": "A vulnerability, which was classified as critical, has been found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This issue affects some unknown processing of the file /Duty/AjaxHandle/UpLoadFloodPlanFile.ashx of the component UpLoadFloodPlanFile. The manipulation of the argument Filedata leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233579. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/MoeMion233/cve/blob/main/2.md"]}, {"cve": "CVE-2023-2900", "desc": "A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown function of the file /Login/CheckLogin. The manipulation leads to use of weak hash. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-229974 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/NFine-Rapid-development-platform-has-weak-password-vulnerability.md"]}, {"cve": "CVE-2023-5890", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.", "poc": ["https://huntr.com/bounties/b60e6e1f-e44d-4b11-acf8-b0548b915686"]}, {"cve": "CVE-2023-26602", "desc": "ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.", "poc": ["http://packetstormsecurity.com/files/171137/ASUS-ASMB8-iKVM-1.14.51-SNMP-Remote-Root.html", "http://seclists.org/fulldisclosure/2023/Feb/15", "https://nwsec.de/NWSSA-002-2023.txt", "https://github.com/ARPSyndicate/cvemon", "https://github.com/D1G17/CVE-2023-26602", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38902", "desc": "A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field.", "poc": ["https://gist.github.com/ZIKH26/18693c67ee7d2f8d2c60231b19194c37"]}, {"cve": "CVE-2023-46116", "desc": "Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.", "poc": ["https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644"]}, {"cve": "CVE-2023-0797", "desc": "LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/495", "https://github.com/ARPSyndicate/cvemon", "https://github.com/peng-hui/CarpetFuzz", "https://github.com/waugustus/CarpetFuzz", "https://github.com/waugustus/waugustus"]}, {"cve": "CVE-2023-3304", "desc": "Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.", "poc": ["https://huntr.dev/bounties/721fae61-3c8c-4e4b-8407-64321bc0ed17"]}, {"cve": "CVE-2023-51252", "desc": "PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing.", "poc": ["https://github.com/sanluan/PublicCMS/issues/79"]}, {"cve": "CVE-2023-41729", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <=\u00a01.22.3.31 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20761", "desc": "In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628604; Issue ID: ALPS07628582.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1300", "desc": "A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222661 was assigned to this vulnerability.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-21253", "desc": "In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/nidhi7598/frameworks_base_AOSP10_r33_CVE-2023-21253"]}, {"cve": "CVE-2023-51689", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 Easy Video Player allows Stored XSS.This issue affects Easy Video Player: from n/a through 1.2.2.10.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38618", "desc": "Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40035", "desc": "Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.", "poc": ["https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phw"]}, {"cve": "CVE-2023-52342", "desc": "In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26081", "desc": "In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.", "poc": ["https://github.com/google/security-research/security/advisories/GHSA-mhhf-w9xw-pp9x"]}, {"cve": "CVE-2023-2178", "desc": "The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/e84b71f9-4208-4efb-90e8-1c778e7d2ebb"]}, {"cve": "CVE-2023-37208", "desc": "When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1837675"]}, {"cve": "CVE-2023-5511", "desc": "Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.", "poc": ["https://huntr.dev/bounties/43206801-9862-48da-b379-e55e341d78bf"]}, {"cve": "CVE-2023-23595", "desc": "BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as \"machine example.com login daniel password qwerty\" in the documentation example for the .netrc file format. NOTE: 2.x versions are no longer supported. There is no available information about whether any later version is affected.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/colemanjp/XXE-Vulnerability-in-Bluecat-Device-Registration-Portal-DRP"]}, {"cve": "CVE-2023-3664", "desc": "The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.", "poc": ["https://wpscan.com/vulnerability/d59e6eac-3ebf-40e0-800c-8cbef345423f"]}, {"cve": "CVE-2023-2240", "desc": "Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.", "poc": ["https://huntr.dev/bounties/8f595559-7b4b-4b00-954c-7a627766e203"]}, {"cve": "CVE-2023-51521", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36629", "desc": "The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read.", "poc": ["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hunting-for-android-privilege-escalation-with-a-32-line-fuzzer/", "https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2023-007_Xiaomi_Redmi_10sNote-1.txt"]}, {"cve": "CVE-2023-49406", "desc": "Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet.", "poc": ["https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_telnet/w30e_telnet.md"]}, {"cve": "CVE-2023-5877", "desc": "The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.", "poc": ["https://wpscan.com/vulnerability/39ed4934-3d91-4924-8acc-25759fef9e81"]}, {"cve": "CVE-2023-1388", "desc": "A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory block, resulting in the service becoming unavailable.", "poc": ["https://kcm.trellix.com/corporate/index?page=content&id=SB10398"]}, {"cve": "CVE-2023-52438", "desc": "In the Linux kernel, the following vulnerability has been resolved:binder: fix use-after-free in shinker's callbackThe mmap read lock is used during the shrinker's callback, which meansthat using alloc->vma pointer isn't safe as it can race with munmap().As of commit dd2283f2605e (\"mm: mmap: zap pages with read mmap_sem inmunmap\") the mmap lock is downgraded after the vma has been isolated.I was able to reproduce this issue by manually adding some delays andtriggering page reclaiming through the shrinker's debug sysfs. Thefollowing KASAN report confirms the UAF: ================================================================== BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758 ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368 vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8 vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7cFix this issue by performing instead a vma_lookup() which will fail tofind the vma that was isolated before the mmap lock downgrade. Note thatthis option has better performance than upgrading to a mmap write lockwhich would increase contention. Plus, mmap_write_trylock() has beenrecently removed anyway.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1110", "desc": "The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/1830e829-4a43-4d98-8214-eecec6bef694"]}, {"cve": "CVE-2023-40605", "desc": "Auth. (contributor) Cross-Site Scripting (XSS) vulnerability in 93digital Typing Effect plugin <=\u00a01.3.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7079", "desc": "Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34164", "desc": "Vulnerability of incomplete input parameter verification in the communication framework module. Successful exploitation of this vulnerability may affect availability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28101", "desc": "Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-49245", "desc": "Unauthorized access vulnerability in the Huawei Share module. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38127", "desc": "An integer overflow exists in the \"HyperLinkFrame\" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the parser to make an under-sized allocation, which can later allow for memory corruption, potentially resulting in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1808", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1808"]}, {"cve": "CVE-2023-28813", "desc": "An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files.", "poc": ["https://github.com/LOURC0D3/ENVY-gitbook", "https://github.com/LOURC0D3/LOURC0D3", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25120", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_dmvpn function with the cisco_secret variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-20635", "desc": "In keyinstall, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07563028; Issue ID: ALPS07563028.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Resery/Resery"]}, {"cve": "CVE-2023-26612", "desc": "D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the HostName field in SetParentsControlInfo.", "poc": ["https://github.com/726232111/VulIoT/tree/main/D-Link/DIR823G%20V1.0.2B05/HNAP1/SetParentsControlInfo"]}, {"cve": "CVE-2023-3654", "desc": "cashIT! - serving solutions. Devices from \"PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH\" to 03.A06rks 2023.02.37 are affected by a origin bypass via the host header in an HTTP request.\u00a0This vulnerability can be triggered by an HTTP endpoint exposed to the network.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0668", "desc": "Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.", "poc": ["https://gitlab.com/wireshark/wireshark/-/issues/19087", "https://takeonme.org/cves/CVE-2023-0668.html"]}, {"cve": "CVE-2023-25616", "desc": "In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object\u00a0execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. Successful attack could highly impact the confidentiality, Integrity, and Availability of the system.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-29087", "desc": "An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP Retry-After header.", "poc": ["http://packetstormsecurity.com/files/172295/Shannon-Baseband-SIP-Retry-After-Header-Heap-Buffer-Overflow.html"]}, {"cve": "CVE-2023-43803", "desc": "Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6020", "desc": "LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.", "poc": ["https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-41249", "desc": "In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40931", "desc": "A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-40851", "desc": "Cross Site Scripting (XSS) vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to run arbitrary code via fname, lname, email, and contact fields of the user registration page.", "poc": ["https://www.exploit-db.com/exploits/51694"]}, {"cve": "CVE-2023-34486", "desc": "itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote code execution can be achieved by entering malicious code in the date selection box.", "poc": ["https://github.com/JunyanYip/itsourcecode_justines_xss_vul"]}, {"cve": "CVE-2023-31723", "desc": "yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function expand_mmac_params at /nasm/nasm-pp.c.", "poc": ["https://github.com/DaisyPo/fuzzing-vulncollect/blob/main/yasm/SEGV/nasm-pp.c:4008%20in%20expand_mmac_params/README.md", "https://github.com/yasm/yasm/issues/220"]}, {"cve": "CVE-2023-23456", "desc": "A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.", "poc": ["https://github.com/upx/upx/issues/632"]}, {"cve": "CVE-2023-45004", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wp3sixty Woo Custom Emails plugin <=\u00a02.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42876", "desc": "The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to a denial-of-service or potentially disclose memory contents.", "poc": ["https://github.com/kohnakagawa/kohnakagawa"]}, {"cve": "CVE-2023-3987", "desc": "A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=user/manage_user&id=3. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235608.", "poc": ["https://github.com/draco1725/POC/blob/main/Exploit/Simple%20Online%20Men's%20Salon%20Management%20System/SQL%20Injection"]}, {"cve": "CVE-2023-5339", "desc": "Mattermost Desktop\u00a0fails to set an appropriate log level during initial run after fresh installation\u00a0resulting in logging all keystrokes\u00a0including password entry\u00a0being logged.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28104", "desc": "`silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with particularly large/complex graphql schemas. Users should upgrade to `silverstripe/graphql` 4.2.3 or 4.1.2 to remedy the vulnerability.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-4426", "desc": "** REJECT ** **REJECT** Not a valid security issue - vendor unable to replicate.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-47119", "desc": "Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.", "poc": ["https://github.com/BaadMaro/BaadMaro", "https://github.com/BaadMaro/CVE-2023-47119", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-2378", "desc": "A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation of the argument suffix-rate-up leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227654 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/4"]}, {"cve": "CVE-2023-49471", "desc": "Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make(), which could allow authenticated remote attackers to execute arbitrary code.", "poc": ["https://github.com/zunak/CVE-2023-49471", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zunak/CVE-2023-49471"]}, {"cve": "CVE-2023-43567", "desc": "A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.", "poc": ["https://support.lenovo.com/us/en/product_security/LEN-141775"]}, {"cve": "CVE-2023-7165", "desc": "The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.", "poc": ["https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/"]}, {"cve": "CVE-2023-1818", "desc": "Use after free in Vulkan in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/KirtiRamchandani/KirtiRamchandani"]}, {"cve": "CVE-2023-22795", "desc": "A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.", "poc": ["https://github.com/jasnow/585-652-ruby-advisory-db", "https://github.com/rubysec/ruby-advisory-db"]}, {"cve": "CVE-2023-28477", "desc": "Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5915", "desc": "A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation.\u00a0This vulnerability may allow to a remote attacker to cause a denial-of-service condition to the FCN/FCJ controller by sending a crafted packet. While sending the packet, the maintenance homepage of the controller could not be accessed. Therefore, functions of the maintenance homepage, changing configuration, viewing logs, etc. are not available. But the controller\u2019s operation is not stopped by the condition.The affected products and versions are as follows: STARDOM FCN/FCJ R1.01 to R4.31.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27637", "desc": "An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.", "poc": ["https://friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.html"]}, {"cve": "CVE-2023-4309", "desc": "Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused elections and enabled web application firewall (WAF) protection for current and future elections on or around 2023-08-12.", "poc": ["https://www.youtube.com/watch?v=yeG1xZkHc64", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6722", "desc": "A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of sensitive information. An attacker could access files such as application code or data, backend credentials, operating system files...", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36612", "desc": "Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses (containing sensitive information) to third-party applications by using a custom-crafted deeplink scheme.", "poc": ["https://github.com/Ch0pin/related_work"]}, {"cve": "CVE-2023-5057", "desc": "The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks", "poc": ["https://wpscan.com/vulnerability/58a63507-f0fd-46f1-a80c-6b1c41dddcf5"]}, {"cve": "CVE-2023-1714", "desc": "Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitrary code via (1) appending arbitrary content to existing PHP files or (2) PHAR deserialization.", "poc": ["https://starlabs.sg/advisories/23/23-1714/", "https://github.com/ForceFledgling/CVE-2023-1714", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5084", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.", "poc": ["https://huntr.dev/bounties/f3340570-6e59-4c72-a7d1-d4b829b4fb45"]}, {"cve": "CVE-2023-33218", "desc": "The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow. This could potentially lead to a Remote Code execution on the targeted device.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4382", "desc": "A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /user/settings of the component Profile Settings. The manipulation of the argument avatar leads to cross site scripting. The attack may be launched remotely. VDB-237314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["http://packetstormsecurity.com/files/174212/Hyip-Rio-2.1-Cross-Site-Scripting-File-Upload.html"]}, {"cve": "CVE-2023-49295", "desc": "quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6279", "desc": "The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name", "poc": ["https://wpscan.com/vulnerability/626bbc7d-0d0f-4418-ac61-666278a1cbdb/"]}, {"cve": "CVE-2023-28353", "desc": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to chain this vulnerability with others to cause a deployed DLL file to immediately execute as NT AUTHORITY/SYSTEM.", "poc": ["https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/", "https://research.nccgroup.com/?research=Technical%20advisories"]}, {"cve": "CVE-2023-3275", "desc": "A vulnerability classified as critical was found in PHPGurukul Rail Pass Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view-pass-detail.php of the component POST Request Handler. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The identifier VDB-231625 was assigned to this vulnerability.", "poc": ["https://github.com/scumdestroy/100-RedTeam-Projects"]}, {"cve": "CVE-2023-46672", "desc": "An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances.The prerequisites for the manifestation of this issue are: * Logstash is configured to log in JSON format https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html , which is not the default logging format. * Sensitive data is stored in the Logstash keystore and referenced as a variable in Logstash configuration.", "poc": ["https://www.elastic.co/community/security", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4250", "desc": "The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/9c271619-f478-45c3-91d9-be0f55ee06a2"]}, {"cve": "CVE-2023-50951", "desc": "IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive information about invalid authorization attempts. IBM X-Force ID: 275747.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2440", "desc": "The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'admin_page', 'userpro_verify_user' and 'verifyUnverifyAllUsers' functions. This makes it possible for unauthenticated attackers to modify the role of verified users to elevate verified user privileges to that of any user such as 'administrator' via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681"]}, {"cve": "CVE-2023-33894", "desc": "In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2672", "desc": "A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file items/view.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228888.", "poc": ["https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/CVE-2023-2672.md", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-0947", "desc": "Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.", "poc": ["https://huntr.dev/bounties/7379d702-72ff-4a5d-bc68-007290015496"]}, {"cve": "CVE-2023-0126", "desc": "Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.", "poc": ["https://github.com/Gerxnox/One-Liner-Collections", "https://github.com/thecybertix/One-Liner-Collections"]}, {"cve": "CVE-2023-4687", "desc": "The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts.", "poc": ["https://wpscan.com/vulnerability/31596fc5-4203-40c4-9b0a-e8a37faafddd"]}, {"cve": "CVE-2023-44252", "desc": "** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27801", "desc": "H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.", "poc": ["https://hackmd.io/@0dayResearch/DelDNSHnList"]}, {"cve": "CVE-2023-43789", "desc": "A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46071", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ClickDatos Protecci\u00f3n de Datos RGPD plugin <=\u00a03.1.0 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-30480", "desc": "Missing Authorization vulnerability in Sparkle WP Educenter.This issue affects Educenter: from n/a through 1.5.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46018", "desc": "SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \\allows attackers to run arbitrary SQL commands via 'remail' parameter.", "poc": ["https://github.com/ersinerenler/CVE-2023-46018-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability", "https://github.com/ersinerenler/CVE-2023-46018-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability", "https://github.com/ersinerenler/Code-Projects-Blood-Bank-1.0", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3771", "desc": "The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary websites.", "poc": ["https://wpscan.com/vulnerability/7c6fc499-de09-4874-ab96-bdc24d550cfb/"]}, {"cve": "CVE-2023-33320", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mohammad I. Okfie WP-Hijri plugin <=\u00a01.5.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20251", "desc": "A vulnerability in the memory buffer of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause memory leaks that could eventually lead to a device reboot.