[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0542.

[Assistant] The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0542?

[Assistant] {'url': 'https://wpscan.com/vulnerability/17de2f77-3e6c-4c22-9196-6e5577ee7fcf', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0542?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0543 mean in the context of cybersecurity?

[Assistant] CVE-2023-0543


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0543.

[Assistant] The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0543?

[Assistant] {'url': 'https://wpscan.com/vulnerability/e3771938-40b5-4e8b-bb5a-847131a2b4a7', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0543?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0544 mean in the context of cybersecurity?

[Assistant] CVE-2023-0544


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0544.

[Assistant] The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0544?

[Assistant] {'url': 'https://wpscan.com/vulnerability/8ef9585f-67d7-4651-977a-fcad113882bd', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0544?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0545 mean in the context of cybersecurity?

[Assistant] CVE-2023-0545


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0545.

[Assistant] The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0545?

[Assistant] {'url': 'https://wpscan.com/vulnerability/b604afc8-61d0-4e98-8950-f3d29f9e9ee1', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0545?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0546 mean in the context of cybersecurity?

[Assistant] CVE-2023-0546


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0546.

[Assistant] The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0546?

[Assistant] {'url': 'https://wpscan.com/vulnerability/078f33cd-0f5c-46fe-b858-2107a09c6b69', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0546?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0547 mean in the context of cybersecurity?

[Assistant] CVE-2023-0547


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0547.

[Assistant] OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug. This vulnerability affects Thunderbird < 102.10.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0547?

[Assistant] {'url': 'https://www.mozilla.org/security/advisories/mfsa2023-15/'}, {'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1811298'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0547?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0548 mean in the context of cybersecurity?

[Assistant] CVE-2023-0548


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0548.

[Assistant] The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0548?

[Assistant] {'url': 'https://wpscan.com/vulnerability/b6c1ed7a-5b2d-4985-847d-56586b1aae9b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0548?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0549 mean in the context of cybersecurity?

[Assistant] CVE-2023-0549


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0549.

[Assistant] A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/PostPrivateMessage of the component Private Message Handler. The manipulation of the argument subject/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.11 is able to address this issue. The identifier of the patch is 2237a9d552e258a43570bb478a92a5505e7c8797. It is recommended to upgrade the affected component. The identifier VDB-219665 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0549?

[Assistant] {'url': 'https://vuldb.com/?id.219665', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219665', 'tags': ['signature', 'permissions-required']}, {'url': 'https://drive.google.com/drive/folders/1ct6Tp_cnsYO8L_JSvlBCf_Ae7KW3JAcD?usp=sharing', 'tags': ['exploit']}, {'url': 'https://github.com/YAFNET/YAFNET/security/advisories/GHSA-4hwx-678w-9cp5', 'tags': ['related']}, {'url': 'https://github.com/YAFNET/YAFNET/commit/2237a9d552e258a43570bb478a92a5505e7c8797', 'tags': ['patch']}, {'url': 'https://github.com/YAFNET/YAFNET/releases/tag/v3.1.11', 'tags': ['patch']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0549?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0550 mean in the context of cybersecurity?

[Assistant] CVE-2023-0550


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0550.

[Assistant] The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided to the AJAX action is indeed a menu item. This makes it possible for authenticated attackers, with subscriber-level access or higher, to modify or delete arbitrary posts.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0550?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0550?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0551 mean in the context of cybersecurity?

[Assistant] CVE-2023-0551


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0551.

[Assistant] The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0551?

[Assistant] {'url': 'https://wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-f12a2c655a7d', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0551?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0552 mean in the context of cybersecurity?

[Assistant] CVE-2023-0552


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0552.

[Assistant] The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0552?

[Assistant] {'url': 'https://wpscan.com/vulnerability/832c6155-a413-4641-849c-b98ba55e8551', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0552?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0553 mean in the context of cybersecurity?

[Assistant] CVE-2023-0553


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0553.

[Assistant] The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0553?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0553?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0554 mean in the context of cybersecurity?

[Assistant] CVE-2023-0554


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0554.

[Assistant] The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0554?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0554?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0555 mean in the context of cybersecurity?

