Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1998?


Explain the CVE ID: What does the identifier CVE-2022-1999 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1999.

An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain conditions, using the REST API an unprivileged user was able to change labels description.


Provide references for further information: Can you share references or external links related to CVE-2022-1999?

{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/357963'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1999.json'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1999?


Explain the CVE ID: What does the identifier CVE-2023-0001 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0001.

An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent.


Provide references for further information: Can you share references or external links related to CVE-2023-0001?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0001?


Explain the CVE ID: What does the identifier CVE-2023-0002 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0002.

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.


Provide references for further information: Can you share references or external links related to CVE-2023-0002?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0002?


Explain the CVE ID: What does the identifier CVE-2023-0003 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0003.

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.


Provide references for further information: Can you share references or external links related to CVE-2023-0003?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0003?


Explain the CVE ID: What does the identifier CVE-2023-0004 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0004.

A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges.

These files can include logs and system components that impact the integrity and availability of PAN-OS software.


Provide references for further information: Can you share references or external links related to CVE-2023-0004?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0004?


Explain the CVE ID: What does the identifier CVE-2023-0005 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0005.

A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.


Provide references for further information: Can you share references or external links related to CVE-2023-0005?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0005?


Explain the CVE ID: What does the identifier CVE-2023-0006 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0006.

A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with elevated privileges through a race condition.


Provide references for further information: Can you share references or external links related to CVE-2023-0006?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0006?


Explain the CVE ID: What does the identifier CVE-2023-0007 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0007.

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed.


Provide references for further information: Can you share references or external links related to CVE-2023-0007?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0007?


Explain the CVE ID: What does the identifier CVE-2023-0008 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0008.

A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.


Provide references for further information: Can you share references or external links related to CVE-2023-0008?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0008?


Explain the CVE ID: What does the identifier CVE-2023-0009 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0009.

A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated privileges.


Provide references for further information: Can you share references or external links related to CVE-2023-0009?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0009?


Explain the CVE ID: What does the identifier CVE-2023-0010 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0010.

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.


Provide references for further information: Can you share references or external links related to CVE-2023-0010?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0010?


Explain the CVE ID: What does the identifier CVE-2023-0011 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0011.

A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial interface to send malicious AT commands.

Exploitation of the vulnerability gives full administrative (root) privileges to the attacker to execute any operating system command on TOBY-L2 which can lead to modification of the behavior of the module itself as well as the components connected with it (depending on its rights on other connected systems). It can further provide the ability to read system level files and hamper the availability of the module as well..

This issue affects TOBY-L2 series: TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220, TOBY-L280.


Provide references for further information: Can you share references or external links related to CVE-2023-0011?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0011?


Explain the CVE ID: What does the identifier CVE-2023-0012 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0012.

In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SAP_LocaAdmin are denied the ability to logon locally by security policy so that this can only occur if the system has already been compromised.


Provide references for further information: Can you share references or external links related to CVE-2023-0012?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0012?


Explain the CVE ID: What does the identifier CVE-2023-0013 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0013.

The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.


Provide references for further information: Can you share references or external links related to CVE-2023-0013?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0013?


Explain the CVE ID: What does the identifier CVE-2023-0014 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0014.

SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system.


Provide references for further information: Can you share references or external links related to CVE-2023-0014?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0014?


Explain the CVE ID: What does the identifier CVE-2023-0015 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0015.

In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intelligence DHTML may be vulnerable to XSS attacks. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.


Provide references for further information: Can you share references or external links related to CVE-2023-0015?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0015?


Explain the CVE ID: What does the identifier CVE-2023-0016 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0016.

SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection vulnerability and could allow an attacker to access, modify, and/or delete data from the backend database.


Provide references for further information: Can you share references or external links related to CVE-2023-0016?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0016?


Explain the CVE ID: What does the identifier CVE-2023-0017 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0017.

An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current system. This could allow the attacker to have full read access to user data, make modifications to user data, and make services within the system unavailable.


Provide references for further information: Can you share references or external links related to CVE-2023-0017?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0017?


Explain the CVE ID: What does the identifier CVE-2023-0018 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0018.

Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports containing a malicious payload. Once these reports are viewable, anyone who opens those reports would be susceptible to stored XSS attacks. As a result of the attack, information maintained in the victim's web browser can be read, modified, and sent to the attacker.


Provide references for further information: Can you share references or external links related to CVE-2023-0018?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0018?