\nThis vulnerability is due to memory leaks caused by multiple clients connecting under specific conditions. An attacker could exploit this vulnerability by causing multiple wireless clients to attempt to connect to an access point (AP) on an affected device. A successful exploit could allow the attacker to cause the affected device to reboot after a significant amount of time, resulting in a denial of service (DoS) condition.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44466", "desc": "An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32.", "poc": ["https://github.com/google/security-research/security/advisories/GHSA-jg27-jx6w-xwph", "https://github.com/chenghungpan/test_data", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28748", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in biztechc Copy or Move Comments allows SQL Injection.This issue affects Copy or Move Comments: from n/a through 5.0.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33969", "desc": "Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an attacker to execute arbitrary Javascript and any user who views the task containing the malicious code will be exposed to the XSS attack. Note: The default CSP header configuration blocks this javascript attack. This issue has been addressed in version 1.2.30. Users are advised to upgrade. Users unable to upgrade should ensure that they have a restrictive CSP header config.", "poc": ["https://github.com/kanboard/kanboard/security/advisories/GHSA-8qvf-9847-gpc9"]}, {"cve": "CVE-2023-4462", "desc": "A vulnerability classified as problematic has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. This affects an unknown part of the component Web Configuration Application. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249255.", "poc": ["https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices", "https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"]}, {"cve": "CVE-2023-43995", "desc": "An issue in picot.golf mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33565", "desc": "** DISPUTED ** ROS2 (Robot Operating System 2) Foxy Fitzroy ROS_VERSION=2 and ROS_PYTHON_VERSION=3 are vulnerable to Denial-of-Service (DoS) attacks. A malicious user potentially exploited the vulnerability remotely and crashed the ROS2 nodes. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability.", "poc": ["https://github.com/16yashpatel/CVE-2023-33565", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/yashpatelphd/CVE-2023-33565"]}, {"cve": "CVE-2023-7160", "desc": "A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Add Engineer Handler. The manipulation of the argument first name/last name with the input leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249182 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.249182"]}, {"cve": "CVE-2023-3721", "desc": "The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/3f90347a-6586-4648-9f2c-d4f321bf801a"]}, {"cve": "CVE-2023-40000", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rxerium/CVE-2023-40000", "https://github.com/rxerium/stars", "https://github.com/securitycipher/daily-bugbounty-writeups"]}, {"cve": "CVE-2023-3618", "desc": "A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/jgamblin/cvelint-action", "https://github.com/mprpic/cvelint"]}, {"cve": "CVE-2023-3513", "desc": "Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to\u00a0gain SYSTEM privilege via communicating with the named pipe as a low-privilege user and triggering an insecure .NET deserialization.", "poc": ["https://starlabs.sg/advisories/23/23-3513/", "https://github.com/SohelParashar/.Net-Deserialization-Cheat-Sheet", "https://github.com/star-sg/CVE"]}, {"cve": "CVE-2023-45111", "desc": "Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.\u00a0The 'email' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5033", "desc": "A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /admin/category/cate-edit-run.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239877 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.239877"]}, {"cve": "CVE-2023-39143", "desc": "PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).", "poc": ["https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/", "https://github.com/codeb0ss/CVE-2023-39143", "https://github.com/netlas-io/netlas-dorks", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/nvn1729/advisories"]}, {"cve": "CVE-2023-21930", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-50312", "desc": "IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2342", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/01cd3ed5-dce8-4021-9de0-81cb14bf1829", "https://github.com/clearbluejar/ghidriff", "https://github.com/khanhchauminh/khanhchauminh"]}, {"cve": "CVE-2023-21923", "desc": "Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Health Sciences InForm. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Health Sciences InForm accessible data as well as unauthorized access to critical data or complete access to all Oracle Health Sciences InForm accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Health Sciences InForm. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-1067", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.", "poc": ["https://huntr.dev/bounties/31d17b34-f80d-49f2-86e7-97ae715cc045"]}, {"cve": "CVE-2023-50259", "desc": "Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testslack` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `slack_webhook` variable and passes it to the `notifiers.slack_notifier.test_notify` method, then `_notify_slack` and finally `_send_slack` method, which sends a POST request to the user-controlled URL on line 103 in `/medusa/notifiers/slack.py`, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.", "poc": ["https://github.com/pymedusa/Medusa/security/advisories/GHSA-8mcr-vffr-jwxv", "https://securitylab.github.com/advisories/GHSL-2023-201_GHSL-2023-202_Medusa/"]}, {"cve": "CVE-2023-39364", "desc": "Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php` file accepts `ref` as a URL parameter and reflects it in the form used to perform the change password. It's value is used to perform a redirect via `header` PHP function. A user can be tricked in performing the change password operation, e.g., via a phishing message, and then interacting with the malicious website where the redirection has been performed, e.g., downloading malwares, providing credentials, etc. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/Cacti/cacti/security/advisories/GHSA-4pjv-rmrp-r59x", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-4928", "desc": "SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.", "poc": ["https://huntr.dev/bounties/cb72cc17-5a0d-4392-9a5f-a13aa773de9e"]}, {"cve": "CVE-2023-26818", "desc": "Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.", "poc": ["https://github.com/Zeyad-Azima/CVE-2023-26818", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30620", "desc": "mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx", "https://github.com/Sim4n6/Sim4n6"]}, {"cve": "CVE-2023-27366", "desc": "Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20225.", "poc": ["https://github.com/Souf31/mqtt-pentest"]}, {"cve": "CVE-2023-21829", "desc": "Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Database RDBMS Security accessible data as well as unauthorized read access to a subset of Oracle Database RDBMS Security accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/MikeKutz/APEX--RAS-Cloud"]}, {"cve": "CVE-2023-5005", "desc": "The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/bfb174d4-7658-4883-a682-d06bda89ec44"]}, {"cve": "CVE-2023-28870", "desc": "Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged user accounts.", "poc": ["https://herolab.usd.de/en/security-advisories/usd-2022-0004/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39354", "desc": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c3r2-pxxp-f8r6"]}, {"cve": "CVE-2023-6655", "desc": "A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_selfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument parentid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247358 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/willchen0011/cve/blob/main/HongJing-sql.md", "https://github.com/20142995/sectool"]}, {"cve": "CVE-2023-3393", "desc": "Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.", "poc": ["https://huntr.dev/bounties/e4df9280-900a-407a-a07e-e7fef3345914"]}, {"cve": "CVE-2023-21894", "desc": "Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer issues). Supported versions that are affected are Prior to 13.9.4.2.11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Global Lifecycle Management NextGen OUI Framework executes to compromise Oracle Global Lifecycle Management NextGen OUI Framework. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Global Lifecycle Management NextGen OUI Framework. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-33010", "desc": "A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"]}, {"cve": "CVE-2023-21964", "desc": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-26311", "desc": "A remote code execution vulnerability in the webview component of OPPO Store app.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48225", "desc": "Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another obj, the name of the obj itself will be used as the key, and the entire object structure will be integrated intact. When constructing the deployment instance of the app, env was found from the database and directly inserted into the template, resulting in controllability here. Sensitive information in the secret and configmap can be read through the k8s envFrom field. In a privatization environment, when `namespaceConf. fixed` is marked, it may lead to the leakage of sensitive information in the system. As of time of publication, it is unclear whether any patches or workarounds exist.", "poc": ["https://github.com/labring/laf/security/advisories/GHSA-hv2g-gxx4-fwxp"]}, {"cve": "CVE-2023-2927", "desc": "A vulnerability was found in JIZHICMS 2.4.5. It has been classified as critical. Affected is the function index of the file TemplateController.php. The manipulation of the argument webapi leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230082 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/HuBenLab/HuBenVulList/blob/main/JiZhiCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md"]}, {"cve": "CVE-2023-27019", "desc": "Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_458FBC function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC10/8/8.md"]}, {"cve": "CVE-2023-52424", "desc": "The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an \"SSID Confusion\" issue. This occurs because the SSID is not always used to derive the pairwise master key or session keys, and because there is not a protected exchange of an SSID during a 4-way handshake.", "poc": ["https://www.top10vpn.com/assets/2024/05/Top10VPN-x-Vanhoef-SSID-Confusion.pdf", "https://github.com/giterlizzi/secdb-feeds", "https://github.com/securitycipher/daily-bugbounty-writeups"]}, {"cve": "CVE-2023-51684", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads \u2013 Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital Downloads \u2013 Sell Digital Files (eCommerce Store & Payments Made Easy): from n/a through 3.2.5.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29732", "desc": "SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.", "poc": ["https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29732/CVE%20detail.md"]}, {"cve": "CVE-2023-25210", "desc": "Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromSetSysTime function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC5/1/1.md"]}, {"cve": "CVE-2023-37174", "desc": "GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dump_isom_scene function at /mp4box/filedump.c.", "poc": ["https://github.com/gpac/gpac/issues/2505"]}, {"cve": "CVE-2023-25231", "desc": "Tenda Router W30E V1.0.1.25(633) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface.", "poc": ["https://github.com/Funcy33/Vluninfo_Repo/tree/main/CNVDs/104"]}, {"cve": "CVE-2023-0147", "desc": "The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/af9cbb4a-42fc-43c5-88f3-349b417f1a6a"]}, {"cve": "CVE-2023-3567", "desc": "A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.", "poc": ["http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html", "http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html", "https://github.com/nidhi7598/linux-4.1.15_CVE-2023-3567", "https://github.com/nidhi7598/linux-4.19.72_CVE-2023-3567"]}, {"cve": "CVE-2023-2813", "desc": "All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2, BunnyPressLite WordPress theme before 2.1, Cafe Bistro WordPress theme before 1.1.4, College WordPress theme before 1.5.1, Connections Reloaded WordPress theme through 3.1, Counterpoint WordPress theme through 1.8.1, Digitally WordPress theme through 1.0.8, Directory WordPress theme before 3.0.2, Drop WordPress theme before 1.22, Everse WordPress theme before 1.2.4, Fashionable Store WordPress theme through 1.3.4, Fullbase WordPress theme before 1.2.1, Ilex WordPress theme before 1.4.2, Js O3 Lite WordPress theme through 1.5.8.2, Js Paper WordPress theme through 2.5.7, Kata WordPress theme before 1.2.9, Kata App WordPress theme through 1.0.5, Kata Business WordPress theme through 1.0.2, Looki Lite WordPress theme before 1.3.0, moseter WordPress theme through 1.3.1, Nokke WordPress theme before 1.2.4, Nothing Personal WordPress theme through 1.0.7, Offset Writing WordPress theme through 1.2, Opor Ayam WordPress theme through 18, Pinzolo WordPress theme before 1.2.10, Plato WordPress theme before 1.1.9, Polka Dots WordPress theme through 1.2, Purity Of Soul WordPress theme through 1.9, Restaurant PT WordPress theme before 1.1.3, Saul WordPress theme before 1.1.0, Sean Lite WordPress theme before 1.4.6, Tantyyellow WordPress theme through 1.0.0.5, TIJAJI WordPress theme through 1.43, Tiki Time WordPress theme through 1.3, Tuaug4 WordPress theme through 1.4, Tydskrif WordPress theme through 1.1.3, UltraLight WordPress theme through 1.2, Venice Lite WordPress theme before 1.5.5, Viala WordPress theme through 1.3.1, viburno WordPress theme before 1.3.2, Wedding Bride WordPress theme before 1.0.2, Wlow WordPress theme before 1.2.7 suffer from the same issue about the search box reflecting the results causing XSS which allows an unauthenticated attacker to exploit against users if they click a malicious link.", "poc": ["https://wpscan.com/vulnerability/f434afd3-7de4-4bf4-a9bb-9f9aeaae1dc5", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1850", "desc": "A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-224990 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.224990"]}, {"cve": "CVE-2023-7198", "desc": "The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses a significant security risk as it violates the principle of least privilege and compromises the integrity and privacy of user data.", "poc": ["https://wpscan.com/vulnerability/75fbee63-d622-441f-8675-082907b0b1e6/"]}, {"cve": "CVE-2023-4078", "desc": "Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27893", "desc": "An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions 2088_1_700, 2008_1_710, 740, can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform.\u00a0 Depending on the function executed, the attack can read or modify any user or application data and can make the application unavailable.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-41964", "desc": "The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0428", "desc": "The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/c933460b-f77d-4986-9f5a-32d9f3f8b412"]}, {"cve": "CVE-2023-4797", "desc": "The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.", "poc": ["https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92/"]}, {"cve": "CVE-2023-43668", "desc": "Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,\u00a0some sensitive params checks will be bypassed, like \"autoDeserizalize\",\"allowLoadLocalInfile\".....\u00a0\u00a0Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.[1]\u00a0 https://github.com/apache/inlong/pull/8604", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nbxiglk0/nbxiglk0"]}, {"cve": "CVE-2023-38905", "desc": "SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.", "poc": ["https://gist.github.com/wealeson1/e24fc8575f4e051320d69e9a75080642"]}, {"cve": "CVE-2023-33625", "desc": "D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function.", "poc": ["https://github.com/naihsin/IoT/blob/main/D-Link/DIR-600/cmd%20injection/README.md", "https://github.com/naihsin/IoT/tree/main/D-Link/DIR-600/cmd%20injection"]}, {"cve": "CVE-2023-39185", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1887", "desc": "Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/e4a58835-96b5-412c-a17e-3ceed30231e1", "https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-4895", "desc": "An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the 'group ip restriction' settings to access environment details of projects", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45158", "desc": "An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.", "poc": ["https://github.com/Evan-Zhangyf/CVE-2023-45158", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-47320", "desc": "Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in \"Maintenance Mode\" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below.", "poc": ["https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320", "https://github.com/RhinoSecurityLabs/CVEs"]}, {"cve": "CVE-2023-1186", "desc": "A vulnerability has been found in FabulaTech Webcam for Remote Desktop 2.8.42 and classified as problematic. This vulnerability affects the function 0x222010/0x222018 in the library ftwebcam.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-222358 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1186", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-20592", "desc": "Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity.", "poc": ["https://github.com/cispa/CacheWarp"]}, {"cve": "CVE-2023-24880", "desc": "Windows SmartScreen Security Feature Bypass Vulnerability", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/karimhabush/cyberowl", "https://github.com/whitfieldsdad/cisa_kev"]}, {"cve": "CVE-2023-30372", "desc": "In Tenda AC15 V15.03.05.19, The function \"xkjs_ver32\" contains a stack-based buffer overflow vulnerability.", "poc": ["https://github.com/2205794866/Tenda/blob/main/AC15/10.md"]}, {"cve": "CVE-2023-1713", "desc": "Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticated attackers to execute arbitrary code via uploading a crafted \".htaccess\" file.", "poc": ["https://starlabs.sg/advisories/23/23-1713/", "https://github.com/ForceFledgling/CVE-2023-1713", "https://github.com/k1rurk/check_bitrix", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-31740", "desc": "There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the apply.cgi interface, thereby gaining shell privileges.", "poc": ["https://github.com/D2y6p/CVE/blob/main/Linksys/CVE-2023-31740/Linksys_E2000_RCE.pdf"]}, {"cve": "CVE-2023-33833", "desc": "IBM Security Verify Information Queue 10.0.4 and 10.0.5 stores sensitive information in plain clear text which can be read by a local user. IBM X-Force ID: 256013.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5483", "desc": "Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27290", "desc": "Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write access. IBM X-Force ID: 248737.", "poc": ["http://packetstormsecurity.com/files/171770/IBM-Instana-243-0-Missing-Authentication.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/karimhabush/cyberowl", "https://github.com/zipponnova/IBM-Instana-Exploits", "https://github.com/zipponnova/Microservices-Exploitation"]}, {"cve": "CVE-2023-0923", "desc": "A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27720", "desc": "D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_48d630 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/HolyTruth/DIR_878-1.30B08/blob/main/4.md"]}, {"cve": "CVE-2023-5956", "desc": "The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/b3d1fbae-88c9-45d1-92c6-0a529b21e3b2/"]}, {"cve": "CVE-2023-34346", "desc": "A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_20221108. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1764"]}, {"cve": "CVE-2023-31613", "desc": "An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "poc": ["https://github.com/openlink/virtuoso-opensource/issues/1121", "https://github.com/Sedar2024/Sedar"]}, {"cve": "CVE-2023-2583", "desc": "Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.", "poc": ["https://huntr.dev/bounties/397ea68d-1e28-44ff-b830-c8883d067d96"]}, {"cve": "CVE-2023-6342", "desc": "Tyler Technologies Court Case Management Plus allows a remote attacker to authenticate as any user by manipulating at least the 'CmWebSearchPfp/Login.aspx?xyzldk=' and 'payforprint_CM/Redirector.ashx?userid=' parameters. The vulnerable \"pay for print\" feature was removed on or around 2023-11-01.", "poc": ["https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/", "https://github.com/qwell/disorder-in-the-court"]}, {"cve": "CVE-2023-24051", "desc": "A client side rate limit issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via brute force style attacks.", "poc": ["https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/"]}, {"cve": "CVE-2023-3855", "desc": "A vulnerability classified as problematic was found in phpscriptpoint JobSeeker 1.5. Affected by this vulnerability is an unknown functionality of the file /search-result.php. The manipulation of the argument kw/lc/ct/cp/p leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235207. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22325", "desc": "A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736"]}, {"cve": "CVE-2023-49425", "desc": "Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg .", "poc": ["https://github.com/ef4tless/vuln/blob/master/iot/AX12/setMacFilterCfg.md"]}, {"cve": "CVE-2023-2951", "desc": "A vulnerability classified as critical has been found in code-projects Bus Dispatch and Information System 1.0. Affected is an unknown function of the file delete_bus.php. The manipulation of the argument busid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230112.", "poc": ["https://github.com/1-tong/vehicle_cves", "https://github.com/Spr1te76/CVE-2023-2951", "https://github.com/Vu1nT0tal/Vehicle-Security", "https://github.com/VulnTotal-Team/Vehicle-Security", "https://github.com/VulnTotal-Team/vehicle_cves", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-43274", "desc": "Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter.", "poc": ["https://github.com/nu11secur1ty/CVE-nu11secur1ty"]}, {"cve": "CVE-2023-5889", "desc": "Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.", "poc": ["https://huntr.com/bounties/fba2991a-1b8a-4c89-9689-d708526928e1"]}, {"cve": "CVE-2023-4436", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0. This issue affects some unknown processing of the file app/action/edit_update.php. The manipulation of the argument user_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237557 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6901", "desc": "A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/handle-command.php of the component HTTP POST Request Handler. The manipulation of the argument command with the input whoami leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248259.", "poc": ["https://github.com/g1an123/POC/blob/main/README.md"]}, {"cve": "CVE-2023-43801", "desc": "Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1088", "desc": "The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/a956f1cd-fce4-4235-b1af-4b7675a60ca2"]}, {"cve": "CVE-2023-4649", "desc": "Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.", "poc": ["https://huntr.dev/bounties/069bb1f3-0805-480d-a6e1-b3345cdc60f3"]}, {"cve": "CVE-2023-45992", "desc": "A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, could allow the attacker to gain full admin privileges on the exploited system.", "poc": ["https://github.com/harry935/CVE-2023-45992", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/harry935/CVE-2023-45992", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-27293", "desc": "Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal other users\u2019 cookies and force users to make actions without their knowledge.", "poc": ["https://www.tenable.com/security/research/tra-2023-8"]}, {"cve": "CVE-2023-52223", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite \u2013 WooCommerce integration.This issue affects MailerLite \u2013 WooCommerce integration: from n/a through 2.0.8.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40010", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in realmag777 HUSKY \u2013 Products Filter for WooCommerce Professional.This issue affects HUSKY \u2013 Products Filter for WooCommerce Professional: from n/a through 1.3.4.2.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24367", "desc": "** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/mrojz/T24"]}, {"cve": "CVE-2023-33510", "desc": "Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.", "poc": ["https://carl1l.github.io/2023/05/08/jeecg-p3-biz-chat-1-0-5-jar-has-arbitrary-file-read-vulnerability/", "https://github.com/izj007/wechat", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-28436", "desc": "Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in version 1.34.0 and prior to prior to 1.38.2 in FreeBSD allows commands to be run with a higher privilege group ID than that specified in Tailscale SSH access rules. A difference in the behavior of the FreeBSD `setgroups` system call from POSIX meant that the Tailscale client running on a FreeBSD-based operating system did not appropriately restrict groups on the host when using Tailscale SSH. When accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process was used instead of that of the user specified in Tailscale SSH access rules. Tailscale SSH commands may have been run with a higher privilege group ID than that specified in Tailscale SSH access rules if they met all of the following criteria: the destination node was a FreeBSD device with Tailscale SSH enabled; Tailscale SSH access rules permitted access for non-root users; and a non-interactive SSH session was used. Affected users should upgrade to version 1.38.2 to remediate the issue.", "poc": ["https://tailscale.com/security-bulletins/#ts-2023-003"]}, {"cve": "CVE-2023-2942", "desc": "Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.", "poc": ["https://huntr.dev/bounties/dd56e7a0-9dff-48fc-bc59-9a22d91869eb"]}, {"cve": "CVE-2023-46952", "desc": "Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer header.", "poc": ["https://github.com/SadFox/ABO.CMS-Blind-XSS"]}, {"cve": "CVE-2023-39125", "desc": "NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c because a file's width, height, and BPP are not validated. NOTE: the vendor's perspective is \"this main application was not intended to be a well tested program, it's just something to demonstrate it works and for the user to see how to integrate it into their own programs.\"", "poc": ["https://github.com/LMP88959/NTSC-CRT/issues/32"]}, {"cve": "CVE-2023-3201", "desc": "The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This makes it possible for unauthenticated attackers to update new order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-39172", "desc": "The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.", "poc": ["https://seclists.org/fulldisclosure/2023/Nov/4"]}, {"cve": "CVE-2023-20711", "desc": "In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07581668; Issue ID: ALPS07581668.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Resery/Resery"]}, {"cve": "CVE-2023-22016", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.46 and Prior to 7.0.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-27856", "desc": "In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-31286", "desc": "An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist.", "poc": ["http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html", "http://seclists.org/fulldisclosure/2023/May/14"]}, {"cve": "CVE-2023-0571", "desc": "A vulnerability has been found in SourceCodester Canteen Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file createcustomer.php of the component Add Customer. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219730 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/ctflearner/Vulnerability/blob/main/Canteen%20Management%20System/Canteen_Management_System_XSS_IN_Add_Customer.md", "https://vuldb.com/?id.219730", "https://github.com/ctflearner/ctflearner"]}, {"cve": "CVE-2023-24026", "desc": "In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.", "poc": ["https://github.com/sixgroup-security/CVE"]}, {"cve": "CVE-2023-5060", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1.", "poc": ["https://huntr.dev/bounties/01b0917d-f92f-4903-9eca-bcfc46e847e3"]}, {"cve": "CVE-2023-27493", "desc": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy\u2019s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.", "poc": ["https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5w5-487h-qv8q"]}, {"cve": "CVE-2023-4697", "desc": "Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.", "poc": ["https://huntr.dev/bounties/3ff3325a-1dcb-4da7-894d-81a9cf726d81", "https://github.com/sjkp/devopsai"]}, {"cve": "CVE-2023-28346", "desc": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate with the private API endpoints exposed at /login, /consoleSettings, /console, etc. despite Virtual Host Routing being used to block this access. Remote attackers can interact with private pages on the web server, enabling them to perform privileged actions such as logging into the console and changing console settings if they have valid credentials.", "poc": ["https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/", "https://research.nccgroup.com/?research=Technical%20advisories"]}, {"cve": "CVE-2023-46088", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <=\u00a01.6.1 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-28867", "desc": "In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/srchen1987/springcloud-distributed-transaction"]}, {"cve": "CVE-2023-50693", "desc": "An issue in Jester v.0.6.0 and before allows a remote attacker to send a malicious crafted request.", "poc": ["https://github.com/dom96/jester/issues/326"]}, {"cve": "CVE-2023-44483", "desc": "All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled.\u00a0Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.", "poc": ["https://github.com/phax/ph-xmldsig"]}, {"cve": "CVE-2023-31099", "desc": "Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.", "poc": ["https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-33084", "desc": "Transient DOS while processing IE fragments from server during DTLS handshake.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44011", "desc": "An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at the Skin management component.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38431", "desc": "An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read.", "poc": ["https://github.com/chenghungpan/test_data", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44809", "desc": "D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.", "poc": ["https://github.com/Archerber/bug_submit/blob/main/D-Link/DIR-820l/bug1.md"]}, {"cve": "CVE-2023-32790", "desc": "Cross-Site Scripting (XSS) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inject a malicious JavaScript payload into the 'Full Name' field during a user edit, due to improper sanitization of the input parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24165", "desc": "Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/initIpAddrInfo.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC18/7/7.md"]}, {"cve": "CVE-2023-6377", "desc": "A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1572", "desc": "A vulnerability has been found in DataGear up to 1.11.1 and classified as problematic. This vulnerability affects unknown code of the component Plugin Handler. The manipulation leads to cross site scripting. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223564.", "poc": ["https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-32433", "desc": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-47619", "desc": "Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of time of publication, no patches are available.", "poc": ["https://securitylab.github.com/advisories/GHSL-2023-203_GHSL-2023-204_audiobookshelf/"]}, {"cve": "CVE-2023-1532", "desc": "Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/171959/Chrome-media-mojom-VideoFrame-Missing-Validation.html", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-5850", "desc": "Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33970", "desc": "Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, which allows a User with the lowest privileges to leak all the tasks and projects titles within the software, even if they are not invited or it's a personal project. This could also lead to private/critical information being leaked if such information is in the title. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["https://github.com/kanboard/kanboard/security/advisories/GHSA-wfch-8rhv-v286"]}, {"cve": "CVE-2023-5989", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies LioXERP allows Stored XSS.This issue affects LioXERP: before v.146.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6906", "desc": "A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag with the input ie8 leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248268. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/unpWn4bL3/iot-security/blob/main/1.md"]}, {"cve": "CVE-2023-22803", "desc": "LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily.", "poc": ["https://github.com/goheea/goheea"]}, {"cve": "CVE-2023-40989", "desc": "SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.", "poc": ["https://github.com/Zone1-Z/CVE-2023-40989", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-28638", "desc": "Snappier is a high performance C# implementation of the Snappy compression algorithm. This is a buffer overrun vulnerability that can affect any user of Snappier 1.1.0. In this release, much of the code was rewritten to use byte references rather than pointers to pinned buffers. This change generally improves performance and reduces workload on the garbage collector. However, when the garbage collector performs compaction and rearranges memory, it must update any byte references on the stack to refer to the updated location. The .NET garbage collector can only update these byte references if they still point within the buffer or to a point one byte past the end of the buffer. If they point outside this area, the buffer itself may be moved while the byte reference stays the same. There are several places in 1.1.0 where byte references very briefly point outside the valid areas of buffers. These are at locations in the code being used for buffer range checks. While the invalid references are never dereferenced directly, if a GC compaction were to occur during the brief window when they are on the stack then it could invalidate the buffer range check and allow other operations to overrun the buffer. This should be very difficult for an attacker to trigger intentionally. It would require a repetitive bulk attack with the hope that a GC compaction would occur at precisely the right moment during one of the requests. However, one of the range checks with this problem is a check based on input data in the decompression buffer, meaning malformed input data could be used to increase the chance of success. Note that any resulting buffer overrun is likely to cause access to protected memory, which will then cause an exception and the process to be terminated. Therefore, the most likely result of an attack is a denial of service. This issue has been patched in release 1.1.1. Users are advised to upgrade. Users unable to upgrade may pin buffers to a fixed location before using them for compression or decompression to mitigate some, but not all, of these cases. At least one temporary decompression buffer is internal to the library and never pinned.", "poc": ["https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-2676", "desc": "A vulnerability, which was classified as critical, has been found in H3C R160 V1004004. Affected by this issue is some unknown functionality of the file /goForm/aspForm. The manipulation of the argument go leads to stack-based buffer overflow. The exploit has been disclosed to the public and may be used. VDB-228890 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/xinzhihen06/dxq-cve/blob/main/h3cr160.md"]}, {"cve": "CVE-2023-31541", "desc": "A unrestricted file upload vulnerability was discovered in the \u2018Browse and upload images\u2019 feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.", "poc": ["https://github.com/DreamD2v/CVE-2023-31541", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-25348", "desc": "ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.", "poc": ["https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25348", "https://github.com/10splayaSec/CVE-Disclosures", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-3656", "desc": "cashIT! - serving solutions. Devices from \"PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH\" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-48121", "desc": "An authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior to v5.3.x build 20230401, Ezviz CS-CV310-xxx prior to v5.3.x build 20230401, Ezviz CS-C6CN-xxx prior to v5.3.x build 20230401, Ezviz CS-C3N-xxx prior to v5.3.x build 20230401 allows remote attackers to obtain sensitive information by sending crafted messages to the affected devices.", "poc": ["https://joerngermany.github.io/ezviz_vulnerability/", "https://github.com/joerngermany/ezviz_vulnerability"]}, {"cve": "CVE-2023-1080", "desc": "The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018tab\u2019 parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-22952", "desc": "In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.", "poc": ["http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/h00die-gr3y/Metasploit", "https://github.com/jakabakos/PHP-payload-injection-to-PNGs", "https://github.com/santosomar/kev_checker"]}, {"cve": "CVE-2023-30402", "desc": "** DISPUTED ** YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.", "poc": ["https://github.com/yasm/yasm/issues/206"]}, {"cve": "CVE-2023-5238", "desc": "The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.", "poc": ["https://wpscan.com/vulnerability/47a5fbfd-f47c-4356-8567-b29dadb48423"]}, {"cve": "CVE-2023-6320", "desc": "A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this vulnerability.Full versions and TV models affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA\u00a0 * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44769", "desc": "A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias.", "poc": ["https://github.com/sromanhu/CVE-2023-44769_ZenarioCMS--Reflected-XSS---Alias/tree/main", "https://github.com/sromanhu/ZenarioCMS--Reflected-XSS---Alias/tree/main", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-44769_ZenarioCMS--Reflected-XSS---Alias"]}, {"cve": "CVE-2023-49299", "desc": "Improper Input Validation vulnerability in Apache DolphinScheduler. An\u00a0authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9.Users are recommended to upgrade to version 3.1.9, which fixes the issue.", "poc": ["https://github.com/Drun1baby/JavaSecurityLearning"]}, {"cve": "CVE-2023-26866", "desc": "GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete takeover.", "poc": ["https://github.com/lionelmusonza/CVE-2023-26866", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-47250", "desc": "In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to a VNC session) to access the X11 desktops of other users by specifying their DISPLAY ID. This allows complete control of their desktop, including the ability to inject keystrokes and perform a keylogging attack.", "poc": ["http://packetstormsecurity.com/files/175949/m-privacy-TightGate-Pro-Code-Execution-Insecure-Permissions.html", "http://seclists.org/fulldisclosure/2023/Nov/13", "https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-m-privacy-tightgate-pro/"]}, {"cve": "CVE-2023-5121", "desc": "The Migration, Backup, Staging \u2013 WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33194", "desc": "Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn\u2019t fix it when clicking save. This issue was patched in version 4.4.6.", "poc": ["https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9"]}, {"cve": "CVE-2023-37711", "desc": "Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the deviceId parameter in the saveParentControlInfo function.", "poc": ["https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/saveParentControlInfo"]}, {"cve": "CVE-2023-34452", "desc": "Grav is a flat-file content management system. In versions 1.7.42 and prior, the \"/forgot_password\" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the \"email\" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browser, the impact is limited as it requires user interaction to trigger the vulnerability. As of time of publication, a patch is not available. Server-side validation should be implemented to prevent this vulnerability.", "poc": ["https://github.com/getgrav/grav/security/advisories/GHSA-xcr8-cc2j-62fc"]}, {"cve": "CVE-2023-36947", "desc": "TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.", "poc": ["https://github.com/Archerber/bug_submit/blob/main/TOTOLINK/UploadCustomModule.md"]}, {"cve": "CVE-2023-1188", "desc": "A vulnerability was found in FabulaTech Webcam for Remote Desktop 2.8.42. It has been classified as problematic. Affected is the function 0x222018 in the library ftwebcam.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222360.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1188", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-6869", "desc": "A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to display under the guise of trusted content. This vulnerability affects Firefox < 121.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23581", "desc": "A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1741"]}, {"cve": "CVE-2023-1882", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://huntr.dev/bounties/8ab09a1c-cfd5-4ce0-aae3-d33c93318957", "https://github.com/punggawacybersecurity/CVE-List"]}, {"cve": "CVE-2023-45657", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSIMYTH Nexter allows SQL Injection.This issue affects Nexter: from n/a through 2.0.3.", "poc": ["https://github.com/RandomRobbieBF/CVE-2023-45657", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1473", "desc": "The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/a6e6c67b-7d9b-4fdb-8115-c33add7bfc3d"]}, {"cve": "CVE-2023-0301", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.", "poc": ["https://huntr.dev/bounties/8a91e127-2903-4c6b-9a66-e4d2e30f8dec"]}, {"cve": "CVE-2023-22995", "desc": "In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17"]}, {"cve": "CVE-2023-40135", "desc": "In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"]}, {"cve": "CVE-2023-32173", "desc": "Unified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the product is in its default configuration.The specific flaw exists within the implementation of the AddServer method. By specifying crafted arguments, an attacker can cause invalid characters to be inserted into an XML configuration file. An attacker can leverage this vulnerability to create a persistent denial-of-service condition on the system. . Was ZDI-CAN-20576.", "poc": ["https://github.com/0vercl0k/pwn2own2023-miami"]}, {"cve": "CVE-2023-4195", "desc": "PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.", "poc": ["https://huntr.dev/bounties/0bd5da2f-0e29-47ce-90f3-06518656bfd6"]}, {"cve": "CVE-2023-25116", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the local_virtual_ip and the remote_virtual_ip variables.