[Assistant] CVE-2023-0555


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0555.

[Assistant] The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those actions intended for administrator use. Actions include menu item creation, update and deletion and other menu management functions. Since the plugin does not verify that a post ID passed to one of its AJAX actions belongs to a menu item, this can lead to arbitrary post deletion/alteration.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0555?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0555?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0556 mean in the context of cybersecurity?

[Assistant] CVE-2023-0556


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0556.

[Assistant] The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0556?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0556?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0557 mean in the context of cybersecurity?

[Assistant] CVE-2023-0557


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0557.

[Assistant] The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0557?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0557?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0558 mean in the context of cybersecurity?

[Assistant] CVE-2023-0558


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0558.

[Assistant] The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper API keys.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0558?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0558?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0559 mean in the context of cybersecurity?

[Assistant] CVE-2023-0559


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0559.

[Assistant] The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0559?

[Assistant] {'url': 'https://wpscan.com/vulnerability/e5549261-66e2-4a5e-8781-bc555b629ccc', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0559?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0560 mean in the context of cybersecurity?

[Assistant] CVE-2023-0560


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0560.

[Assistant] A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219701 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0560?

[Assistant] {'url': 'https://vuldb.com/?id.219701', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219701', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_practice_pdf_id.md', 'tags': ['broken-link', 'exploit']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0560?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0561 mean in the context of cybersecurity?

[Assistant] CVE-2023-0561


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0561.

[Assistant] A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-219702 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0561?

[Assistant] {'url': 'https://vuldb.com/?id.219702', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219702', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/_user_s_id.md', 'tags': ['broken-link', 'exploit']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0561?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0562 mean in the context of cybersecurity?

[Assistant] CVE-2023-0562


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0562.

[Assistant] A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0562?

[Assistant] {'url': 'https://vuldb.com/?id.219716', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219716', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md', 'tags': ['exploit']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0562?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0563 mean in the context of cybersecurity?

[Assistant] CVE-2023-0563


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0563.

[Assistant] A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219717 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0563?

[Assistant] {'url': 'https://vuldb.com/?id.219717', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219717', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/BLMS_XSS_IN_ADMIN_BROWSER.md', 'tags': ['exploit']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0563?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0564 mean in the context of cybersecurity?

[Assistant] CVE-2023-0564


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0564.

[Assistant] Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0564?

[Assistant] {'url': 'https://huntr.dev/bounties/a4f86d6f-0d5d-428d-a4b3-551b20a21ce6'}, {'url': 'https://github.com/froxlor/froxlor/commit/2a84e9c1207fd3d792b7fb198fd0c66fe1a66a7a'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0564?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0565 mean in the context of cybersecurity?

[Assistant] CVE-2023-0565


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0565.

[Assistant] Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0565?

[Assistant] {'url': 'https://huntr.dev/bounties/12d78294-1723-4450-a239-023952666102'}, {'url': 'https://github.com/froxlor/froxlor/commit/2feb8020941a82bfb4ac68890f6ced0e5b3c4a15'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0565?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0566 mean in the context of cybersecurity?

[Assistant] CVE-2023-0566


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0566.

[Assistant] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0566?

[Assistant] {'url': 'https://huntr.dev/bounties/8339e4f1-d430-4845-81b5-36dd9fcdac49'}, {'url': 'https://github.com/froxlor/froxlor/commit/bd5b99dc1c06f594b9563d459a50bf3b32504876'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0566?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0567 mean in the context of cybersecurity?

[Assistant] CVE-2023-0567


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0567.

[Assistant] In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0567?

[Assistant] {'url': 'https://bugs.php.net/bug.php?id=81744'}, {'url': 'https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0567?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0568 mean in the context of cybersecurity?

[Assistant] CVE-2023-0568


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0568.

[Assistant] In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0568?

[Assistant] {'url': 'https://bugs.php.net/bug.php?id=81746'}, {'url': 'https://security.netapp.com/advisory/ntap-20230517-0001/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0568?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0569 mean in the context of cybersecurity?

[Assistant] CVE-2023-0569


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0569.

[Assistant] Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0569?