Explain the CVE ID: What does the identifier CVE-2023-0019 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0019.

In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.


Provide references for further information: Can you share references or external links related to CVE-2023-0019?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0019?


Explain the CVE ID: What does the identifier CVE-2023-0020 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0020.

SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality and limited impact on integrity of the application.


Provide references for further information: Can you share references or external links related to CVE-2023-0020?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0020?


Explain the CVE ID: What does the identifier CVE-2023-0021 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0021.

Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.


Provide references for further information: Can you share references or external links related to CVE-2023-0021?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0021?


Explain the CVE ID: What does the identifier CVE-2023-0022 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0022.

SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application causing a high impact on the confidentiality, integrity, and availability of the application.


Provide references for further information: Can you share references or external links related to CVE-2023-0022?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0022?


Explain the CVE ID: What does the identifier CVE-2023-0023 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0023.

In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the application.


Provide references for further information: Can you share references or external links related to CVE-2023-0023?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0023?


Explain the CVE ID: What does the identifier CVE-2023-0024 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0024.

SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources, resulting in Cross-Site Scripting vulnerability.


Provide references for further information: Can you share references or external links related to CVE-2023-0024?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0024?


Explain the CVE ID: What does the identifier CVE-2023-0025 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0025.

SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources.


Provide references for further information: Can you share references or external links related to CVE-2023-0025?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0025?


Explain the CVE ID: What does the identifier CVE-2023-0026 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0026.

An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occurs as soon as the update is received. This issue is exploitable remotely as the respective attribute can propagate through unaffected systems and intermediate AS (if any). Continuous receipt of a BGP update containing this attribute will create a sustained Denial of Service (DoS) condition. Some customers have experienced these BGP session flaps which prompted Juniper SIRT to release this advisory out of cycle before fixed releases are widely available as there is an effective workaround.

This issue affects:
Juniper Networks Junos OS
15.1R1 and later versions prior to 20.4R3-S8;
21.1 version 21.1R1 and later versions prior to 21.2R3-S6;
21.3 versions prior to 21.3R3-S5;
21.4 versions prior to 21.4R3-S4;
22.1 versions prior to 22.1R3-S4;
22.2 versions prior to 22.2R3-S2;
22.3 versions prior to 22.3R2-S2, 22.3R3-S1;
22.4 versions prior to 22.4R2-S1, 22.4R3;
23.1 versions prior to 23.1R1-S1, 23.1R2.

Juniper Networks Junos OS Evolved
All versions prior to 20.4R3-S8-EVO;
21.1 version 21.1R1-EVO and later versions prior to 21.2R3-S6-EVO;
21.3 versions prior to 21.3R3-S5-EVO;
21.4 versions prior to 21.4R3-S4-EVO;
22.1 versions prior to 22.1R3-S4-EVO;
22.2 versions prior to 22.2R3-S2-EVO;
22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
23.1 versions prior to 23.1R1-S1-EVO, 23.1R2-EVO.


Provide references for further information: Can you share references or external links related to CVE-2023-0026?

{'tags': ['vendor-advisory'], 'url': 'https://supportportal.juniper.net/JSA71542'}, {'tags': ['product'], 'url': 'https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0026?


Explain the CVE ID: What does the identifier CVE-2023-0027 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0027.

Rockwell Automation Modbus TCP Server AOI prior to 2.04.00 is vulnerable to an unauthorized user sending a malformed message that could cause the controller to respond with a copy of the most recent response to the last valid request. If exploited, an unauthorized user could read the connected device’s Modbus TCP Server AOI information.


Provide references for further information: Can you share references or external links related to CVE-2023-0027?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0027?


Explain the CVE ID: What does the identifier CVE-2023-0028 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0028.

Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+.


Provide references for further information: Can you share references or external links related to CVE-2023-0028?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0028?


Explain the CVE ID: What does the identifier CVE-2023-0029 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0029.

A vulnerability was found in Multilaser RE708 RE1200R4GC-2T2R-V3_v3411b_MUL029B. It has been rated as problematic. This issue affects some unknown processing of the component Telnet Service. The manipulation leads to denial of service. The attack may be initiated remotely. The identifier VDB-217169 was assigned to this vulnerability.


Provide references for further information: Can you share references or external links related to CVE-2023-0029?

{'url': 'https://vuldb.com/?id.217169', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.217169', 'tags': ['signature', 'permissions-required']}, {'url': 'https://www.youtube.com/watch?v=yh0pK7YlmI4', 'tags': ['media-coverage']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0029?