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-4437", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/search_sell_paymen_report.php. The manipulation of the argument customer leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-237558 is the identifier assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.237558"]}, {"cve": "CVE-2023-37529", "desc": "A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information. This is not the same vulnerability as identified in CVE-2023-37530.", "poc": ["https://github.com/kaje11/CVEs"]}, {"cve": "CVE-2023-5320", "desc": "Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.", "poc": ["https://huntr.dev/bounties/3a2bc18b-5932-4fb5-a01e-24b2b0443b67"]}, {"cve": "CVE-2023-44348", "desc": "Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44044", "desc": "Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php.", "poc": ["https://github.com/TishaManandhar/Superstore-sql-poc/blob/main/SQL"]}, {"cve": "CVE-2023-6930", "desc": "EuroTel ETL3100 versions v01c01 and v01x37 suffer from an unauthenticated configuration and log download vulnerability. This enables the attacker to disclose sensitive information and assist in authentication bypass, privilege escalation, and full system access.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05"]}, {"cve": "CVE-2023-7247", "desc": "The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.", "poc": ["https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharing", "https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841/"]}, {"cve": "CVE-2023-44096", "desc": "Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35781", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in LWS Cleaner plugin <=\u00a02.3.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24343", "desc": "D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSchedule.", "poc": ["https://github.com/1160300418/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/01"]}, {"cve": "CVE-2023-1009", "desc": "** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub_1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input /../etc/passwd- leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221742 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "poc": ["https://github.com/xxy1126/Vuln/blob/main/Draytek/1.md"]}, {"cve": "CVE-2023-50859", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through 2.1.6.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30446", "desc": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253361.", "poc": ["https://www.ibm.com/support/pages/node/7010557"]}, {"cve": "CVE-2023-45007", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fotomoto plugin <=\u00a01.2.8 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47215", "desc": "Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.", "poc": ["https://github.com/mute1008/mute1008", "https://github.com/mute1997/mute1997"]}, {"cve": "CVE-2023-40845", "desc": "Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'sub_34FD0.' In the function, it reads user provided parameters and passes variables to the function without any length checks.", "poc": ["https://github.com/XYIYM/Digging/blob/main/Tenda/AC6/bof/14/14.md"]}, {"cve": "CVE-2023-23073", "desc": "Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.", "poc": ["https://bugbounty.zohocorp.com/bb/#/bug/101000006459171?tab=originator"]}, {"cve": "CVE-2023-5843", "desc": "The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.", "poc": ["https://github.com/codeb0ss/CVE-2023-5843-PoC", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49083", "desc": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.", "poc": ["http://www.openwall.com/lists/oss-security/2023/11/29/2", "https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-2362", "desc": "The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", "poc": ["https://wpscan.com/vulnerability/27e70507-fd68-4915-88cf-0b96ed55208e"]}, {"cve": "CVE-2023-32516", "desc": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GloriaFood Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation plugin <=\u00a02.3.6 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41578", "desc": "Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.", "poc": ["https://github.com/Snakinya/Snakinya"]}, {"cve": "CVE-2023-42663", "desc": "Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.", "poc": ["https://github.com/Y4tacker/JavaSec"]}, {"cve": "CVE-2023-33866", "desc": "A use-after-free vulnerability exists in the JavaScript engine of Foxit Software\u2019s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1757"]}, {"cve": "CVE-2023-4724", "desc": "The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server", "poc": ["https://wpscan.com/vulnerability/48820f1d-45cb-4f1f-990d-d132bfc5536f", "https://github.com/dipa96/my-days-and-not"]}, {"cve": "CVE-2023-41737", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGens Swifty Bar, sticky bar by WPGens plugin <=\u00a01.2.10 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-22608", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none", "poc": ["https://github.com/13579and2468/Wei-fuzz"]}, {"cve": "CVE-2023-33035", "desc": "Memory corruption while invoking callback function of AFE from ADSP.", "poc": ["https://github.com/Moonshieldgru/Moonshieldgru"]}, {"cve": "CVE-2023-41821", "desc": "A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30560", "desc": "The configuration from the PCU can be modified without authentication using physical connection to the PCU.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7101", "desc": "Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type \u201ceval\u201d. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.", "poc": ["https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md", "https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc", "https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html", "https://github.com/Ostorlab/KEV", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/vinzel-ops/vuln-barracuda"]}, {"cve": "CVE-2023-5860", "desc": "The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31418", "desc": "An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.", "poc": ["https://www.elastic.co/community/security"]}, {"cve": "CVE-2023-4805", "desc": "The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/1049e940-49b1-4236-bea2-c636f35c5647"]}, {"cve": "CVE-2023-22004", "desc": "Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Reports Configuration). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Technology accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-44855", "desc": "Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a remote attacker to execute arbitrary code via a crafted script to the rdiag, sender, and recipients parameters of the sub_219C4 function in the acu_web file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39246", "desc": "Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure Operation on Windows Junction Vulnerability during installation. A local malicious user could potentially exploit this vulnerability to create an arbitrary folder inside a restricted directory, leading to Privilege Escalation", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44016", "desc": "Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.", "poc": ["https://github.com/aixiao0621/Tenda/blob/main/AC10U/7/0.md", "https://github.com/aixiao0621/Tenda"]}, {"cve": "CVE-2023-4858", "desc": "The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://github.com/nightcloudos/bug_report/blob/main/vendors/poc2.md", "https://wpscan.com/vulnerability/ef8029e0-9282-401a-a77d-10b6656adaa6"]}, {"cve": "CVE-2023-25105", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_ike_profile function with the secrets_remote variable.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-22098", "desc": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: Only applicable to 7.0.x platform. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).", "poc": ["https://github.com/google/security-research"]}, {"cve": "CVE-2023-38975", "desc": "* Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked_vectors.rs component.", "poc": ["https://github.com/qdrant/qdrant/issues/2268"]}, {"cve": "CVE-2023-2935", "desc": "Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/173196/Chrome-v8-internal-Object-SetPropertyWithAccessor-Type-Confusion.html"]}, {"cve": "CVE-2023-6548", "desc": "Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway\u00a0allows an attacker with\u00a0access\u00a0to NSIP, CLIP or SNIP with management interface to perform\u00a0Authenticated (low privileged) remote code execution on Management Interface.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Roonye660/CVE-2023-6548-POC", "https://github.com/jake-44/Research", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-4539", "desc": "Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Comarch ERP XL installations. This issue affects ERP XL: from 2020.2.2 through 2023.2.", "poc": ["https://github.com/defragmentator/mitmsqlproxy"]}, {"cve": "CVE-2023-43252", "desc": "XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow via a crafted image file.", "poc": ["http://packetstormsecurity.com/files/175145/XNSoft-Nconvert-7.136-Buffer-Overflow-Denial-Of-Service.html", "http://seclists.org/fulldisclosure/2023/Oct/15", "https://github.com/mrtouch93/exploits"]}, {"cve": "CVE-2023-23714", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <=\u00a03.6.4.1 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/UncannyOwl/Uncanny-Toolkit-for-LearnDash"]}, {"cve": "CVE-2023-1938", "desc": "The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wp_remote_get() function, leading to a Blind SSRF issue", "poc": ["https://wpscan.com/vulnerability/92b1c6d8-51db-46aa-bde6-abdfb091aab5"]}, {"cve": "CVE-2023-2761", "desc": "The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/8c82d317-f9f9-4e25-a7f1-43edb77e8aba", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2666", "desc": "Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.", "poc": ["https://huntr.dev/bounties/0bbdc9d4-d9dc-4490-93ef-0a83b451a20f"]}, {"cve": "CVE-2023-1741", "desc": "A vulnerability was found in jeecg-boot 3.5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file SysDictMapper.java of the component Sleep Command Handler. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224629 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.224629"]}, {"cve": "CVE-2023-2479", "desc": "OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.", "poc": ["https://github.com/Marco-zcl/POC", "https://github.com/d4n-sec/d4n-sec.github.io", "https://github.com/tanjiti/sec_profile", "https://github.com/wjlin0/poc-doc", "https://github.com/wy876/POC", "https://github.com/xingchennb/POC-", "https://github.com/zn9988/publications"]}, {"cve": "CVE-2023-38602", "desc": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file system.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-37628", "desc": "Online Piggery Management System 1.0 is vulnerable to SQL Injection.", "poc": ["https://github.com/1337kid/Piggery_CMS_multiple_vulns_PoC/tree/main/CVE-2023-37628", "https://github.com/1337kid/Piggery_CMS_multiple_vulns_PoC"]}, {"cve": "CVE-2023-27114", "desc": "radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c.", "poc": ["https://github.com/radareorg/radare2/issues/21363"]}, {"cve": "CVE-2023-23997", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <=\u00a01.2.7 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35966", "desc": "Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger these vulnerabilities.This integer overflow result is used as argument for the realloc function.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1787"]}, {"cve": "CVE-2023-4218", "desc": "In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/sahilagichani14/sootUpTutorial"]}, {"cve": "CVE-2023-50333", "desc": "Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing\u00a0freshly demoted guests to change group names.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3218", "desc": "Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.", "poc": ["https://huntr.dev/bounties/94d50b11-20ca-46e3-9086-dd6836421675"]}, {"cve": "CVE-2023-45283", "desc": "The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.", "poc": ["https://github.com/20142995/sectool", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5882", "desc": "The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.", "poc": ["https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2", "https://github.com/dipa96/my-days-and-not"]}, {"cve": "CVE-2023-51704", "desc": "An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41325", "desc": "OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, `shdr_verify_signature` can make a double free. `shdr_verify_signature` used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (`sw_crypto_acipher_alloc_rsa_public_key`) will try to allocate a memory (which is optee\u2019s heap memory). RSA key is consist of exponent and modulus (represent as variable `e`, `n`) and it allocation is not atomic way, so it may succeed in `e` but fail in `n`. In this case sw_crypto_acipher_alloc_rsa_public_key` will free on `e` and return as it is failed but variable \u2018e\u2019 is remained as already freed memory address . `shdr_verify_signature` will free again that memory (which is `e`) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available.", "poc": ["https://github.com/OP-TEE/optee_os/security/advisories/GHSA-jrw7-63cq-7vhm"]}, {"cve": "CVE-2023-45798", "desc": "In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2281", "desc": "When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-4448", "desc": "A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 4dff387283060961c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier VDB-237569 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.237569"]}, {"cve": "CVE-2023-36562", "desc": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35794", "desc": "An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only Basic Authentication to the SSH console.", "poc": ["https://github.com/Dodge-MPTC/CVE-2023-35794-WebSSH-Hijacking", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-41814", "desc": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving the messages opens their notifications.\u00a0This issue affects Pandora FMS: from 700 through 774.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5914", "desc": "Cross-site scripting (XSS)", "poc": ["https://github.com/SohelParashar/.Net-Deserialization-Cheat-Sheet"]}, {"cve": "CVE-2023-37142", "desc": "ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees().", "poc": ["https://github.com/chakra-core/ChakraCore/issues/6887"]}, {"cve": "CVE-2023-50873", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages.This issue affects Add Any Extension to Pages: from n/a through 1.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32418", "desc": "The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. Processing a file may lead to unexpected app termination or arbitrary code execution.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores"]}, {"cve": "CVE-2023-47757", "desc": "Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber \u2013 Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects AWeber \u2013 Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth: from n/a through 7.3.9.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45866", "desc": "Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.", "poc": ["https://github.com/skysafe/reblog/tree/main/cve-2023-45866", "https://github.com/Eason-zz/BluetoothDucky", "https://github.com/V33RU/CommandInWiFi", "https://github.com/V33RU/CommandInWiFi-Zeroclick", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/gato001k1/helt", "https://github.com/jjjjjjjj987/cve-2023-45866-py", "https://github.com/johe123qwe/github-trending", "https://github.com/marcnewlin/hi_my_name_is_keyboard", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/pentestfunctions/BlueDucky", "https://github.com/sampsonv/github-trending", "https://github.com/shirin-ehtiram/hi_my_name_is_keyboard", "https://github.com/tanjiti/sec_profile", "https://github.com/vs4vijay/exploits", "https://github.com/zhaoxiaoha/github-trending"]}, {"cve": "CVE-2023-6152", "desc": "A user changing their email after signing up and verifying it can change it without verification in profile settings.The configuration option \"verify_email_enabled\" will only validate email only on sign up.", "poc": ["https://github.com/grafana/bugbounty/security/advisories/GHSA-3hv4-r2fm-h27f"]}, {"cve": "CVE-2023-28949", "desc": "IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 251216.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37826", "desc": "A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fieldname parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27198", "desc": "PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow the execution of arbitrary commands by using the exec service and including a specific word in the command to be executed. The attacker must have physical USB access to the device in order to exploit this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-23076", "desc": "OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.", "poc": ["https://bugbounty.zohocorp.com/bb/#/bug/101000006459751?tab=originator"]}, {"cve": "CVE-2023-1905", "desc": "The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003", "poc": ["https://wpscan.com/vulnerability/b6ac3e15-6f39-4514-a50d-cca7b9457736"]}, {"cve": "CVE-2023-2661", "desc": "A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Master.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228803.", "poc": ["https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Online-Computer-and-Laptop-Store---Multiple-vulnerabilities.md#5sql-injection-vulnerability-in-classesmasterphp"]}, {"cve": "CVE-2023-37148", "desc": "TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function.", "poc": ["https://github.com/DaDong-G/Vulnerability_info/blob/main/TOTOLINK/lr350/3/README.md"]}, {"cve": "CVE-2023-23376", "desc": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/jake-44/Research", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-3083", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.", "poc": ["https://huntr.dev/bounties/c6b29e46-02e0-43ad-920f-28ac482ea2ab"]}, {"cve": "CVE-2023-26953", "desc": "onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module.", "poc": ["https://github.com/keheying/onekeyadmin/issues/8"]}, {"cve": "CVE-2023-23504", "desc": "The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. An app may be able to execute arbitrary code with kernel privileges.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/adamdoupe/adamd-pocs", "https://github.com/houjingyi233/macOS-iOS-system-security", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/zeroc00I/CVE-2023-23504"]}, {"cve": "CVE-2023-28709", "desc": "The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount\u00a0could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters\u00a0in the query string, the limit for uploaded request parts could be\u00a0bypassed with the potential for a denial of service to occur.", "poc": ["https://github.com/Dzmitry-Basiachenka/dist-foreign-aliakh", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-2699", "desc": "A vulnerability, which was classified as critical, has been found in SourceCodester Lost and Found Information System 1.0. Affected by this issue is some unknown functionality of the file admin/?page=items/view_item of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228980.", "poc": ["https://vuldb.com/?id.228980", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-43873", "desc": "A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu.", "poc": ["https://github.com/sromanhu/e107-CMS-Stored-XSS---Manage/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43873-e107-CMS-Stored-XSS---Manage"]}, {"cve": "CVE-2023-3013", "desc": "Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.", "poc": ["https://huntr.dev/bounties/52f95edc-cc03-4a9f-9bf8-74f641260073"]}, {"cve": "CVE-2023-6606", "desc": "An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3432", "desc": "Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.", "poc": ["https://huntr.dev/bounties/8ac3316f-431c-468d-87e4-3dafff2ecf51", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45207", "desc": "An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising the JavaScript code present in a PDF document.)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21950", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-44291", "desc": "Dell DM5500 5.14.0.0 contains an OS command injection vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33592", "desc": "Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lfis/admin/?page=system_info/contact_information.", "poc": ["http://packetstormsecurity.com/files/173331/Lost-And-Found-Information-System-1.0-SQL-Injection.html", "https://github.com/0XRedRose/CVE-2023-33592", "https://github.com/Acous7icwav3/CVE-2023-33592", "https://github.com/FuckingHack3r/CVE-2023-33592", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-44796", "desc": "Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _generaloptions_panel.php component.", "poc": ["https://github.com/Hebing123/CVE-2023-44796/issues/1", "https://github.com/Hebing123/cve/issues/4", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-52214", "desc": "Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29849", "desc": "Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty parameter.", "poc": ["http://packetstormsecurity.com/files/171900/Bang-Resto-1.0-SQL-Injection.html"]}, {"cve": "CVE-2023-6862", "desc": "A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47256", "desc": "ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings", "poc": ["https://web.archive.org/web/20240208140218/https://gotham-security.com/screenconnect-cve-2023-47256"]}, {"cve": "CVE-2023-22012", "desc": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). The supported version that is affected is 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-46699", "desc": "Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention.", "poc": ["https://github.com/a-zara-n/a-zara-n"]}, {"cve": "CVE-2023-39709", "desc": "Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add Member section.", "poc": ["https://github.com/Arajawat007/CVE-2023-39709", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-51972", "desc": "Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp.", "poc": ["https://github.com/toxyl/lscve"]}, {"cve": "CVE-2023-20249", "desc": "A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6210", "desc": "When an https: web page created a pop-up from a \"javascript:\" URL, that pop-up was incorrectly allowed to load blockable content such as iframes from insecure http: URLs This vulnerability affects Firefox < 120.