[Assistant] {'url': 'https://huntr.dev/bounties/81b1e1da-10dd-435e-94ae-4bdd41df6df9'}, {'url': 'https://github.com/publify/publify/commit/8905e4e639cf03b758da558568a86c9816253b2d'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0569?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0570 mean in the context of cybersecurity?

[Assistant] CVE-2023-0570


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0570.

[Assistant] A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file user\operations\payment_operation.php. The manipulation of the argument booking_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219729 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0570?

[Assistant] {'url': 'https://vuldb.com/?id.219729', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219729', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/user_operations_payment_operation_booking_id.md', 'tags': ['broken-link', 'exploit']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0570?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0571 mean in the context of cybersecurity?

[Assistant] CVE-2023-0571


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0571.

[Assistant] A vulnerability has been found in SourceCodester Canteen Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file createcustomer.php of the component Add Customer. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219730 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0571?

[Assistant] {'url': 'https://vuldb.com/?id.219730', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219730', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/ctflearner/Vulnerability/blob/main/Canteen%20Management%20System/Canteen_Management_System_XSS_IN_Add_Customer.md', 'tags': ['exploit']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0571?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0572 mean in the context of cybersecurity?

[Assistant] CVE-2023-0572


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0572.

[Assistant] Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0572?

[Assistant] {'url': 'https://huntr.dev/bounties/4ab24ee2-3ff6-4248-9555-0af3e5f754ec'}, {'url': 'https://github.com/froxlor/froxlor/commit/7b08a71c59430d06c1efb012a6c6448262aacdb1'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0572?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0574 mean in the context of cybersecurity?

[Assistant] CVE-2023-0574


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0574.

[Assistant] Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0574?

[Assistant] {'url': 'https://www.yugabyte.com/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0574?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0575 mean in the context of cybersecurity?

[Assistant] CVE-2023-0575


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0575.

[Assistant]
External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipulation, Privilege Abuse. This vulnerability is associated with program files backup.Py.

This issue affects Yugabyte DB: Lesser then 2.2.0.0


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0575?

[Assistant] {'url': 'https://www.yugabyte.com/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0575?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0576 mean in the context of cybersecurity?

[Assistant] CVE-2023-0576


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0576.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0576?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0576?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0577 mean in the context of cybersecurity?

[Assistant] CVE-2023-0577


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0577.

[Assistant] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information Technologies SOBIAD allows Cross-Site Scripting (XSS).This issue affects SOBIAD: before 23.02.01.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0577?

[Assistant] {'tags': ['government-resource'], 'url': 'https://www.usom.gov.tr/bildirim/tr-23-0125'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0577?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0578 mean in the context of cybersecurity?

[Assistant] CVE-2023-0578


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0578.

[Assistant] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information Technologies Book Cites allows Cross-Site Scripting (XSS).This issue affects Book Cites: before 23.01.05.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0578?

[Assistant] {'tags': ['government-resource'], 'url': 'https://www.usom.gov.tr/bildirim/tr-23-0125'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0578?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0579 mean in the context of cybersecurity?

[Assistant] CVE-2023-0579


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0579.

[Assistant] The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0579?

[Assistant] {'url': 'https://wpscan.com/vulnerability/574f7607-96d8-4ef8-b96c-0425ad7e7690', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0579?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0580 mean in the context of cybersecurity?

[Assistant] CVE-2023-0580


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0580.

[Assistant]
Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability to gain access to the secure application data or take control of the application.
Of the services that make up the My Control System (on-premise) application, the following ones are affected by this vulnerability:
User Interface
System Monitoring1
Asset Inventory

This issue affects My Control System (on-premise): from 5.0;0 through 5.13.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0580?

[Assistant] {'url': 'https://search.abb.com/library/Download.aspx?DocumentID=7PAA007893&LanguageCode=en&DocumentPartId=&Action=Launch'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0580?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0581 mean in the context of cybersecurity?

[Assistant] CVE-2023-0581


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0581.

[Assistant] The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it possible for unauthenticated attackers to bypass any login restrictions  that may prevent a brute force attack.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0581?