Explain the CVE ID: What does the identifier CVE-2023-0030 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0030.

A use-after-free flaw was found in the Linux kernel’s nouveau driver in how a user triggers a memory overflow that causes the nvkm_vma_tail function to fail. This flaw allows a local user to crash or potentially escalate their privileges on the system.


Provide references for further information: Can you share references or external links related to CVE-2023-0030?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0030?


Explain the CVE ID: What does the identifier CVE-2023-0033 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0033.

The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.


Provide references for further information: Can you share references or external links related to CVE-2023-0033?

{'url': 'https://wpscan.com/vulnerability/2d9ae43b-75a7-4fcc-bce3-d9e9d7a97ec0', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0033?


Explain the CVE ID: What does the identifier CVE-2023-0034 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0034.

The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks


Provide references for further information: Can you share references or external links related to CVE-2023-0034?

{'url': 'https://wpscan.com/vulnerability/ffbdb8a1-19c3-45e9-81b0-ad47a0791c4a', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0034?


Explain the CVE ID: What does the identifier CVE-2023-0035 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0035.

softbus_client_stub in communication subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay attack".Local attackers can bypass authentication and attack other SAs with high privilege.


Provide references for further information: Can you share references or external links related to CVE-2023-0035?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0035?


Explain the CVE ID: What does the identifier CVE-2023-0036 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0036.

platform_callback_stub in misc subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay attack".Local attackers can bypass authentication and attack other SAs with high privilege.


Provide references for further information: Can you share references or external links related to CVE-2023-0036?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0036?


Explain the CVE ID: What does the identifier CVE-2023-0037 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0037.

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection


Provide references for further information: Can you share references or external links related to CVE-2023-0037?

{'url': 'https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'https://bulletin.iese.de/post/wd-google-maps_1-0-72_1'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0037?


Explain the CVE ID: What does the identifier CVE-2023-0038 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0038.

The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page.


Provide references for further information: Can you share references or external links related to CVE-2023-0038?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0038?


Explain the CVE ID: What does the identifier CVE-2023-0039 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0039.


Provide references for further information: Can you share references or external links related to CVE-2023-0039?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0039?


Explain the CVE ID: What does the identifier CVE-2023-0040 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0040.

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.


Provide references for further information: Can you share references or external links related to CVE-2023-0040?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0040?


Explain the CVE ID: What does the identifier CVE-2023-0041 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0041.

IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration.  IBM X-Force ID:  243657.


Provide references for further information: Can you share references or external links related to CVE-2023-0041?

{'tags': ['vendor-advisory'], 'url': 'https://www.ibm.com/support/pages/node/7000021'}, {'tags': ['vdb-entry'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/243657'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0041?


Explain the CVE ID: What does the identifier CVE-2023-0042 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0042.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols.


Provide references for further information: Can you share references or external links related to CVE-2023-0042?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0042?


Explain the CVE ID: What does the identifier CVE-2023-0043 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0043.

The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin


Provide references for further information: Can you share references or external links related to CVE-2023-0043?

{'url': 'https://wpscan.com/vulnerability/e012f23a-7daf-4ef3-b116-d0e2ed5bd0a3', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0043?


Explain the CVE ID: What does the identifier CVE-2023-0044 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0044.

If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.


Provide references for further information: Can you share references or external links related to CVE-2023-0044?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0044?


Explain the CVE ID: What does the identifier CVE-2023-0045 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0045.

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set  function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall.  The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176.

We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96


Provide references for further information: Can you share references or external links related to CVE-2023-0045?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0045?


Explain the CVE ID: What does the identifier CVE-2023-0046 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0046.

Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.


Provide references for further information: Can you share references or external links related to CVE-2023-0046?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0046?


Explain the CVE ID: What does the identifier CVE-2023-0047 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0047.


Provide references for further information: Can you share references or external links related to CVE-2023-0047?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0047?


Explain the CVE ID: What does the identifier CVE-2023-0048 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0048.

Code Injection in GitHub repository lirantal/daloradius prior to master-branch.


Provide references for further information: Can you share references or external links related to CVE-2023-0048?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0048?


Explain the CVE ID: What does the identifier CVE-2023-0049 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0049.

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.


Provide references for further information: Can you share references or external links related to CVE-2023-0049?