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1801501"]}, {"cve": "CVE-2023-27334", "desc": "Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20498.", "poc": ["https://github.com/claroty/opcua-exploit-framework"]}, {"cve": "CVE-2023-28231", "desc": "DHCP Server Service Remote Code Execution Vulnerability", "poc": ["https://github.com/2lambda123/diaphora", "https://github.com/ARPSyndicate/cvemon", "https://github.com/elefantesagradodeluzinfinita/elefantesagradodeluzinfinita", "https://github.com/glavstroy/CVE-2023-28231", "https://github.com/joxeankoret/diaphora", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5838", "desc": "Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9.", "poc": ["https://huntr.com/bounties/8f6feca3-386d-4897-801c-39b9e3e5eb03", "https://github.com/sev-hack/sev-hack"]}, {"cve": "CVE-2023-40194", "desc": "An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace characters. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1833"]}, {"cve": "CVE-2023-26847", "desc": "A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/cassis-sec/CVE", "https://github.com/cassis-sec/cassis-sec"]}, {"cve": "CVE-2023-51079", "desc": "** DISPUTED ** A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because \"the only thing that you could expect is that the parser will take a crazy amount of time to complete its task.\"", "poc": ["https://github.com/mvel/mvel/issues/348", "https://github.com/mvel/mvel/issues/348#issuecomment-1874047271"]}, {"cve": "CVE-2023-49467", "desc": "Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merging_candidates function at motion.cc.", "poc": ["https://github.com/strukturag/libde265/issues/434"]}, {"cve": "CVE-2023-22616", "desc": "An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM.", "poc": ["https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/"]}, {"cve": "CVE-2023-49689", "desc": "Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.\u00a0The 'JobId' parameter of the Employer/DeleteJob.php resource\u00a0does not validate the characters received and they\u00a0are sent unfiltered to the database.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29499", "desc": "A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-28319", "desc": "A use after free vulnerability exists in curl
bind function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.", "poc": ["https://github.com/googleprojectzero/fuzzilli", "https://github.com/zhangjiahui-buaa/MasterThesis"]}, {"cve": "CVE-2023-51210", "desc": "SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters in the UpdateProductQuantity function.", "poc": ["https://medium.com/@nasir.synack/uncovering-critical-vulnerability-cve-2023-51210-in-prestashop-plugin-bundle-product-pack-ad7fb08bdc91"]}, {"cve": "CVE-2023-52525", "desc": "In the Linux kernel, the following vulnerability has been resolved:wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packetOnly skip the code path trying to access the rfc1042 headers when thebuffer is too small, so the driver can still process packets withoutrfc1042 headers.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3335", "desc": "Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator on Linux allows local users\u00a0 to gain sensitive information.This issue affects Hitachi Ops Center Administrator: before 10.9.3-00.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-0861", "desc": "NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/abrahim7112/Vulnerability-checking-program-for-Android", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/seifallahhomrani1/CVE-2023-0861-POC"]}, {"cve": "CVE-2023-28229", "desc": "Windows CNG Key Isolation Service Elevation of Privilege Vulnerability", "poc": ["https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/GhostTroops/TOP", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/Y3A/CVE-2023-28229", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/hktalent/TOP", "https://github.com/johe123qwe/github-trending", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-26876", "desc": "SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.", "poc": ["http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html", "https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693"]}, {"cve": "CVE-2023-32171", "desc": "Unified Automation UaGateway OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability.The specific flaw exists within the ImportCsv method. A crafted XML payload can cause a null pointer dereference. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20495.", "poc": ["https://github.com/0vercl0k/pwn2own2023-miami"]}, {"cve": "CVE-2023-29141", "desc": "An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42654", "desc": "In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45465", "desc": "Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.", "poc": ["https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20ddnsDomainName%20parameter%20in%20Dynamic%20DNS%20setting.md", "https://github.com/Luwak-IoT-Security/CVEs"]}, {"cve": "CVE-2023-44099", "desc": "Vulnerability of data verification errors in the kernel module. Successful exploitation of this vulnerability may cause WLAN interruption.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-26817", "desc": "codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controllers/api/user.php.", "poc": ["https://github.com/PGYER/codefever/issues/140", "https://github.com/youyou-pm10/MyCVEs"]}, {"cve": "CVE-2023-28344", "desc": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly updated screenshots of student desktops and to submit falsified screenshots on behalf of students. Attackers are able to view screenshots of student desktops without their consent. These screenshots may potentially contain sensitive/personal data. Attackers can also rapidly submit falsified images, hiding the actual contents of student desktops from the Teacher Console.", "poc": ["https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/", "https://research.nccgroup.com/?research=Technical%20advisories"]}, {"cve": "CVE-2023-39008", "desc": "A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.", "poc": ["https://logicaltrust.net/blog/2023/08/opnsense.html"]}, {"cve": "CVE-2023-45316", "desc": "Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1810705"]}, {"cve": "CVE-2023-6035", "desc": "The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape \"data\" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.", "poc": ["https://wpscan.com/vulnerability/44f5a29a-05f9-40d2-80f2-6fb2bda60d79"]}, {"cve": "CVE-2023-2449", "desc": "The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_process_form). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-2448 and CVE-2023-2446, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.", "poc": ["http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html", "https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681"]}, {"cve": "CVE-2023-0669", "desc": "Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.", "poc": ["http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html", "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis", "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html", "https://github.com/0xf4n9x/CVE-2023-0669", "https://github.com/ARPSyndicate/cvemon", "https://github.com/ARPSyndicate/kenzer-templates", "https://github.com/Avento/CVE-2023-0669", "https://github.com/CVEDB/PoC-List", "https://github.com/CVEDB/awesome-cve-repo", "https://github.com/CVEDB/top", "https://github.com/H4lo/awesome-IoT-security-article", "https://github.com/Loginsoft-LLC/Linux-Exploit-Detection", "https://github.com/Loginsoft-Research/Linux-Exploit-Detection", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/aneasystone/github-trending", "https://github.com/cataiovita/CVE-2023-0669", "https://github.com/cataliniovita/CVE-2023-0669", "https://github.com/hktalent/TOP", "https://github.com/k0mi-tg/CVE-POC", "https://github.com/manas3c/CVE-POC", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile", "https://github.com/trhacknon/CVE-2023-0669", "https://github.com/trhacknon/CVE-2023-0669-bis", "https://github.com/whoforget/CVE-POC", "https://github.com/yosef0x01/CVE-2023-0669-Analysis", "https://github.com/youwizard/CVE-POC"]}, {"cve": "CVE-2023-3131", "desc": "The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.", "poc": ["https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c"]}, {"cve": "CVE-2023-1831", "desc": "Mattermost fails to redact from audit logs\u00a0the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).", "poc": ["https://mattermost.com/security-updates/"]}, {"cve": "CVE-2023-21512", "desc": "Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access permission.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20159", "desc": "Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.", "poc": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sg-web-multi-S9g4Nkgv", "https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-27754", "desc": "vox2mesh 1.0 has stack-overflow in main.cpp, this is stack-overflow caused by incorrect use of memcpy() funciton. The flow allows an attacker to cause a denial of service (abort) via a crafted file.", "poc": ["https://github.com/10cksYiqiyinHangzhouTechnology/vox2mesh_poc", "https://github.com/10cks/10cks", "https://github.com/10cksYiqiyinHangzhouTechnology/10cksYiqiyinHangzhouTechnology", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-41290", "desc": "A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.We have already fixed the vulnerability in the following version:QuFirewall 2.4.1 ( 2024/02/01 ) and later", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34600", "desc": "Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection.", "poc": ["https://github.com/costacoco/Adiscon", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-5675", "desc": "A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49372", "desc": "JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.", "poc": ["https://github.com/li-yu320/cms/blob/main/There%20is%20a%20CSRF%20present%20at%20the%20new%20location%20of%20the%20rotation%20image.md"]}, {"cve": "CVE-2023-21843", "desc": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html", "https://github.com/ARPSyndicate/cvemon", "https://github.com/gdams/openjdk-cve-parser"]}, {"cve": "CVE-2023-4089", "desc": "On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45198", "desc": "ftpd before \"NetBSD-ftpd 20230930\" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30058", "desc": "novel-plus 3.6.2 is vulnerable to SQL Injection.", "poc": ["https://github.com/Rabb1tQ/HillstoneCVEs"]}, {"cve": "CVE-2023-6033", "desc": "Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-43343", "desc": "Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Files - Description parameter in the Pages Menu component.", "poc": ["https://github.com/sromanhu/CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files", "https://github.com/sromanhu/Quick-CMS-Stored-XSS---Pages-Files", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sromanhu/CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files"]}, {"cve": "CVE-2023-22655", "desc": "Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-37599", "desc": "An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sahiloj/CVE-2023-37599"]}, {"cve": "CVE-2023-26102", "desc": "All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype", "poc": ["https://github.com/timdown/rangy/issues/478", "https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702"]}, {"cve": "CVE-2023-23315", "desc": "The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.", "poc": ["https://friends-of-presta.github.io/security-advisories/modules/2023/03/01/stripejs.html"]}, {"cve": "CVE-2023-44694", "desc": "D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php.", "poc": ["https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_rce_%20mailrecvview.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34330", "desc": "AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.", "poc": ["https://github.com/chnzzh/Redfish-CVE-lib"]}, {"cve": "CVE-2023-40202", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Hannes Etzelstorfer // codemiq WP HTML Mail plugin <=\u00a03.4.1 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2600", "desc": "The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/8e1d65c3-14e4-482f-ae9e-323e847a8613"]}, {"cve": "CVE-2023-46675", "desc": "An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users, Elastic Security package policy objects which can contain private keys, bearer token, and sessions of 3rd-party integrations and finally Authorization headers, client secrets, local file paths, and stack traces. The issue may occur in any Kibana instance running an affected version that could potentially receive an unexpected error when communicating to Elasticsearch causing it to include sensitive data into Kibana error logs. It could also occur under specific circumstances when debug level logging is enabled in Kibana. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38969", "desc": "Cross Site Scripting vulnerabiltiy in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the title parameter in the new book and edit book function.", "poc": ["https://panda002.hashnode.dev/badaso-version-297-has-an-xss-vulnerability-in-add-books"]}, {"cve": "CVE-2023-29454", "desc": "Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4548", "desc": "A vulnerability classified as critical has been found in SPA-Cart eCommerce CMS 1.9.0.3. This affects an unknown part of the file /search of the component GET Parameter Handler. The manipulation of the argument filter[brandid] leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-238059.", "poc": ["http://packetstormsecurity.com/files/174344/SPA-Cart-eCommerce-CMS-1.9.0.3-SQL-Injection.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3191", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.", "poc": ["https://huntr.dev/bounties/19fed157-128d-4bfb-a30e-eadf748cbd1a"]}, {"cve": "CVE-2023-6354", "desc": "Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the PDFViewer.aspx 'filename' parameter.", "poc": ["https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/", "https://github.com/qwell/disorder-in-the-court"]}, {"cve": "CVE-2023-32521", "desc": "A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files.", "poc": ["https://www.tenable.com/security/research/tra-2023-17"]}, {"cve": "CVE-2023-36250", "desc": "CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.", "poc": ["https://github.com/BrunoTeixeira1996/CVE-2023-36250/blob/main/README.md", "https://github.com/BrunoTeixeira1996/CVE-2023-36250", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-39699", "desc": "IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.", "poc": ["https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion"]}, {"cve": "CVE-2023-1717", "desc": "Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim\u2019s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.", "poc": ["https://starlabs.sg/advisories/23/23-1717/"]}, {"cve": "CVE-2023-51810", "desc": "SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain sensitive information via a crafted request to the search parameter in the Users module.", "poc": ["https://github.com/Pastea/CVE-2023-51810", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-45058", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Short URL plugin <=\u00a01.6.8 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21974", "desc": "Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Team Calendar Plugin: 18.2-22.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Application Express Team Calendar Plugin. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express Team Calendar Plugin, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Application Express Team Calendar Plugin. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-1490", "desc": "A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical. Affected by this issue is the function 0x220020 in the library SDActMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223376.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1490", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-40604", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jes Madsen Cookies by JM plugin <=\u00a01.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27497", "desc": "Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-27643", "desc": "An issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button in Queue and Select Folders button in Library", "poc": ["https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27643/CVE%20detail.md"]}, {"cve": "CVE-2023-27905", "desc": "Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Rajchowdhury420/Secure-or-Break-Jenkins", "https://github.com/gquere/pwn_jenkins", "https://github.com/karimhabush/cyberowl"]}, {"cve": "CVE-2023-41818", "desc": "An improper use of the SD card for sensitive data vulnerability was reported in the Motorola Device Help application that could allow a local attacker to read system logs.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46007", "desc": "Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_staff.php.", "poc": ["https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/SQL-Injection-Vulnerability-3.md"]}, {"cve": "CVE-2023-33118", "desc": "Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6950", "desc": "** DISPUTED ** An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a malicious packet containing a malformed path provided to the FTP SIZE command that leads to a denial-of-service attack of the FTP service itself.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4736", "desc": "Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.", "poc": ["https://huntr.dev/bounties/e1ce0995-4df4-4dec-9cd7-3136ac3e8e71"]}, {"cve": "CVE-2023-4592", "desc": "A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie session details of an authenticated user, resulting in a session hijacking.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1157", "desc": "A vulnerability, which was classified as problematic, was found in finixbit elf-parser. Affected is the function elf_parser::Elf_parser::get_segments of the file elf_parser.cpp. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-222222 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/10cksYiqiyinHangzhouTechnology/elf-parser_segments_poc", "https://github.com/10cks/10cks", "https://github.com/10cksYiqiyinHangzhouTechnology/10cksYiqiyinHangzhouTechnology", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-25707", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <=\u00a01.5.12 versions.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/yaudahbanh/CVE-Archive"]}, {"cve": "CVE-2023-24160", "desc": "TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.", "poc": ["https://github.com/iceyjchen/VulnerabilityProjectRecords/blob/main/setPasswordCfg_admuser/setPasswordCfg_admuser.md", "https://github.com/ARPSyndicate/cvemon", "https://github.com/iceyjchen/VulnerabilityProjectRecords"]}, {"cve": "CVE-2023-5573", "desc": "Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.", "poc": ["https://huntr.dev/bounties/46a2bb2c-712a-4008-a147-b862e3af7d72"]}, {"cve": "CVE-2023-49695", "desc": "OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and earlier allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command by sending a specially crafted request to the product.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31664", "desc": "A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter.", "poc": ["https://github.com/adilkhan7/CVE-2023-31664", "https://github.com/adilkhan7/CVE-2023-31664", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-48011", "desc": "GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments.c.", "poc": ["https://github.com/gpac/gpac/issues/2611"]}, {"cve": "CVE-2023-24019", "desc": "A stack-based buffer overflow vulnerability exists in the urvpn_client http_connection_readcb functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1718"]}, {"cve": "CVE-2023-6873", "desc": "Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 121.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29210", "desc": "XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the user parameter of the macro that provide the notification filters. These macros are used in the user profiles and thus installed by default in XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.", "poc": ["https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9mj-v5mf-m82x"]}, {"cve": "CVE-2023-37895", "desc": "Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component \"commons-beanutils\", which contains a class that can be used for remote code execution over RMI.Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore.In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases.How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone.The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like \"netstat\" can be used to check.RMI-over-HTTP in Jackrabbit by default uses the path \"/rmi\". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control.Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:\u00a0 \u00a0 \u00a0 \u00a0