[Assistant] {'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/de73304e-7a28-4304-b1ed-2f6dd7738236'}, {'url': 'https://lcweb.it/privatecontent/changelog'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0581?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0582 mean in the context of cybersecurity?

[Assistant] CVE-2023-0582


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0582.

[Assistant]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass.

This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0582?

[Assistant] {'tags': ['product'], 'url': 'https://backstage.forgerock.com/downloads/browse/am/featured'}, {'tags': ['mitigation', 'release-notes', 'vendor-advisory'], 'url': 'https://backstage.forgerock.com/knowledge/kb/article/a64088600'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0582?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0583 mean in the context of cybersecurity?

[Assistant] CVE-2023-0583


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0583.

[Assistant] The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0583?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0583?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0584 mean in the context of cybersecurity?

[Assistant] CVE-2023-0584


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0584.

[Assistant] The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_font_awesome_version' option to an arbitrary value.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0584?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0584?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0585 mean in the context of cybersecurity?

[Assistant] CVE-2023-0585


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0585.

[Assistant] The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0585?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0585?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0586 mean in the context of cybersecurity?

[Assistant] CVE-2023-0586


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0586.

[Assistant] The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0586?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0586?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0587 mean in the context of cybersecurity?

[Assistant] CVE-2023-0587


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0587.

[Assistant] A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e., \PCCSRV\TEMP\SampleSubmission) on the server. The attacker can upload a large number of large files to fill up the file system on which the Apex One server is installed.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0587?

[Assistant] {'url': 'https://www.tenable.com/security/research/tra-2023-5'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0587?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0588 mean in the context of cybersecurity?

[Assistant] CVE-2023-0588


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0588.

[Assistant] The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0588?

[Assistant] {'url': 'https://wpscan.com/vulnerability/84be272e-0891-461c-91ad-496b64f92f8f', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0588?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0589 mean in the context of cybersecurity?

[Assistant] CVE-2023-0589


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0589.

[Assistant] The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0589?

[Assistant] {'url': 'https://wpscan.com/vulnerability/58649228-69a6-4028-8487-166b0a07fcf7', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0589?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0590 mean in the context of cybersecurity?

[Assistant] CVE-2023-0590


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0590.

[Assistant] A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()") not applied yet, then kernel could be affected.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0590?

[Assistant] {'url': 'https://lore.kernel.org/all/20221018203258.2793282-1-edumazet%40google.com/'}, {'name': '[debian-lts-announce] 20240111 [SECURITY] [DLA 3710-1] linux security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0590?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0591 mean in the context of cybersecurity?

[Assistant] CVE-2023-0591


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0591.

[Assistant]
ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory).

This is due to the fact that a node name (dent_node.name) is considered trusted and joined to the extraction directory path during processing, then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g. ../../tmp/outside.txt), it's possible to force ubi_reader to write outside of the extraction directory.

This issue affects ubi-reader before 0.8.5.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0591?

[Assistant] {'url': 'https://github.com/jrspruitt/ubi_reader/pull/57'}, {'url': 'https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0591?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0592 mean in the context of cybersecurity?

[Assistant] CVE-2023-0592


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0592.

[Assistant] A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outside of the extraction directory.This issue affects jefferson: before 0.4.1.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0592?

[Assistant] {'url': 'https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/'}, {'url': 'https://github.com/sviehb/jefferson/commit/971aca1a8b3b9f4fcb4674fa9621d3349195cdc6'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0592?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0593 mean in the context of cybersecurity?

[Assistant] CVE-2023-0593


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0593.

[Assistant]
A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory.

This issue affects yaffshiv up to version 0.1 included, which is the most recent at time of publication.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0593?

[Assistant] {'url': 'https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/'}, {'url': 'https://github.com/devttys0/yaffshiv/pull/3/files'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0593?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0594 mean in the context of cybersecurity?

[Assistant] CVE-2023-0594


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0594.

[Assistant]
Grafana is an open-source platform for monitoring and observability.

Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization.

The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded.

An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript.

This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.

Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0594?

[Assistant] {'url': 'https://grafana.com/security/security-advisories/cve-2023-0594/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0594?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0595 mean in the context of cybersecurity?