{'url': 'https://huntr.dev/bounties/5e6f325c-ba54-4bf0-b050-dca048fd3fd9'}, {'url': 'https://github.com/vim/vim/commit/7b17eb4b063a234376c1ec909ee293e42cff290c'}, {'name': 'FEDORA-2023-0f6a9433cf', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3Y752EAVACVC5XY2TMGGOAIU25VQRPDW/'}, {'name': 'FEDORA-2023-208f2107d5', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T33LLWHLH63XDCO5OME7NWN63RA4U5HF/'}, {'url': 'https://support.apple.com/kb/HT213670'}, {'name': '20230327 APPLE-SA-2023-03-27-3 macOS Ventura 13.3', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2023/Mar/17'}, {'name': 'GLSA-202305-16', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-16'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0049?


Explain the CVE ID: What does the identifier CVE-2023-0050 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0050.

An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.


Provide references for further information: Can you share references or external links related to CVE-2023-0050?

{'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/387023'}, {'url': 'https://hackerone.com/reports/1731349'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0050.json'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0050?


Explain the CVE ID: What does the identifier CVE-2023-0051 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0051.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.


Provide references for further information: Can you share references or external links related to CVE-2023-0051?

{'url': 'https://huntr.dev/bounties/1c8686db-baa6-42dc-ba45-aed322802de9'}, {'url': 'https://github.com/vim/vim/commit/c32949b0779106ed5710ae3bffc5053e49083ab4'}, {'url': 'https://support.apple.com/kb/HT213670'}, {'name': '20230327 APPLE-SA-2023-03-27-3 macOS Ventura 13.3', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2023/Mar/17'}, {'name': 'GLSA-202305-16', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-16'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0051?


Explain the CVE ID: What does the identifier CVE-2023-0052 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0052.

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol (FTP) are the only protocols available for device management, an unauthorized user could access the system and modify the device configuration, which could result in the unauthorized user executing unrestricted malicious commands.


Provide references for further information: Can you share references or external links related to CVE-2023-0052?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0052?


Explain the CVE ID: What does the identifier CVE-2023-0053 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0053.

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and
prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet
available for device management. Any sensitive information communicated
through these protocols, such as credentials, is sent in cleartext. An
attacker could obtain sensitive information such as user credentials to
gain access to the system.


Provide references for further information: Can you share references or external links related to CVE-2023-0053?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0053?


Explain the CVE ID: What does the identifier CVE-2023-0054 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0054.

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.


Provide references for further information: Can you share references or external links related to CVE-2023-0054?

{'url': 'https://huntr.dev/bounties/b289ee0f-fd16-4147-bd01-c6289c45e49d'}, {'url': 'https://github.com/vim/vim/commit/3ac1d97a1d9353490493d30088256360435f7731'}, {'url': 'https://support.apple.com/kb/HT213670'}, {'name': '20230327 APPLE-SA-2023-03-27-3 macOS Ventura 13.3', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2023/Mar/17'}, {'name': 'GLSA-202305-16', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-16'}, {'name': '[debian-lts-announce] 20230612 [SECURITY] [DLA 3453-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0054?


Explain the CVE ID: What does the identifier CVE-2023-0055 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0055.

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.


Provide references for further information: Can you share references or external links related to CVE-2023-0055?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0055?


Explain the CVE ID: What does the identifier CVE-2023-0056 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0056.

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.


Provide references for further information: Can you share references or external links related to CVE-2023-0056?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0056?


Explain the CVE ID: What does the identifier CVE-2023-0057 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0057.

Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.


Provide references for further information: Can you share references or external links related to CVE-2023-0057?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0057?


Explain the CVE ID: What does the identifier CVE-2023-0058 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0058.

The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack


Provide references for further information: Can you share references or external links related to CVE-2023-0058?

{'url': 'https://wpscan.com/vulnerability/0e677df9-2c49-42f0-a8e2-dbcf85bfc1a2', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0058?


Explain the CVE ID: What does the identifier CVE-2023-0059 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0059.

The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0059?

{'url': 'https://wpscan.com/vulnerability/5e26c485-9a5a-44a3-95b3-6c063a1c321c', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0059?


Explain the CVE ID: What does the identifier CVE-2023-0060 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0060.

The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0060?

{'url': 'https://wpscan.com/vulnerability/be2fc859-3158-4f06-861d-382381a7551b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0060?


Explain the CVE ID: What does the identifier CVE-2023-0061 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0061.

The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0061?

{'url': 'https://wpscan.com/vulnerability/a1d0d131-c773-487e-88f8-e3d63936fbbb', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0061?