ContentPrincipals resulting in extensions being able to open them without user interaction via ExpandedPrincipals. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1792138"]}, {"cve": "CVE-2023-29007", "desc": "Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.", "poc": ["https://github.com/9069332997/session-1-full-stack", "https://github.com/ethiack/CVE-2023-29007", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/omespino/CVE-2023-29007", "https://github.com/x-Defender/CVE-2023-29007_win-version"]}, {"cve": "CVE-2023-42295", "desc": "An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_rle_image function of file bifs/unquantize.c", "poc": ["https://github.com/OpenImageIO/oiio/issues/3947"]}, {"cve": "CVE-2023-32212", "desc": "An attacker could have positioned a datalist element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1826622"]}, {"cve": "CVE-2023-37903", "desc": "vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.", "poc": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4", "https://github.com/7h3h4ckv157/CVE-2023-37903", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-39003", "desc": "OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp.", "poc": ["https://logicaltrust.net/blog/2023/08/opnsense.html"]}, {"cve": "CVE-2023-1379", "desc": "A vulnerability was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file addmem.php of the component POST Parameter Handler. The manipulation of the argument firstname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223127.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/Vinalti/cve-badge.li"]}, {"cve": "CVE-2023-2669", "desc": "A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as critical. This affects an unknown part of the file admin/?page=categories/view_category of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228885 was assigned to this vulnerability.", "poc": ["https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/CVE-2023-2669.md", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-22038", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpujul2023.html"]}, {"cve": "CVE-2023-27107", "desc": "Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 allows users who do not have appropriate access rights to generate internal reports using a direct URL.", "poc": ["https://gist.github.com/smidtbx10/f8ff1c4977b7f54886c6a52e9ef4e816"]}, {"cve": "CVE-2023-1106", "desc": "Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.", "poc": ["https://huntr.dev/bounties/1288ec00-f69d-4b84-abce-efc9a97941a0"]}, {"cve": "CVE-2023-4812", "desc": "An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1638", "desc": "A vulnerability was found in IObit Malware Fighter 9.4.0.776. It has been rated as problematic. Affected by this issue is the function 0x8001E024/0x8001E040 in the library ImfRegistryFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-224018 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1638", "https://github.com/ARPSyndicate/cvemon", "https://github.com/zeze-zeze/WindowsKernelVuln"]}, {"cve": "CVE-2023-1655", "desc": "Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.", "poc": ["https://huntr.dev/bounties/05f1d1de-bbfd-43fe-bdf9-7f73419ce7c9"]}, {"cve": "CVE-2023-28842", "desc": "Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*.Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.The `overlay` driver dynamically and lazily defines the kernel configuration for the VXLAN network on each node as containers are attached and detached. Routes and encryption parameters are only defined for destination nodes that participate in the network. The iptables rules that prevent encrypted overlay networks from accepting unencrypted packets are not created until a peer is available with which to communicate.Encrypted overlay networks silently accept cleartext VXLAN datagrams that are tagged with the VNI of an encrypted overlay network. As a result, it is possible to inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams. The implications of this can be quite dire, and GHSA-vwm3-crmr-xfxw should be referenced for a deeper exploration.Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16.Some workarounds are available. In multi-node clusters, deploy a global \u2018pause\u2019 container for each encrypted overlay network, on every node. For a single-node cluster, do not use overlay networks of any sort. Bridge networks provide the same connectivity on a single node and have no multi-node features. The Swarm ingress feature is implemented using an overlay network, but can be disabled by publishing ports in `host` mode instead of `ingress` mode (allowing the use of an external load balancer), and removing the `ingress` network. If encrypted overlay networks are in exclusive use, block UDP port 4789 from traffic that has not been validated by IPSec.", "poc": ["https://github.com/wolfi-dev/advisories"]}, {"cve": "CVE-2023-25135", "desc": "vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.", "poc": ["https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable", "https://github.com/ARPSyndicate/cvemon", "https://github.com/ambionics/vbulletin-exploits", "https://github.com/getdrive/PoC", "https://github.com/iluaster/getdrive_PoC", "https://github.com/izj007/wechat", "https://github.com/netlas-io/netlas-dorks", "https://github.com/tawkhidd/CVE", "https://github.com/whoami13apt/files2"]}, {"cve": "CVE-2023-37580", "desc": "Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.", "poc": ["https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/v-p-b/xss-reflections"]}, {"cve": "CVE-2023-33336", "desc": "Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the double quotes.", "poc": ["https://inf0seq.github.io/cve/2023/04/30/Cross-site-scripting-(XSS)-in-Sophos-Web-Appliance-4.1.1-0.9.html"]}, {"cve": "CVE-2023-28293", "desc": "Windows Kernel Elevation of Privilege Vulnerability", "poc": ["http://packetstormsecurity.com/files/172300/Windows-Kernel-CmpDoReDoCreateKey-CmpDoReOpenTransKey-Out-Of-Bounds-Read.html", "http://packetstormsecurity.com/files/173135/Microsoft-Windows-11-22h2-Kernel-Privilege-Escalation.html"]}, {"cve": "CVE-2023-45133", "desc": "Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any \"polyfill provider\" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.", "poc": ["https://github.com/ViniMortinho/Babel-vulner-vel-a-execucao-arbitraria-de-codigo-ao-compilar-codigo-malicioso-especificamente-criado", "https://github.com/azu/babel-traversal-eval-issue", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-45864", "desc": "A race condition issue discovered in Samsung Mobile Processor Exynos 9820, 980, 1080, 2100, 2200, 1280, and 1380 allows unintended modifications of values within certain areas.", "poc": ["https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-38336", "desc": "netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36664", "desc": "Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).", "poc": ["https://github.com/BC-SECURITY/Moriarty", "https://github.com/JeanChpt/CVE-2023-36664", "https://github.com/SrcVme50/Hospital", "https://github.com/churamanib/CVE-2023-36664-Ghostscript-command-injection", "https://github.com/izj007/wechat", "https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection", "https://github.com/jeanchpt/CVE-2023-36664", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/winkler-winsen/Scan_GhostScript"]}, {"cve": "CVE-2023-23859", "desc": "SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-40751", "desc": "PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the \"action\" parameter of index.php.", "poc": ["https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5546", "desc": "ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/obelia01/CVE-2023-5546"]}, {"cve": "CVE-2023-2492", "desc": "The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.", "poc": ["https://wpscan.com/vulnerability/fa7c54c2-5653-4d3d-8163-f3d63272c050"]}, {"cve": "CVE-2023-32489", "desc": "Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker with high privileges could potentially exploit this vulnerability, to bypass mode protections and gain elevated privileges.", "poc": ["https://www.dell.com/support/kbdoc/en-us/000216717/dsa-2023-269-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"]}, {"cve": "CVE-2023-52314", "desc": "PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-023.md"]}, {"cve": "CVE-2023-45357", "desc": "Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 (6.14.0) is also a fixed release.", "poc": ["https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44217", "desc": "A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier versions allows a local low-privileged user to gain system privileges through running repair functionality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29534", "desc": "Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks.*This bug only affects Firefox and Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1816007", "https://bugzilla.mozilla.org/show_bug.cgi?id=1816059", "https://bugzilla.mozilla.org/show_bug.cgi?id=1821155", "https://bugzilla.mozilla.org/show_bug.cgi?id=1821576", "https://bugzilla.mozilla.org/show_bug.cgi?id=1821906"]}, {"cve": "CVE-2023-21874", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).", "poc": ["https://www.oracle.com/security-alerts/cpujan2023.html"]}, {"cve": "CVE-2023-1218", "desc": "Use after free in WebRTC in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-1010", "desc": "A vulnerability classified as critical was found in vox2png 1.0. Affected by this vulnerability is an unknown functionality of the file vox2png.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221743.", "poc": ["https://github.com/10cksYiqiyinHangzhouTechnology/vox2png/blob/main/README.md", "https://github.com/10cks/10cks", "https://github.com/10cksYiqiyinHangzhouTechnology/10cksYiqiyinHangzhouTechnology", "https://github.com/ARPSyndicate/cvemon", "https://github.com/jpapa275/paramecium"]}, {"cve": "CVE-2023-36158", "desc": "Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on the My Account page.", "poc": ["https://cyberredteam.tech/posts/cve-2023-36158/", "https://github.com/unknown00759/CVE-2023-36158/blob/main/CVE-2023-36158.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/unknown00759/CVE-2023-36158"]}, {"cve": "CVE-2023-46362", "desc": "jbig2enc v0.28 was discovered to contain a heap-use-after-free via jbig2enc_auto_threshold_using_hash in src/jbig2enc.cc.", "poc": ["https://github.com/agl/jbig2enc/issues/84"]}, {"cve": "CVE-2023-50010", "desc": "Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the set_encoder_id function in /fftools/ffmpeg_enc.c component.", "poc": ["https://ffmpeg.org/", "https://trac.ffmpeg.org/ticket/10702"]}, {"cve": "CVE-2023-32541", "desc": "A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520. A specially crafted .doc file can lead to a use-after-free. An attacker can trick a user into opening a malformed file to trigger this vulnerability.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1759"]}, {"cve": "CVE-2023-0424", "desc": "The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks", "poc": ["https://wpscan.com/vulnerability/b0f8713f-54b2-4ab2-a475-60a1692a50e9"]}, {"cve": "CVE-2023-6928", "desc": "EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.", "poc": ["https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05"]}, {"cve": "CVE-2023-6592", "desc": "The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files.", "poc": ["https://research.cleantalk.org/cve-2023-6592-fastdup-database-users-password-leak-poc-exploit/", "https://wpscan.com/vulnerability/a39bb807-b143-4863-88ff-1783e407d7d4/"]}, {"cve": "CVE-2023-41078", "desc": "An authorization issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. An app may be able to bypass certain Privacy preferences.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-29770", "desc": "In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering.", "poc": ["https://github.com/sapplica/sentrifugo/issues/384"]}, {"cve": "CVE-2023-47144", "desc": "IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 270271.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25089", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the handle_interface_acl function with the interface variable when in_acl is -1.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-0816", "desc": "The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.", "poc": ["https://wpscan.com/vulnerability/a281f63f-e295-4666-8a08-01b23cd5a744"]}, {"cve": "CVE-2023-1721", "desc": "Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.", "poc": ["https://fluidattacks.com/advisories/blessd/"]}, {"cve": "CVE-2023-31705", "desc": "A Reflected Cross-site scripting (XSS) vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript into the page parameter.", "poc": ["https://github.com/d34dun1c02n/CVE-2023-31705", "https://github.com/d34dun1c02n/CVE-2023-31705", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-38619", "desc": "Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `msb` array.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21959", "desc": "Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iReceivables. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iReceivables accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-52347", "desc": "In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-33786", "desc": "A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.", "poc": ["https://github.com/anhdq201/netbox/issues/2"]}, {"cve": "CVE-2023-0164", "desc": "OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.", "poc": ["https://fluidattacks.com/advisories/queen/"]}, {"cve": "CVE-2023-40292", "desc": "Harman Infotainment 20190525031613 and later discloses the IP address via CarPlay CTRL packets.", "poc": ["https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/"]}, {"cve": "CVE-2023-25214", "desc": "Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the setSchedWifi function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC5/4/4.md"]}, {"cve": "CVE-2023-43764", "desc": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-43762. Reason: This candidate is a duplicate of CVE-2023-43762. Notes: All CVE users should reference CVE-2023-43762 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4439", "desc": "A vulnerability was found in SourceCodester Card Holder Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Minus Value Handler. The manipulation leads to improper validation of specified quantity in input. The attack may be launched remotely. The identifier of this vulnerability is VDB-237560.", "poc": ["https://vuldb.com/?id.237560"]}, {"cve": "CVE-2023-23702", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pixelgrade Comments Ratings plugin <=\u00a01.1.7 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45248", "desc": "Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36497, Acronis Cyber Protect 16 (Windows) before build 37391.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/password123456/cve-collector"]}, {"cve": "CVE-2023-22996", "desc": "In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.", "poc": ["https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.2"]}, {"cve": "CVE-2023-0844", "desc": "The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/8d8e5852-3787-47f9-9931-8308bb81beb1"]}, {"cve": "CVE-2023-43990", "desc": "An issue in cherub-hair mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47075", "desc": "Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50030", "desc": "In the module \"Jms Setting\" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions <= 1.1.0. The method `JmsSetting::getSecondImgs()` has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a blind SQL injection.", "poc": ["https://security.friendsofpresta.org/modules/2024/01/16/jmssetting.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-2839", "desc": "Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.", "poc": ["https://huntr.dev/bounties/42dce889-f63d-4ea9-970f-1f20fc573d5f"]}, {"cve": "CVE-2023-7100", "desc": "A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248952.", "poc": ["https://medium.com/@2839549219ljk/restaurant-table-booking-system-sql-injection-vulnerability-30708cfabe03"]}, {"cve": "CVE-2023-45653", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Video Playlist For YouTube plugin <=\u00a06.0 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46751", "desc": "An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-32071", "desc": "XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.", "poc": ["https://bugzilla.mozilla.org/show_bug.cgi?id=1790345"]}, {"cve": "CVE-2023-41165", "desc": "An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9. An administrator with write access to the SNS firewall can configure a login disclaimer with malicious JavaScript elements that can result in data theft.", "poc": ["https://advisories.stormshield.eu/2023-020/"]}, {"cve": "CVE-2023-32842", "desc": "In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01130256; Issue ID: MOLY01130256 (MSV-848).", "poc": ["https://github.com/AEPP294/5ghoul-5g-nr-attacks", "https://github.com/asset-group/5ghoul-5g-nr-attacks"]}, {"cve": "CVE-2023-34256", "desc": "** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated \"When modifying the block device while it is mounted by the filesystem\" access.", "poc": ["https://github.com/vin01/bogus-cves"]}, {"cve": "CVE-2023-1761", "desc": "Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.", "poc": ["https://github.com/ahmedvienna/CVEs-and-Vulnerabilities"]}, {"cve": "CVE-2023-47162", "desc": "IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 270973.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47212", "desc": "A heap-based buffer overflow vulnerability exists in the comment functionality of stb _vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34457", "desc": "MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.", "poc": ["https://github.com/MechanicalSoup/MechanicalSoup/security/advisories/GHSA-x456-3ccm-m6j4"]}, {"cve": "CVE-2023-4848", "desc": "A vulnerability classified as critical was found in SourceCodester Simple Book Catalog App 1.0. Affected by this vulnerability is an unknown functionality of the file delete_book.php. The manipulation of the argument delete leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239257 was assigned to this vulnerability.", "poc": ["https://skypoc.wordpress.com/2023/09/04/sourcecodester-simple-book-catalog-app-v1-0-has-multiple-vulnerabilities/"]}, {"cve": "CVE-2023-4182", "desc": "A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file edit_sell.php. The manipulation of the argument up_pid leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-236217 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.236217"]}, {"cve": "CVE-2023-0772", "desc": "The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.", "poc": ["https://wpscan.com/vulnerability/28754886-b7b4-44f7-9042-b81c542d3c9c"]}, {"cve": "CVE-2023-36483", "desc": "Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android\u00a0 version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlierwhich allows remote attackers to retrieve sensitive data\u00a0 including customer data, security system status, and event history.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1570", "desc": "A vulnerability, which was classified as problematic, has been found in syoyo tinydng. Affected by this issue is the function __interceptor_memcpy of the file tiny_dng_loader.h. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is recommended to apply a patch to fix this issue. VDB-223562 is the identifier assigned to this vulnerability.", "poc": ["https://github.com/10cksYiqiyinHangzhouTechnology/tinydngSecurityIssueReport1", "https://github.com/syoyo/tinydng/issues/28", "https://github.com/syoyo/tinydng/issues/29", "https://github.com/10cks/10cks", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-26140", "desc": "Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.", "poc": ["https://security.snyk.io/vuln/SNYK-JS-EXCALIDRAWEXCALIDRAW-5841658"]}, {"cve": "CVE-2023-46950", "desc": "Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6732", "desc": "The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed", "poc": ["https://wpscan.com/vulnerability/aaf91707-f03b-4f25-bca9-9fac4945002a/"]}, {"cve": "CVE-2023-40924", "desc": "SolarView Compact < 6.00 is vulnerable to Directory Traversal.", "poc": ["https://github.com/Yobing1/CVE-2023-40924", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0758", "desc": "A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.220469"]}, {"cve": "CVE-2023-26510", "desc": "Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this behavior has no security impact.", "poc": ["https://ghost.org/docs/security/", "https://gist.github.com/yurahod/2e11eabbe4b92ef1d44b08e37023ecfb", "https://gist.github.com/yurahod/828d5e6a077c12f3f74c6485d1c7f0e7"]}, {"cve": "CVE-2023-5962", "desc": "A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attacker compromise the confidentiality of sensitive data. This vulnerability may lead an attacker to get unexpected authorization.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38623", "desc": "Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `vindex_offset` array.