[Assistant] CVE-2023-0595


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0595.

[Assistant] A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server's database web port (default 443). Affected products: EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2021(All Versions prior to October 2022), ClearSCADA (All Versions)


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0595?

[Assistant] {'url': 'https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-01.pdf'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0595?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0597 mean in the context of cybersecurity?

[Assistant] CVE-2023-0597


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0597.

[Assistant] A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0597?

[Assistant] {'url': 'https://git.kernel.org/linus/97e3d26b5e5f371b3ee223d94dd123e6c442ba80'}, {'name': '[oss-security] 20230728 Re: StackRot (CVE-2023-3269): Linux kernel privilege escalation vulnerability', 'tags': ['mailing-list'], 'url': 'http://www.openwall.com/lists/oss-security/2023/07/28/1'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0597?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0598 mean in the context of cybersecurity?

[Assistant] CVE-2023-0598


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0598.

[Assistant] GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0598?

[Assistant] {'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03'}, {'url': 'https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0598?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0599 mean in the context of cybersecurity?

[Assistant] CVE-2023-0599


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0599.

[Assistant] Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization.  Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another Metasploit Pro user using a specially crafted request. Note that in most deployments, all Metasploit Pro users tend to enjoy privileges equivalent to local administrator.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0599?

[Assistant] {'tags': ['release-notes'], 'url': 'https://docs.rapid7.com/release-notes/metasploit/20230130/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0599?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0600 mean in the context of cybersecurity?

[Assistant] CVE-2023-0600


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0600.

[Assistant] The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0600?

[Assistant] {'url': 'https://wpscan.com/vulnerability/8f46df4d-cb80-4d66-846f-85faf2ea0ec4', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0600?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0602 mean in the context of cybersecurity?

[Assistant] CVE-2023-0602


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0602.

[Assistant] The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0602?

[Assistant] {'url': 'https://wpscan.com/vulnerability/c357f93d-4f21-4cd9-9378-d97756c75255', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0602?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0603 mean in the context of cybersecurity?

[Assistant] CVE-2023-0603


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0603.

[Assistant] The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0603?

[Assistant] {'url': 'https://wpscan.com/vulnerability/1c93ea8f-4e68-4da1-994e-35a5873278ba', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0603?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0604 mean in the context of cybersecurity?

[Assistant] CVE-2023-0604


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0604.

[Assistant] The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0604?

[Assistant] {'url': 'https://wpscan.com/vulnerability/4492b5ad-c339-47f5-9003-a9c5f23efdd9', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0604?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0605 mean in the context of cybersecurity?

[Assistant] CVE-2023-0605


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0605.

[Assistant] The Auto Rename Media On Upload WordPress plugin before 1.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0605?

[Assistant] {'url': 'https://wpscan.com/vulnerability/57267c3c-d55e-4b37-a6d0-c5cd8569625c', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0605?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0606 mean in the context of cybersecurity?

[Assistant] CVE-2023-0606


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0606.

[Assistant] Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0606?

[Assistant] {'url': 'https://huntr.dev/bounties/0bfed46d-ac96-43c4-93fb-13f68b4e711b'}, {'url': 'https://github.com/ampache/ampache/commit/d3191503ca856dfe0b33d7cb17717ffd480046cb'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0606?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0607 mean in the context of cybersecurity?

[Assistant] CVE-2023-0607


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0607.

[Assistant] Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0607?

[Assistant] {'url': 'https://huntr.dev/bounties/9294743d-7818-4264-b973-59de027d549b'}, {'url': 'https://github.com/projectsend/projectsend/commit/698be4ade1db6ae0eaf27c843a03ffc9683cca0a'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0607?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0608 mean in the context of cybersecurity?

[Assistant] CVE-2023-0608


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0608.

[Assistant] Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0608?

[Assistant] {'url': 'https://github.com/microweber/microweber/commit/20df56615e61624f5fff149849753869e4b3b936'}, {'url': 'https://huntr.dev/bounties/02a86e0d-dff7-4e27-89d5-2f7dcd4b580c'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0608?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0609 mean in the context of cybersecurity?

[Assistant] CVE-2023-0609


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0609.