Explain the CVE ID: What does the identifier CVE-2023-0062 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0062.

The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0062?

{'url': 'https://wpscan.com/vulnerability/450f94a3-56b1-41c7-ac29-fbda1dc04794', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0062?


Explain the CVE ID: What does the identifier CVE-2023-0063 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0063.

The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0063?

{'url': 'https://wpscan.com/vulnerability/2262f2fc-8122-46ed-8e67-8c34ee35fc97', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0063?


Explain the CVE ID: What does the identifier CVE-2023-0064 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0064.

The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0064?

{'url': 'https://wpscan.com/vulnerability/97be5795-b5b8-40c7-80bf-7da95da7705a', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0064?


Explain the CVE ID: What does the identifier CVE-2023-0065 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0065.

The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0065?

{'url': 'https://wpscan.com/vulnerability/42c3ac68-4bbc-4d47-ad53-2c9ed48cd677', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0065?


Explain the CVE ID: What does the identifier CVE-2023-0066 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0066.

The Companion Sitemap Generator WordPress plugin through 4.5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0066?

{'url': 'https://wpscan.com/vulnerability/545c9e2f-bacd-4f30-ae01-de1583e26d32', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0066?


Explain the CVE ID: What does the identifier CVE-2023-0067 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0067.

The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0067?

{'url': 'https://wpscan.com/vulnerability/92f43da9-9903-4bcf-99e8-0e269072d389', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0067?


Explain the CVE ID: What does the identifier CVE-2023-0068 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0068.

The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0068?

{'url': 'https://wpscan.com/vulnerability/4abd1454-380c-4c23-8474-d7da4b2f3b8e', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0068?


Explain the CVE ID: What does the identifier CVE-2023-0069 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0069.

The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0069?

{'url': 'https://wpscan.com/vulnerability/d9f00bcb-3746-4a9d-a222-4d532e84615f', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0069?


Explain the CVE ID: What does the identifier CVE-2023-0070 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0070.

The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0070?

{'url': 'https://wpscan.com/vulnerability/0d8fbd1a-9fac-42ac-94e0-f8921deb1696', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0070?


Explain the CVE ID: What does the identifier CVE-2023-0071 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0071.

The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0071?

{'url': 'https://wpscan.com/vulnerability/3834a162-2cdc-41e9-9c9d-2b576eed4db9', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0071?


Explain the CVE ID: What does the identifier CVE-2023-0072 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0072.

The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0072?

{'url': 'https://wpscan.com/vulnerability/bb2b876f-7216-4f31-9d1f-a45405c545ce', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0072?


Explain the CVE ID: What does the identifier CVE-2023-0073 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0073.

The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0073?

{'url': 'https://wpscan.com/vulnerability/e5599968-a435-405a-8829-9840a2144987', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0073?


Explain the CVE ID: What does the identifier CVE-2023-0074 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0074.

The WP Social Widget WordPress plugin before 2.2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0074?

{'url': 'https://wpscan.com/vulnerability/82f543e3-9397-4364-9546-af5ea134fcd4', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0074?


Explain the CVE ID: What does the identifier CVE-2023-0075 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0075.

The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0075?

{'url': 'https://wpscan.com/vulnerability/097acd6f-3291-4cdc-a054-4432b6350411', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0075?


Explain the CVE ID: What does the identifier CVE-2023-0076 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0076.

The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0076?

{'url': 'https://wpscan.com/vulnerability/a0a44f8a-877c-40df-a3ba-b9b806ffb772/', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0076?


Explain the CVE ID: What does the identifier CVE-2023-0077 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0077.

Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to overflow buffers via unspecified vectors.


Provide references for further information: Can you share references or external links related to CVE-2023-0077?

{'url': 'https://www.synology.com/en-global/security/advisory/Synology_SA_22_25', 'name': 'Synology_SA_22_25', 'tags': ['vendor-advisory']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0077?


Explain the CVE ID: What does the identifier CVE-2023-0078 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0078.

The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users with a role as low as subscriber to perform Stored XSS attacks against higher privilege users


Provide references for further information: Can you share references or external links related to CVE-2023-0078?

{'url': 'https://wpscan.com/vulnerability/e667854f-56f8-4dbe-9573-6652a8aacc2c', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0078?


Explain the CVE ID: What does the identifier CVE-2023-0079 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0079.

The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0079?

{'url': 'https://wpscan.com/vulnerability/fdaba4d1-950d-4512-95de-cd43fe9e73e5/', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0079?