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-50128", "desc": "The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which results in an attacker being able to conduct replay attacks to bring the alarm system to a disarmed state.", "poc": ["https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices"]}, {"cve": "CVE-2023-38294", "desc": "Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsion.autotest.factory (versionCode='7', versionName='1.8.0(220310_1027)') that allows local third-party apps to execute arbitrary shell commands in its context (system user) due to inadequate access control. No permissions or special privileges are necessary to exploit the vulnerability in the com.transsion.autotest.factory app. No user interaction is required beyond installing and running a third-party app. The vulnerability allows local apps to access sensitive functionality that is generally restricted to pre-installed apps, such as programmatically performing the following actions: granting arbitrary permissions (which can be used to obtain sensitive user data), installing arbitrary apps, video recording the screen, wiping the device (removing the user's apps and data), injecting arbitrary input events, calling emergency phone numbers, disabling apps, accessing notifications, and much more. The confirmed vulnerable software build fingerprints for the Itel Vision 3 Turbo device are as follows: Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V92-20230105:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V86-20221118:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V78-20221101:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V64-20220803:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V61-20220721:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V58-20220712:user/release-keys, and Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V051-20220613:user/release-keys. This malicious app sends a broadcast Intent to the receiver component named com.transsion.autotest.factory/.broadcast.CommandReceiver with the path to a shell script that it creates in its scoped storage directory. Then the com.transsion.autotest.factory app will execute the shell script with \"system\" privileges.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-20899", "desc": "VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36019", "desc": "Microsoft Power Platform Connector Spoofing Vulnerability", "poc": ["https://github.com/myseq/ms_patch_tuesday"]}, {"cve": "CVE-2023-2315", "desc": "Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server", "poc": ["https://starlabs.sg/advisories/23/23-2315/"]}, {"cve": "CVE-2023-4699", "desc": "Insufficient Verification of Data Authenticity vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules and MELSEC iQ-F Series CPU modules allows a remote unauthenticated attacker to reset the memory of the products to factory default state and cause denial-of-service (DoS) condition on the products by sending specific packets.", "poc": ["https://github.com/Scottzxor/Citrix-Bleed-Buffer-Overread-Demo", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-6277", "desc": "An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.", "poc": ["https://gitlab.com/libtiff/libtiff/-/issues/614", "https://github.com/NaInSec/CVE-LIST", "https://github.com/PromptFuzz/PromptFuzz", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6112", "desc": "Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["http://packetstormsecurity.com/files/176721/Chrome-content-NavigationURLLoaderImpl-FallbackToNonInterceptedRequest-Heap-Use-After-Free.html", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21275", "desc": "In decideCancelProvisioningDialog of AdminIntegratedFlowPrepareActivity.java, there is a possible way to bypass factory reset protections due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Trinadh465/packages_apps_ManagedProvisioning_AOSP10_r33_CVE-2023-21275", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-7201", "desc": "The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/64ba4461-bbba-45eb-981f-bb5f2e5e56e1/"]}, {"cve": "CVE-2023-47099", "desc": "A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via Description field while creating the Virtual server.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-24519", "desc": "Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the ping tool utility.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1706"]}, {"cve": "CVE-2023-0268", "desc": "The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/99389641-ad1e-45c1-a42f-2a010ee22d76"]}, {"cve": "CVE-2023-6036", "desc": "The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.", "poc": ["https://wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/pctripsesp/CVE-2023-6036"]}, {"cve": "CVE-2023-35843", "desc": "NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.", "poc": ["https://advisory.dw1.io/60", "https://github.com/0x783kb/Security-operation-book", "https://github.com/Lserein/CVE-2023-35843", "https://github.com/Szlein/CVE-2023-35843", "https://github.com/Tropinene/Yscanner", "https://github.com/b3nguang/CVE-2023-35843", "https://github.com/codeb0ss/cve-202335843", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-35855", "desc": "A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile console variable.", "poc": ["https://github.com/MikeIsAStar/Counter-Strike-Remote-Code-Execution"]}, {"cve": "CVE-2023-29495", "desc": "Improper input validation for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege via local access.", "poc": ["https://github.com/another1024/another1024"]}, {"cve": "CVE-2023-28666", "desc": "The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.", "poc": ["https://www.tenable.com/security/research/tra-2023-3", "https://github.com/ARPSyndicate/cvemon", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-46781", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Roland Murg Current Menu Item for Custom Post Types plugin <=\u00a01.5 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1337", "desc": "The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the clear_uucss_logs function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to delete plugin log files.", "poc": ["https://github.com/ARPSyndicate/cvemon", "https://github.com/DARKSECshell/CVE-2023-1337", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0603", "desc": "The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba"]}, {"cve": "CVE-2023-42632", "desc": "In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-49968", "desc": "Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_department.php.", "poc": ["https://github.com/geraldoalcantara/CVE-2023-49968", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-0540", "desc": "The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/b35b3da2-468d-4fe5-bff6-812432197a38"]}, {"cve": "CVE-2023-25355", "desc": "CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions. A user who has the ability to run commands as the `daemon` user on a sipXcom server can overwrite a service file, and escalate their privileges to `root`.", "poc": ["https://seclists.org/fulldisclosure/2023/Mar/5", "https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-46093", "desc": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LionScripts.Com Webmaster Tools plugin <=\u00a02.0 versions.", "poc": ["https://github.com/hackintoanetwork/hackintoanetwork"]}, {"cve": "CVE-2023-33992", "desc": "The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-25095", "desc": "Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_qos function with the rule_name variable with two possible format strings that represent negated commands.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716"]}, {"cve": "CVE-2023-3226", "desc": "The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "poc": ["https://wpscan.com/vulnerability/941a9aa7-f4b2-474a-84d9-9a74c99079e2", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-47643", "desc": "SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash. This issue is patched in version 8.4.2. There are no known workarounds.", "poc": ["https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-fxww-jqfv-9rrr"]}, {"cve": "CVE-2023-33671", "desc": "Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function.", "poc": ["https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N4/README.md", "https://github.com/DDizzzy79/Tenda-CVE/tree/main/AC8V4.0/N4", "https://github.com/DDizzzy79/Tenda-CVE", "https://github.com/retr0reg/Tenda-CVE"]}, {"cve": "CVE-2023-46197", "desc": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal.This issue affects Popup by Supsystic: from n/a through 1.10.19.", "poc": ["https://github.com/RandomRobbieBF/CVE-2023-46197", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-30253", "desc": "Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: i_uid\" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45892", "desc": "An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information.", "poc": ["https://github.com/Oracle-Security/CVEs/blob/main/FloorsightSoftware/CVE-2023-45892.md"]}, {"cve": "CVE-2023-32019", "desc": "Windows Kernel Information Disclosure Vulnerability", "poc": ["http://packetstormsecurity.com/files/173310/Windows-Kernel-KTM-Registry-Transactions-Non-Atomic-Outcomes.html", "https://github.com/HotCakeX/Harden-Windows-Security"]}, {"cve": "CVE-2023-20947", "desc": "In getGroupState of GrantPermissionsViewModel.kt, there is a possible way to keep a one-time permission granted due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-237405974", "poc": ["https://github.com/Ghizmoo/DroidSolver"]}, {"cve": "CVE-2023-46324", "desc": "pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its private key and the attacker's public key.", "poc": ["https://www.gsma.com/security/wp-content/uploads/2023/10/0073-invalid_curve.pdf", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30191", "desc": "PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent().", "poc": ["https://friends-of-presta.github.io/security-advisories/modules/2023/05/17/cdesigner-89.html"]}, {"cve": "CVE-2023-4102", "desc": "QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-35968", "desc": "Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger these vulnerabilities.This integer overflow result is used as argument for the realloc function.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1788"]}, {"cve": "CVE-2023-5375", "desc": "Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.", "poc": ["https://huntr.dev/bounties/3fa2abde-cb58-45a3-a115-1727ece9acb9", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-45202", "desc": "Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-1214", "desc": "Type confusion in V8 in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-24164", "desc": "Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_000c2318.", "poc": ["https://github.com/DrizzlingSun/Tenda/blob/main/AC18/4/4.md"]}, {"cve": "CVE-2023-6310", "desc": "A vulnerability has been found in SourceCodester Loan Management System 1.0 and classified as critical. This vulnerability affects the function delete_borrower of the file deleteBorrower.php. The manipulation of the argument borrower_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246136.", "poc": ["https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20browser.md"]}, {"cve": "CVE-2023-47353", "desc": "An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitrary files.", "poc": ["https://github.com/actuator/imou/blob/main/com.dahua.imou.go-V1.0.11.md", "https://github.com/actuator/cve", "https://github.com/actuator/imou"]}, {"cve": "CVE-2023-36517", "desc": "Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts plugin <=\u00a02.6.2 versions.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-21219", "desc": "there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-264698379References: N/A", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-7058", "desc": "A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248749 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30237", "desc": "CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe.", "poc": ["https://www.pentestpartners.com/security-blog/bullied-by-bugcrowd-over-kape-cyberghost-disclosure/"]}, {"cve": "CVE-2023-7083", "desc": "The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack", "poc": ["https://wpscan.com/vulnerability/ba77704a-32a1-494b-b2c0-e1c2a3f98adc/"]}, {"cve": "CVE-2023-0029", "desc": "A vulnerability was found in Multilaser RE708 RE1200R4GC-2T2R-V3_v3411b_MUL029B. It has been rated as problematic. This issue affects some unknown processing of the component Telnet Service. The manipulation leads to denial of service. The attack may be initiated remotely. The identifier VDB-217169 was assigned to this vulnerability.", "poc": ["https://vuldb.com/?id.217169"]}, {"cve": "CVE-2023-41012", "desc": "An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the authentication mechanism.", "poc": ["https://github.com/te5tb99/For-submitting/wiki/Command-Execution-Vulnerability-in-China-Mobile-Intelligent-Home-Gateway-HG6543C4-Identity-verification-has-design-flaws"]}, {"cve": "CVE-2023-3966", "desc": "A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42638", "desc": "In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30956", "desc": "A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.", "poc": ["https://palantir.safebase.us/?tcuUid=40367943-738c-4e69-b852-4a503c77478a"]}, {"cve": "CVE-2023-27079", "desc": "Command Injection vulnerability found in Tenda G103 v.1.0.05 allows an attacker to obtain sensitive information via a crafted package", "poc": ["https://github.com/B2eFly/Router/blob/main/Tenda/G103/2.md"]}, {"cve": "CVE-2023-33440", "desc": "Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.", "poc": ["http://packetstormsecurity.com/files/172672/Faculty-Evaluation-System-1.0-Shell-Upload.html", "https://github.com/1337kid/Exploits", "https://github.com/Alexander-Gan/Exploits"]}, {"cve": "CVE-2023-1536", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.", "poc": ["https://huntr.dev/bounties/538207f4-f805-419a-a314-51716643f05e"]}, {"cve": "CVE-2023-0782", "desc": "A vulnerability was found in Tenda AC23 16.03.07.45 and classified as critical. Affected by this issue is the function formSetSysToolDDNS/formGetSysToolDDNS of the file /bin/httpd. The manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220640.", "poc": ["https://github.com/jingping911/tendaAC23overflow/blob/main/README.md"]}, {"cve": "CVE-2023-52073", "desc": "FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte.", "poc": ["https://github.com/zouyang0714/cms/blob/main/3.md"]}, {"cve": "CVE-2023-36845", "desc": "A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code.Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.This issue affects Juniper Networks Junos OS on EX Seriesand SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to\u00a021.2R3-S7; * 21.3 versions prior to\u00a021.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.", "poc": ["http://packetstormsecurity.com/files/174397/Juniper-JunOS-SRX-EX-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://github.com/0xNehru/CVE-2023-36845-Juniper-Vulnerability", "https://github.com/Asbawy/Automation-for-Juniper-cve-2023-36845", "https://github.com/CKevens/ansible-cve-2023-36845", "https://github.com/CharonDefalt/Juniper-exploit-CVE-2023-36845", "https://github.com/FerdiGul/CVEPSS", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/WhiteOwl-Pub/PoC-Vuln-Detector-juniper-cve-2023-36845", "https://github.com/ak1t4/CVE-2023-36845", "https://github.com/cyb3rzest/Juniper-Bug-Automation-CVE-2023-36845", "https://github.com/cyberh3als/CVE-2023-36845-POC", "https://github.com/devmehedi101/bugbounty-CVE-Report", "https://github.com/ditekshen/ansible-cve-2023-36845", "https://github.com/e11i0t4lders0n/CVE-2023-36845", "https://github.com/f1tao/awesome-iot-security-resource", "https://github.com/hackingyseguridad/nmap", "https://github.com/halencarjunior/CVE-2023-36845", "https://github.com/ifconfig-me/CVE-2023-36845", "https://github.com/imhunterand/CVE-2023-36845", "https://github.com/iveresk/CVE-2023-36845-6-", "https://github.com/jahithoque/Juniper-CVE-2023-36845-Mass-Hunting", "https://github.com/kljunowsky/CVE-2023-36845", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/r3dcl1ff/CVE-2023-36844_Juniper_RCE", "https://github.com/securi3ytalent/bugbounty-CVE-Report", "https://github.com/simrotion13/CVE-2023-36845", "https://github.com/tanjiti/sec_profile", "https://github.com/toanln-cov/CVE-2023-36845", "https://github.com/vulncheck-oss/cve-2023-36845-scanner", "https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844", "https://github.com/zaenhaxor/CVE-2023-36845"]}, {"cve": "CVE-2023-26068", "desc": "Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).", "poc": ["http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html"]}, {"cve": "CVE-2023-1234", "desc": "Inappropriate implementation in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)", "poc": ["https://github.com/CyberMatters/Hermes", "https://github.com/DataSurgeon-ds/ds-cve-plugin", "https://github.com/RIZZZIOM/nemesis", "https://github.com/espressif/esp-idf-sbom", "https://github.com/srand2/Variantanalysis", "https://github.com/synfinner/KEVin"]}, {"cve": "CVE-2023-3234", "desc": "A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been declared as problematic. Affected by this vulnerability is the function put_image of the file api/controller/v1/PublicController.php. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231505 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/HuBenLab/HuBenVulList/blob/main/CRMEB%20is%20vulnerable%20to%20deserialization.md"]}, {"cve": "CVE-2023-5959", "desc": "A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01. Affected is an unknown function of the file /login.php. The manipulation of the argument txt_newpwd leads to weak password recovery. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-244992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-3531", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.", "poc": ["https://huntr.dev/bounties/c9f0b3ff-bbc4-4ea1-a59e-8594b48bb414"]}, {"cve": "CVE-2023-41830", "desc": "An improper absolute path traversal vulnerability was reported for the Ready For application allowing a local application access to files without authorization.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4219", "desc": "A vulnerability was found in SourceCodester Doctors Appointment System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument useremail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-236365 was assigned to this vulnerability.", "poc": ["https://github.com/Yesec/-Doctor-s-Appointment-System/blob/main/SQL%20Injection%20in%20login.php/vuln.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27470", "desc": "BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\\GetSupportService_N-Central\\PushUpdates, leading to arbitrary file deletion.", "poc": ["https://github.com/3lp4tr0n/CVE-2023-27470_Exercise", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-1147", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.", "poc": ["https://huntr.dev/bounties/187f5353-f866-4d26-a5ba-fca378520020"]}, {"cve": "CVE-2023-6486", "desc": "The Spectra \u2013 WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS metabox in all versions up to and including 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://youtu.be/t5K745dBsT0"]}, {"cve": "CVE-2023-5955", "desc": "The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/1b5fce7e-14fc-4548-8747-96fdd58fdd98"]}, {"cve": "CVE-2023-28787", "desc": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.", "poc": ["https://github.com/truocphan/VulnBox"]}, {"cve": "CVE-2023-31032", "desc": "NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-4553", "desc": "Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.AppBuilder configuration files are viewable by unauthenticated users.This issue affects AppBuilder: from 21.2 before 23.2.", "poc": ["https://github.com/cxosmo/CVEs"]}, {"cve": "CVE-2023-33732", "desc": "Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sahiloj/CVE-2023-33732"]}, {"cve": "CVE-2023-47488", "desc": "Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attrib_manager_id parameter in the General Information page and the id parameter in the contact page.", "poc": ["https://bugplorer.github.io/cve-xss-itop/", "https://nitipoom-jar.github.io/CVE-2023-47488/", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/nitipoom-jar/CVE-2023-47488", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3620", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.", "poc": ["https://huntr.dev/bounties/a0fd0671-f051-4d41-8928-9b19819084c9"]}, {"cve": "CVE-2023-35811", "desc": "An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using crafted requests, custom SQL code can be injected through the REST API because of missing input validation. Regular user privileges can use used for exploitation. Editions other than Enterprise are also affected.", "poc": ["http://packetstormsecurity.com/files/174303/SugarCRM-12.2.0-SQL-Injection.html", "http://seclists.org/fulldisclosure/2023/Aug/29"]}, {"cve": "CVE-2023-27638", "desc": "An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023.", "poc": ["https://friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.html"]}, {"cve": "CVE-2023-40429", "desc": "A permissions issue was addressed with improved validation. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to access sensitive user data.", "poc": ["https://github.com/biscuitehh/cve-2023-40429-ez-device-name", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3850", "desc": "A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=delete_category of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-235201 was assigned to this vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31805", "desc": "Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function.", "poc": ["https://github.com/msegoviag/discovered-vulnerabilities", "https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-43862", "desc": "D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formLanguageChange function.", "poc": ["https://github.com/YTrick/vuln/blob/main/DIR-619L%20Buffer%20Overflow_1.md"]}, {"cve": "CVE-2023-37474", "desc": "Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "poc": ["http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html", "https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/ilqarli27/CVE-2023-37474", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2023-51620", "desc": "D-Link DIR-X3260 prog.cgi SetIPv6PppoeSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21669.