[Assistant] Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0609?

[Assistant] {'url': 'https://huntr.dev/bounties/3adef66f-fc86-4e6d-a540-2ffa59342ff0'}, {'url': 'https://github.com/wallabag/wallabag/commit/0f7460dbab9e29f4f7d2944aca20210f828b6abb'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0609?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0610 mean in the context of cybersecurity?

[Assistant] CVE-2023-0610


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0610.

[Assistant] Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0610?

[Assistant] {'url': 'https://huntr.dev/bounties/8fdd9b31-d89b-4bbe-9557-20b960faf926'}, {'url': 'https://github.com/wallabag/wallabag/commit/5ac6b6bff9e2e3a87fd88c2904ff3c6aac40722e'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0610?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0611 mean in the context of cybersecurity?

[Assistant] CVE-2023-0611


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0611.

[Assistant] A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing of the file get_set.ccp of the component Web Management Interface. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219935.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0611?

[Assistant] {'url': 'https://vuldb.com/?id.219935', 'tags': ['vdb-entry', 'technical-description', 'exploit']}, {'url': 'https://vuldb.com/?ctiid.219935', 'tags': ['signature']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0611?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0612 mean in the context of cybersecurity?

[Assistant] CVE-2023-0612


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0612.

[Assistant] A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /wireless/basic.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219936.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0612?

[Assistant] {'url': 'https://vuldb.com/?id.219936', 'tags': ['vdb-entry', 'technical-description', 'exploit']}, {'url': 'https://vuldb.com/?ctiid.219936', 'tags': ['signature']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0612?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0613 mean in the context of cybersecurity?

[Assistant] CVE-2023-0613


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0613.

[Assistant] A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /wireless/security.asp of the component httpd. The manipulation leads to memory corruption. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219937 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0613?

[Assistant] {'url': 'https://vuldb.com/?id.219937', 'tags': ['vdb-entry', 'technical-description', 'exploit']}, {'url': 'https://vuldb.com/?ctiid.219937', 'tags': ['signature']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0613?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0614 mean in the context of cybersecurity?

[Assistant] CVE-2023-0614


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0614.

[Assistant] The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0614?

[Assistant] {'url': 'https://www.samba.org/samba/security/CVE-2023-0614.html'}, {'url': 'https://security.netapp.com/advisory/ntap-20230406-0007/'}, {'name': 'FEDORA-2023-1c172e3264', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXBPYIA4VWNOD437NAHZ3NXKAETLFB5S/'}, {'name': 'GLSA-202309-06', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202309-06'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0614?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0615 mean in the context of cybersecurity?

[Assistant] CVE-2023-0615


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0615.

[Assistant] A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0615?

[Assistant] {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2166287'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0615?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0616 mean in the context of cybersecurity?

[Assistant] CVE-2023-0616


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0616.

[Assistant] If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacker could send a crafted message with this structure to attempt a DoS attack. This vulnerability affects Thunderbird < 102.8.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0616?

[Assistant] {'url': 'https://www.mozilla.org/security/advisories/mfsa2023-07/'}, {'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1806507'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0616?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0617 mean in the context of cybersecurity?

[Assistant] CVE-2023-0617


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0617.

[Assistant] A vulnerability was found in TRENDNet TEW-811DRU 1.0.10.0. It has been classified as critical. This affects an unknown part of the file /wireless/guestnetwork.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219957 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0617?

[Assistant] {'url': 'https://vuldb.com/?id.219957', 'tags': ['vdb-entry', 'technical-description', 'exploit']}, {'url': 'https://vuldb.com/?ctiid.219957', 'tags': ['signature']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0617?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0618 mean in the context of cybersecurity?

[Assistant] CVE-2023-0618


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0618.

[Assistant] A vulnerability was found in TRENDnet TEW-652BRP 3.04B01. It has been declared as critical. This vulnerability affects unknown code of the file cfg_op.ccp of the component Web Service. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219958 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0618?

[Assistant] {'url': 'https://vuldb.com/?id.219958', 'tags': ['vdb-entry', 'technical-description', 'exploit']}, {'url': 'https://vuldb.com/?ctiid.219958', 'tags': ['signature']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0618?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0619 mean in the context of cybersecurity?

[Assistant] CVE-2023-0619


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0619.

[Assistant] The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset image optimizations.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0619?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0619?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0620 mean in the context of cybersecurity?

[Assistant] CVE-2023-0620


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0620.

[Assistant]
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command.

This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0620?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0620?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0621 mean in the context of cybersecurity?

[Assistant] CVE-2023-0621


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0621.

[Assistant] Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds read vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in reads past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0621?

[Assistant] {'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-040-04'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0621?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0622 mean in the context of cybersecurity?

[Assistant] CVE-2023-0622


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0622.

[Assistant] Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0622?

[Assistant] {'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-040-04'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0622?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0623 mean in the context of cybersecurity?

[Assistant] CVE-2023-0623


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0623.

[Assistant] Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0623?

[Assistant] {'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-040-04'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0623?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0624 mean in the context of cybersecurity?

[Assistant] CVE-2023-0624


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0624.

[Assistant] OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0624?

[Assistant] {'url': 'https://github.com/Orangescrum/orangescrum/'}, {'url': 'https://fluidattacks.com/advisories/oberhofer/'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0624?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0625 mean in the context of cybersecurity?

[Assistant] CVE-2023-0625


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0625.

[Assistant]
Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog.

This issue affects Docker Desktop: before 4.12.0.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0625?

[Assistant] {'tags': ['release-notes'], 'url': 'https://docs.docker.com/desktop/release-notes/#4120'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0625?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0626 mean in the context of cybersecurity?

[Assistant] CVE-2023-0626


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0626.

[Assistant]
Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route.

This issue affects Docker Desktop: before 4.12.0.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0626?

[Assistant] {'tags': ['release-notes'], 'url': 'https://docs.docker.com/desktop/release-notes/#4120'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0626?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0627 mean in the context of cybersecurity?

[Assistant] CVE-2023-0627


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0627.

[Assistant] Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affects Docker Desktop: 4.11.X.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0627?

[Assistant] {'tags': ['release-notes'], 'url': 'https://docs.docker.com/desktop/release-notes/#4120'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0627?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0628 mean in the context of cybersecurity?

[Assistant] CVE-2023-0628


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0628.

[Assistant] Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0628?

[Assistant] {'tags': ['release-notes'], 'url': 'https://docs.docker.com/desktop/release-notes/#4170'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0628?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0629 mean in the context of cybersecurity?

[Assistant] CVE-2023-0629


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0629.

[Assistant]
Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket).

The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges.
This issue has been fixed in Docker Desktop 4.17.0.

Affected Docker Desktop versions: from 4.13.0 before 4.17.0.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0629?

[Assistant] {'tags': ['release-notes'], 'url': 'https://docs.docker.com/desktop/release-notes/#4170'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0629?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0630 mean in the context of cybersecurity?

[Assistant] CVE-2023-0630


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0630.

[Assistant] The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0630?

[Assistant] {'url': 'https://wpscan.com/vulnerability/b82bdd02-b699-4527-86cc-d60b56ab0c55', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0630?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0631 mean in the context of cybersecurity?

[Assistant] CVE-2023-0631


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0631.

[Assistant] The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0631?

[Assistant] {'url': 'https://wpscan.com/vulnerability/19ef92fd-b493-4488-91f0-e6ba51362f79', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0631?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0632 mean in the context of cybersecurity?

[Assistant] CVE-2023-0632


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0632.

[Assistant] An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0632?

[Assistant] {'name': 'GitLab Issue #390148', 'tags': ['issue-tracking'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/390148'}, {'name': 'HackerOne Bug Bounty Report #1852677', 'tags': ['technical-description', 'exploit', 'permissions-required'], 'url': 'https://hackerone.com/reports/1852677'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0632?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-0633 mean in the context of cybersecurity?

[Assistant] CVE-2023-0633


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0633.

[Assistant] In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop: before 4.12.0.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-0633?

[Assistant] {'tags': ['release-notes'], 'url': 'https://docs.docker.com/desktop/release-notes/#4120'}


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0633?

[Assistant] PUBLISHED