Explain the CVE ID: What does the identifier CVE-2023-0080 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0080.

The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.


Provide references for further information: Can you share references or external links related to CVE-2023-0080?

{'url': 'https://wpscan.com/vulnerability/6b0d63ed-e244-4f20-8f10-a6e0c7ccadd4', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0080?


Explain the CVE ID: What does the identifier CVE-2023-0081 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0081.

The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0081?

{'url': 'https://wpscan.com/vulnerability/76d2963c-ebff-498f-9484-3c3008750c14', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0081?


Explain the CVE ID: What does the identifier CVE-2023-0082 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0082.

The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0082?

{'url': 'https://wpscan.com/vulnerability/e1ba5047-0c39-478f-89c7-b0bb638efdff', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0082?


Explain the CVE ID: What does the identifier CVE-2023-0083 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0083.

The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions,

OpenHarmony-v3.0.7 and prior versions

has an Improper Input Validation vulnerability which local attackers can exploit this vulnerability to send malicious data, causing the current application to crash.


Provide references for further information: Can you share references or external links related to CVE-2023-0083?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0083?


Explain the CVE ID: What does the identifier CVE-2023-0084 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0084.

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page.


Provide references for further information: Can you share references or external links related to CVE-2023-0084?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0084?


Explain the CVE ID: What does the identifier CVE-2023-0085 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0085.

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.


Provide references for further information: Can you share references or external links related to CVE-2023-0085?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0085?


Explain the CVE ID: What does the identifier CVE-2023-0086 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0086.

The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.  This can be used to enable SVG uploads that could make Cross-Site Scripting possible.


Provide references for further information: Can you share references or external links related to CVE-2023-0086?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0086?


Explain the CVE ID: What does the identifier CVE-2023-0087 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0087.

The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ parameter in versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.


Provide references for further information: Can you share references or external links related to CVE-2023-0087?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0087?


Explain the CVE ID: What does the identifier CVE-2023-0088 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0088.

The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other things. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.


Provide references for further information: Can you share references or external links related to CVE-2023-0088?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0088?


Explain the CVE ID: What does the identifier CVE-2023-0089 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0089.

The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'.

This affects all versions 8.20.0 and below.


Provide references for further information: Can you share references or external links related to CVE-2023-0089?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0089?


Explain the CVE ID: What does the identifier CVE-2023-0090 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0090.

The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'.  Exploitation requires network access to the webservices API, but such access is a non-standard configuration.  This affects all versions 8.20.0 and below.


Provide references for further information: Can you share references or external links related to CVE-2023-0090?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0090?


Explain the CVE ID: What does the identifier CVE-2023-0091 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0091.

A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.


Provide references for further information: Can you share references or external links related to CVE-2023-0091?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0091?


Explain the CVE ID: What does the identifier CVE-2023-0093 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0093.

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment.


Provide references for further information: Can you share references or external links related to CVE-2023-0093?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0093?


Explain the CVE ID: What does the identifier CVE-2023-0094 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0094.

The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0094?

{'url': 'https://wpscan.com/vulnerability/1453471f-164d-4487-a736-8cea086212fe/', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0094?


Explain the CVE ID: What does the identifier CVE-2023-0095 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0095.

The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0095?

{'url': 'https://wpscan.com/vulnerability/009ca72e-e8fa-4fdc-ab2d-4210f8f4710f', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0095?


Explain the CVE ID: What does the identifier CVE-2023-0096 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0096.

The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0096?

{'url': 'https://wpscan.com/vulnerability/b28150e7-214b-4bcd-85c0-e819c4223484', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0096?


Explain the CVE ID: What does the identifier CVE-2023-0097 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0097.

The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Provide references for further information: Can you share references or external links related to CVE-2023-0097?

{'url': 'https://wpscan.com/vulnerability/19379f08-d667-4b1e-a774-0f4a17ad7bff', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0097?


Explain the CVE ID: What does the identifier CVE-2023-0098 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0098.

The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.


Provide references for further information: Can you share references or external links related to CVE-2023-0098?

{'url': 'https://wpscan.com/vulnerability/db0b3275-40df-404e-aa8d-53558f0122d8', 'tags': ['exploit', 'vdb-entry', 'technical-description']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0098?


Explain the CVE ID: What does the identifier CVE-2023-0099 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0099.

The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.


Provide references for further information: Can you share references or external links related to CVE-2023-0099?

{'url': 'https://wpscan.com/vulnerability/fd50f2d6-e420-4220-b485-73f33227e8f8', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'http://packetstormsecurity.com/files/176983/WordPress-Simple-URLs-Cross-Site-Scripting.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0099?


Explain the CVE ID: What does the identifier CVE-2023-0100 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0100.

In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.


Provide references for further information: Can you share references or external links related to CVE-2023-0100?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0100?


Explain the CVE ID: What does the identifier CVE-2023-0101 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0101.

A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potentially execute a specially crafted file to obtain root or NT AUTHORITY / SYSTEM privileges on the Nessus host.


Provide references for further information: Can you share references or external links related to CVE-2023-0101?

{'url': 'https://www.tenable.com/security/tns-2023-01'}, {'url': 'https://www.tenable.com/security/tns-2023-02'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0101?


Explain the CVE ID: What does the identifier CVE-2023-0102 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0102.

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files.


Provide references for further information: Can you share references or external links related to CVE-2023-0102?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0102?


Explain the CVE ID: What does the identifier CVE-2023-0103 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0103.

If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communication buffer, the device stops operating. This could allow an attacker to cause a denial-of-service condition.


Provide references for further information: Can you share references or external links related to CVE-2023-0103?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0103?


Explain the CVE ID: What does the identifier CVE-2023-0104 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0104.

The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user’s computer or gain access to sensitive data.


Provide references for further information: Can you share references or external links related to CVE-2023-0104?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0104?


Explain the CVE ID: What does the identifier CVE-2023-0105 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0105.

A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.


Provide references for further information: Can you share references or external links related to CVE-2023-0105?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0105?


Explain the CVE ID: What does the identifier CVE-2023-0106 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0106.

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.


Provide references for further information: Can you share references or external links related to CVE-2023-0106?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0106?


Explain the CVE ID: What does the identifier CVE-2023-0107 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0107.


Provide references for further information: Can you share references or external links related to CVE-2023-0107?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0107?


Explain the CVE ID: What does the identifier CVE-2023-0108 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0108.


Provide references for further information: Can you share references or external links related to CVE-2023-0108?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0108?


Explain the CVE ID: What does the identifier CVE-2023-0109 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0109.

A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.


Provide references for further information: Can you share references or external links related to CVE-2023-0109?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0109?


Explain the CVE ID: What does the identifier CVE-2023-0110 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0110.


Provide references for further information: Can you share references or external links related to CVE-2023-0110?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0110?


Explain the CVE ID: What does the identifier CVE-2023-0111 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0111.


Provide references for further information: Can you share references or external links related to CVE-2023-0111?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0111?


Explain the CVE ID: What does the identifier CVE-2023-0112 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0112.


Provide references for further information: Can you share references or external links related to CVE-2023-0112?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0112?


Explain the CVE ID: What does the identifier CVE-2023-0113 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0113.

A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-217591.


Provide references for further information: Can you share references or external links related to CVE-2023-0113?

{'url': 'https://vuldb.com/?id.217591', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.217591', 'tags': ['signature']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0113?


Explain the CVE ID: What does the identifier CVE-2023-0114 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0114.

A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to cleartext storage in a file or on disk. Local access is required to approach this attack. The identifier of this vulnerability is VDB-217592.


Provide references for further information: Can you share references or external links related to CVE-2023-0114?

{'url': 'https://vuldb.com/?id.217592', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.217592', 'tags': ['signature']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0114?


Explain the CVE ID: What does the identifier CVE-2023-0115 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0115.


Provide references for further information: Can you share references or external links related to CVE-2023-0115?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0115?


Explain the CVE ID: What does the identifier CVE-2023-0116 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0116.

The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability.


Provide references for further information: Can you share references or external links related to CVE-2023-0116?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0116?


Explain the CVE ID: What does the identifier CVE-2023-0117 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0117.

The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this vulnerability may affect availability of features,such as MeeTime.


Provide references for further information: Can you share references or external links related to CVE-2023-0117?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0117?


Explain the CVE ID: What does the identifier CVE-2023-0118 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0118.

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.


Provide references for further information: Can you share references or external links related to CVE-2023-0118?

{'url': 'https://access.redhat.com/errata/RHSA-2023:4466', 'name': 'RHSA-2023:4466', 'tags': ['vendor-advisory', 'x_refsource_REDHAT']}, {'url': 'https://access.redhat.com/errata/RHSA-2023:5979', 'name': 'RHSA-2023:5979', 'tags': ['vendor-advisory', 'x_refsource_REDHAT']}, {'url': 'https://access.redhat.com/errata/RHSA-2023:5980', 'name': 'RHSA-2023:5980', 'tags': ['vendor-advisory', 'x_refsource_REDHAT']}, {'url': 'https://access.redhat.com/errata/RHSA-2023:6818', 'name': 'RHSA-2023:6818', 'tags': ['vendor-advisory', 'x_refsource_REDHAT']}, {'url': 'https://access.redhat.com/security/cve/CVE-2023-0118', 'tags': ['vdb-entry', 'x_refsource_REDHAT']}, {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2159291', 'name': 'RHBZ#2159291', 'tags': ['issue-tracking', 'x_refsource_REDHAT']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0118?


Explain the CVE ID: What does the identifier CVE-2023-0119 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0119.

A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials.


Provide references for further information: Can you share references or external links related to CVE-2023-0119?

{'url': 'https://access.redhat.com/errata/RHSA-2023:3387', 'name': 'RHSA-2023:3387', 'tags': ['vendor-advisory', 'x_refsource_REDHAT']}, {'url': 'https://access.redhat.com/errata/RHSA-2023:6818', 'name': 'RHSA-2023:6818', 'tags': ['vendor-advisory', 'x_refsource_REDHAT']}, {'url': 'https://access.redhat.com/security/cve/CVE-2023-0119', 'tags': ['vdb-entry', 'x_refsource_REDHAT']}, {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2159104', 'name': 'RHBZ#2159104', 'tags': ['issue-tracking', 'x_refsource_REDHAT']}, {'url': 'https://projects.theforeman.org/issues/35977'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0119?


Explain the CVE ID: What does the identifier CVE-2023-0120 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0120.

An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user.


Provide references for further information: Can you share references or external links related to CVE-2023-0120?

{'name': 'GitLab Issue #387531', 'tags': ['issue-tracking'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/387531'}, {'name': 'HackerOne Bug Bounty Report #1818425', 'tags': ['technical-description', 'exploit', 'permissions-required'], 'url': 'https://hackerone.com/reports/1818425'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0120?


Explain the CVE ID: What does the identifier CVE-2023-0121 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0121.

A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.


Provide references for further information: Can you share references or external links related to CVE-2023-0121?

{'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/387549'}, {'url': 'https://hackerone.com/reports/1774688'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.json'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0121?


Explain the CVE ID: What does the identifier CVE-2023-0122 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0122.

A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4.


Provide references for further information: Can you share references or external links related to CVE-2023-0122?

{'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=da0342a3aa0357795224e6283df86444e1117168'}, {'name': '[oss-security] 20230118 Re: CVE-2023-0122: Linux kernel: Pre-Auth Remote DoS in NVMe', 'tags': ['mailing-list'], 'url': 'http://www.openwall.com/lists/oss-security/2023/01/18/1'}, {'url': 'https://security.netapp.com/advisory/ntap-20230302-0002/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0122?


Explain the CVE ID: What does the identifier CVE-2023-0123 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0123.

Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.


Provide references for further information: Can you share references or external links related to CVE-2023-0123?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0123?


Explain the CVE ID: What does the identifier CVE-2023-0124 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0124.

Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to an out-of-bounds write, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.


Provide references for further information: Can you share references or external links related to CVE-2023-0124?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0124?


Explain the CVE ID: What does the identifier CVE-2023-0125 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0125.

A vulnerability was found in Control iD Gerencia Web 1.30. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation of the argument Nome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217717 was assigned to this vulnerability.


Provide references for further information: Can you share references or external links related to CVE-2023-0125?

{'url': 'https://vuldb.com/?id.217717', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.217717', 'tags': ['signature', 'permissions-required']}, {'url': 'https://www.notion.so/ControlID-XSS-7ab891644a794103b582a59360f071a5', 'tags': ['broken-link', 'exploit']}


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0125?


Explain the CVE ID: What does the identifier CVE-2023-0126 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0126.

Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.


Provide references for further information: Can you share references or external links related to CVE-2023-0126?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0126?


Explain the CVE ID: What does the identifier CVE-2023-0127 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0127.

A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.


Provide references for further information: Can you share references or external links related to CVE-2023-0127?


Explain the state of this CVE: What is the publication or resolution state of CVE-2023-0127?


Explain the CVE ID: What does the identifier CVE-2023-0128 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-0128.

Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)