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-42788", "desc": "An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local attacker with low privileges to execute unauthorized code via specifically crafted arguments to a CLI command", "poc": ["https://github.com/orangecertcc/security-research/security/advisories/GHSA-qpv8-g6qv-rf8p"]}, {"cve": "CVE-2023-21919", "desc": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).", "poc": ["https://www.oracle.com/security-alerts/cpuapr2023.html"]}, {"cve": "CVE-2023-2671", "desc": "A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file classes/Master.php?f=save_inquiry of the component Contact Form. The manipulation of the argument fullname/contact/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228887.", "poc": ["https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/CVE-2023-2671.md", "https://github.com/tht1997/tht1997"]}, {"cve": "CVE-2023-2291", "desc": "Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user.", "poc": ["https://tenable.com/security/research/tra-2023-16"]}, {"cve": "CVE-2023-32073", "desc": "WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.", "poc": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-2mhh-27v7-3vcx", "https://github.com/jmrcsnchz/CVE-2023-32073", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-3690", "desc": "A vulnerability, which was classified as critical, has been found in Bylancer QuickOrder 6.3.7. Affected by this issue is some unknown functionality of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-234236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-30448", "desc": "IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253437.", "poc": ["https://www.ibm.com/support/pages/node/7010557"]}, {"cve": "CVE-2023-30447", "desc": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253436.", "poc": ["https://www.ibm.com/support/pages/node/7010557"]}, {"cve": "CVE-2023-21274", "desc": "In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/2bffd7f5e66dd0cf7e5668fb65c4f2b2e9f87cf7"]}, {"cve": "CVE-2023-0542", "desc": "The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/17de2f77-3e6c-4c22-9196-6e5577ee7fcf"]}, {"cve": "CVE-2023-0074", "desc": "The WP Social Widget WordPress plugin before 2.2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/82f543e3-9397-4364-9546-af5ea134fcd4"]}, {"cve": "CVE-2023-34241", "desc": "OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process.The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`.Version 2.4.6 has a patch for this issue.", "poc": ["https://github.com/jp-cpe/retrieve-cvss-scores", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-6149", "desc": "Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data", "poc": ["https://www.qualys.com/security-advisories/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51949", "desc": "Verydows v2.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /protected/controller/backend/role_controller", "poc": ["https://github.com/cui2shark/security/blob/main/Added%20CSRF%20in%20Role%20Controller.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-5445", "desc": "An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the purpose of redirecting URL request(s) to a malicious site. This impacts the dashboard area of the user interface. A user would need to be logged into ePO to trigger this vulnerability. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-6352", "desc": "The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services (IIS) or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate files or directories, traverse directories, bypass authentication, or access restricted files.", "poc": ["https://github.com/qwell/disorder-in-the-court"]}, {"cve": "CVE-2023-39139", "desc": "An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.", "poc": ["https://blog.ostorlab.co/zip-packages-exploitation.html"]}, {"cve": "CVE-2023-35001", "desc": "Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace", "poc": ["http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html", "http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html", "https://github.com/ZonghaoLi777/githubTrending", "https://github.com/aneasystone/github-trending", "https://github.com/h0pe-ay/Vulnerability-Reproduction", "https://github.com/johe123qwe/github-trending", "https://github.com/mrbrelax/Exploit_CVE-2023-35001", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/syedhafiz1234/nftables-oob-read-write-exploit-CVE-2023-35001-", "https://github.com/synacktiv/CVE-2023-35001", "https://github.com/tanjiti/sec_profile", "https://github.com/xairy/linux-kernel-exploitation"]}, {"cve": "CVE-2023-26800", "desc": "Ruijie Networks RG-EW1200 Wireless Routers EW_3.0(1)B11P204 was discovered to contain a command injetion vulnerability via the params.path parameter in the upgradeConfirm function.", "poc": ["https://github.com/winmt/my-vuls/tree/main/RG-EW1200"]}, {"cve": "CVE-2023-47840", "desc": "Improper Control of Generation of Code ('Code Injection') vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: from n/a through 1.5.2.", "poc": ["https://github.com/RandomRobbieBF/CVE-2023-47840", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-42790", "desc": "A stack-based buffer overflow in Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-25717", "desc": "Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.", "poc": ["https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/", "https://github.com/ARPSyndicate/cvemon", "https://github.com/Ostorlab/KEV", "https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors", "https://github.com/netlas-io/netlas-dorks"]}, {"cve": "CVE-2023-2968", "desc": "A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception.", "poc": ["https://research.jfrog.com/vulnerabilities/undefined-variable-usage-in-proxy-leads-to-remote-denial-of-service-xray-520917"]}, {"cve": "CVE-2023-26952", "desc": "onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.", "poc": ["https://github.com/keheying/onekeyadmin/issues/7"]}, {"cve": "CVE-2023-46773", "desc": "Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-41738", "desc": "Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to execute arbitrary commands via unspecified vectors.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-46456", "desc": "In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality.", "poc": ["https://github.com/cyberaz0r/GL.iNet-Multiple-Vulnerabilities"]}, {"cve": "CVE-2023-23499", "desc": "This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. An app may be able to access user-sensitive data.", "poc": ["https://github.com/ARPSyndicate/cvemon"]}, {"cve": "CVE-2023-5881", "desc": "Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) \"Garage Door Control Module Setup\" and modify the Garage door's SSID settings.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27639", "desc": "An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). Only files that can be parsed in XML can be opened. This is exploited in the wild in March 2023.", "poc": ["https://friends-of-presta.github.io/security-advisories/module/2023/03/30/tshirtecommerce_cwe-22.html"]}, {"cve": "CVE-2023-28661", "desc": "The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_data action.", "poc": ["https://www.tenable.com/security/research/tra-2023-2", "https://github.com/ARPSyndicate/cvemon", "https://github.com/JoshuaMart/JoshuaMart"]}, {"cve": "CVE-2023-37687", "desc": "Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the View Request of Nurse Page in the Admin portal.", "poc": ["https://github.com/rt122001/CVES/blob/main/CVE-2023-37687.txt", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31982", "desc": "Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_packet_reasm_ip at /src/capture.c.", "poc": ["https://github.com/irontec/sngrep/issues/431"]}, {"cve": "CVE-2023-33284", "desc": "Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote attacker authenticated as any user is able to execute code in context of the web server.", "poc": ["https://www.cyberskydd.se/cve/2023/CVE-2023-33284.html"]}, {"cve": "CVE-2023-2246", "desc": "A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227236.", "poc": ["http://packetstormsecurity.com/files/172182/Online-Pizza-Ordering-System-1.0-Shell-Upload.html", "https://github.com/Alexander-Gan/Exploits"]}, {"cve": "CVE-2023-52304", "desc": "Stack overflow in paddle.searchsorted\u00a0in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.", "poc": ["https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-013.md"]}, {"cve": "CVE-2023-0064", "desc": "The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", "poc": ["https://wpscan.com/vulnerability/97be5795-b5b8-40c7-80bf-7da95da7705a"]}, {"cve": "CVE-2023-0381", "desc": "The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks", "poc": ["https://wpscan.com/vulnerability/39c964fa-6d8d-404d-ac38-72f6f88d203c"]}, {"cve": "CVE-2023-29401", "desc": "The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of \"setup.bat";x=.txt\" will be sent as a file named \"setup.bat\". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.", "poc": ["https://github.com/gin-gonic/gin/issues/3555", "https://github.com/motoyasu-saburi/reported_vulnerability"]}, {"cve": "CVE-2023-1649", "desc": "The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/ea806115-14ab-4bc4-a272-2141cb14454a"]}, {"cve": "CVE-2023-38002", "desc": "IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system. IBM X-Force ID: 260208.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-44098", "desc": "Vulnerability of missing encryption in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-40930", "desc": "An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/.", "poc": ["https://github.com/NSnidie/CVE-2023-40930", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-34832", "desc": "TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.", "poc": ["http://packetstormsecurity.com/files/172989/TP-Link-Archer-AX10-EU-_V1.2_230220-Buffer-Overflow.html"]}, {"cve": "CVE-2023-6237", "desc": "Issue summary: Checking excessively long invalid RSA public keys may takea long time.Impact summary: Applications that use the function EVP_PKEY_public_check()to check RSA public keys may experience long delays. Where the key thatis being checked has been obtained from an untrusted source this may leadto a Denial of Service.When function EVP_PKEY_public_check() is called on RSA public keys,a computation is done to confirm that the RSA modulus, n, is composite.For valid RSA keys, n is a product of two or more large primes and thiscomputation completes quickly. However, if n is an overly large prime,then this computation would take a long time.An application that calls EVP_PKEY_public_check() and supplies an RSA keyobtained from an untrusted source could be vulnerable to a Denial of Serviceattack.The function EVP_PKEY_public_check() is not called from other OpenSSLfunctions however it is called from the OpenSSL pkey command lineapplication. For that reason that application is also vulnerable if usedwith the '-pubin' and '-check' options on untrusted data.The OpenSSL SSL/TLS implementation is not affected by this issue.The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.", "poc": ["https://github.com/GrigGM/05-virt-04-docker-hw", "https://github.com/chnzzh/OpenSSL-CVE-lib", "https://github.com/seal-community/patches"]}, {"cve": "CVE-2023-34931", "desc": "A stack overflow in the EditWlanMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", "poc": ["https://github.com/h4kuy4/vuln/blob/main/H3C_B1STW/CVE-2023-34931.md"]}, {"cve": "CVE-2023-26563", "desc": "The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal. As a result, an unauthenticated attacker can: - On Windows, list files in any directory, read any file, delete any file, upload any file to any directory accessible by the web server. - On Linux, read any file, download any directory, delete any file, upload any file to any directory accessible by the web server.", "poc": ["https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2023-39951", "desc": "OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. OpenTelemetry Java Instrumentation prior to version 1.28.0 contains an issue related to the instrumentation of Java applications using the AWS SDK v2 with Amazon Simple Email Service (SES) v1 API. When SES POST requests are instrumented, the query parameters of the request are inserted into the trace `url.path` field. This behavior leads to the http body, containing the email subject and message, to be present in the trace request url metadata. Any user using a version before 1.28.0 of OpenTelemetry Java Instrumentation to instrument AWS SDK v2 call to SES\u2019s v1 SendEmail API is affected. The e-mail content sent to SES may end up in telemetry backend. This exposes the e-mail content to unintended audiences. The issue can be mitigated by updating OpenTelemetry Java Instrumentation to version 1.28.0 or later.", "poc": ["https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-hghr-r469-gfq6", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-51512", "desc": "Cross Site Request Forgery (CSRF) vulnerability in WBW Product Table by WBW.This issue affects Product Table by WBW: from n/a through 1.8.6.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-31477", "desc": "A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path.", "poc": ["https://github.com/gl-inet/CVE-issues/blob/main/3.215/Path_Traversal.md"]}, {"cve": "CVE-2023-1319", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.", "poc": ["https://huntr.dev/bounties/a822067a-d90d-4c3e-b9ef-9b2a5c2bc97f", "https://github.com/indevi0us/indevi0us"]}, {"cve": "CVE-2023-27315", "desc": "SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user credentials", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27042", "desc": "Tenda AX3 V16.03.12.11 is vulnerable to Buffer Overflow via /goform/SetFirewallCfg.", "poc": ["https://github.com/hujianjie123/vuln/blob/main/Tenda/SetFirewallCfg/readme.md"]}, {"cve": "CVE-2023-0894", "desc": "The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "poc": ["https://wpscan.com/vulnerability/d42eff41-096f-401d-bbfb-dcd6e08faca5"]}, {"cve": "CVE-2023-2323", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.", "poc": ["https://huntr.dev/bounties/41edf190-f6bf-4a29-a237-7ff1b2d048d3"]}, {"cve": "CVE-2023-27225", "desc": "A cross-site scripting (XSS) vulnerability in User Registration & Login and User Management System with Admin Panel v3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the first and last name field.", "poc": ["https://packetstormsecurity.com"]}, {"cve": "CVE-2023-27233", "desc": "Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.", "poc": ["https://gist.github.com/renanavs/dcb13bb1cd618ce7eb0c80290b837245"]}, {"cve": "CVE-2023-49084", "desc": "Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.", "poc": ["http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2023-0627", "desc": "Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affects Docker Desktop: 4.11.X.", "poc": ["https://github.com/liuli2023/myProject"]}, {"cve": "CVE-2023-36119", "desc": "** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", "poc": ["https://nvd.nist.gov/vuln/detail/CVE-2023-0527"]}, {"cve": "CVE-2023-2288", "desc": "The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.", "poc": ["https://wpscan.com/vulnerability/93acb4ee-1053-48e1-8b69-c09dc3b2f302"]}, {"cve": "CVE-2023-7192", "desc": "A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.", "poc": ["https://github.com/NaInSec/CVE-LIST", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39549", "desc": "A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 2). The affected application contains a use-after-free vulnerability that could be triggered while parsing specially crafted DWG file. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19562)", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-39443", "desc": "Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the prefix copy loop.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2023-1826", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-34062", "desc": "In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.", "poc": ["https://github.com/chainguard-dev/pombump", "https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/tanjiti/sec_profile", "https://github.com/vaikas/pombump"]}, {"cve": "CVE-2023-3883", "desc": "A vulnerability, which was classified as problematic, was found in Campcodes Beauty Salon Management System 1.0. This affects an unknown part of the file /admin/add-category.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235245 was assigned to this vulnerability.", "poc": ["https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System/Beauty%20Salon%20Management%20System%20-%20vuln%2015.pdf", "https://github.com/MorDavid/CVE-2023-38831-Winrar-Exploit-Generator-POC"]}, {"cve": "CVE-2023-6840", "desc": "An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR.", "poc": ["https://gitlab.com/gitlab-org/gitlab/-/issues/435500"]}, {"cve": "CVE-2023-3215", "desc": "Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "poc": ["https://github.com/em1ga3l/cve-msrc-extractor"]}, {"cve": "CVE-2023-1856", "desc": "A vulnerability has been found in SourceCodester Air Cargo Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/transactions/track_shipment.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224995.", "poc": ["https://vuldb.com/?id.224995"]}, {"cve": "CVE-2023-42648", "desc": "In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-36022", "desc": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-27501", "desc": "SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity", "poc": ["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"]}, {"cve": "CVE-2023-32804", "desc": "Out-of-bounds Write vulnerability in Arm Ltd Midgard GPU Userspace Driver, Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a\u00a0local non-privileged user to write a constant pattern to a limited amount of memory not allocated by the user space driver.This issue affects Midgard GPU Userspace Driver: from r0p0 through r32p0; Bifrost GPU Userspace Driver: from r0p0 through r44p0; Valhall GPU Userspace Driver: from r19p0 through r44p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r44p0.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-38120", "desc": "Adtran SR400ac ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adtran SR400ac routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the ping command, which is available over JSON-RPC. A crafted host parameter can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20525.", "poc": ["https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/warber0x/CVE-2023-38120"]}, {"cve": "CVE-2023-22959", "desc": "WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).", "poc": ["https://github.com/chenan224/webchess_sqli_poc"]}, {"cve": "CVE-2023-1105", "desc": "External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.", "poc": ["https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f"]}, {"cve": "CVE-2023-37597", "desc": "Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete user grouplist function.", "poc": ["https://github.com/sahiloj/CVE-2023-37597/blob/main/README.md", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/sahiloj/CVE-2023-37597"]}, {"cve": "CVE-2023-43121", "desc": "A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7, and before 31.7.2 allows attackers to read arbitrary files.", "poc": ["https://github.com/RhinoSecurityLabs/CVEs"]}, {"cve": "CVE-2023-50612", "desc": "Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter.", "poc": ["https://github.com/yaowenxiao721/CloudExplorer-Lite-v1.4.1-vulnerability-BOPLA"]}, {"cve": "CVE-2023-34843", "desc": "Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request.", "poc": ["https://github.com/0x783kb/Security-operation-book", "https://github.com/Imahian/CVE-2023-34843", "https://github.com/hheeyywweellccoommee/CVE-2023-34843-illrj", "https://github.com/nomi-sec/PoC-in-GitHub", "https://github.com/rootd4ddy/CVE-2023-34843"]}, {"cve": "CVE-2023-0112", "desc": "Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.", "poc": ["https://huntr.dev/bounties/ec2a29dc-79a3-44bd-a58b-15f676934af6"]}, {"cve": "CVE-2023-49294", "desc": "Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.", "poc": ["https://github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8f"]}, {"cve": "CVE-2023-27447", "desc": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS \u2013 Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc.This issue affects WP SMS \u2013 Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.0.4.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2023-52081", "desc": "ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like U+FE4D (\ufe4d), which would result in the omitted U+005F (_), for instance. The `lookupPreprocess()` function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability is fixed in 0.2.0. There are no known workarounds.", "poc": ["https://github.com/Sim4n6/Sim4n6"]}, {"cve": "CVE-2023-6380", "desc": "Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/msegoviag/msegoviag"]}, {"cve": "CVE-2023-45887", "desc": "DS Wireless Communication (DWC) with DWC_VERSION_3 and DWC_VERSION_11 allows remote attackers to execute arbitrary code on a game-playing client's machine via a modified GPCM message.", "poc": ["http://packetstormsecurity.com/files/177135/DS-Wireless-Communication-Code-Execution.html", "https://github.com/MikeIsAStar/DS-Wireless-Communication-Remote-Code-Execution"]}, {"cve": "CVE-2023-3242", "desc": "Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime