[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1384?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1385 mean in the context of cybersecurity?

[Assistant] CVE-2023-1385


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1385.

[Assistant]
Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services.

This issue affects:

Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5.
Insignia TV with FireOS 7.6.3.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1385?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1385?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1386 mean in the context of cybersecurity?

[Assistant] CVE-2023-1386


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1386.

[Assistant] A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1386?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1386?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1387 mean in the context of cybersecurity?

[Assistant] CVE-2023-1387


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1387.

[Assistant]
Grafana is an open-source platform for monitoring and observability.

Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token.

By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1387?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1387?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1388 mean in the context of cybersecurity?

[Assistant] CVE-2023-1388


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1388.

[Assistant] A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory block, resulting in the service becoming unavailable.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1388?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1388?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1389 mean in the context of cybersecurity?

[Assistant] CVE-2023-1389


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1389.

[Assistant] TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1389?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1389?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1390 mean in the context of cybersecurity?

[Assistant] CVE-2023-1390


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1390.

[Assistant] A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1390?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1390?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1391 mean in the context of cybersecurity?

[Assistant] CVE-2023-1391


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1391.

[Assistant] A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/ab.php. The manipulation of the argument img leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222978 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1391?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1391?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1392 mean in the context of cybersecurity?

[Assistant] CVE-2023-1392


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1392.

[Assistant] A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is the function save_menu. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222979.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1392?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1392?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1393 mean in the context of cybersecurity?

[Assistant] CVE-2023-1393


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1393.

[Assistant] A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1393?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1393?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1394 mean in the context of cybersecurity?

[Assistant] CVE-2023-1394


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1394.

[Assistant] A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been classified as critical. This affects the function mysqli_query of the file bsitemp.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222981 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1394?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1394?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1395 mean in the context of cybersecurity?

[Assistant] CVE-2023-1395


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1395.

[Assistant] A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affects the function query of the file admin/user/list.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222982 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1395?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1395?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1396 mean in the context of cybersecurity?

[Assistant] CVE-2023-1396


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1396.

[Assistant] A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/traveller_details.php. The manipulation of the argument address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222983.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1396?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1396?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1397 mean in the context of cybersecurity?

[Assistant] CVE-2023-1397


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1397.

[Assistant] A vulnerability classified as problematic has been found in SourceCodester Online Student Management System 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument adminname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222984.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1397?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1397?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1398 mean in the context of cybersecurity?

[Assistant] CVE-2023-1398


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1398.

[Assistant] A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload. The manipulation leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222985 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1398?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1398?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1399 mean in the context of cybersecurity?

[Assistant] CVE-2023-1399


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1399.

[Assistant] N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate privileges in the affected device’s default configuration and achieve remote code execution.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1399?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1399?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1400 mean in the context of cybersecurity?

[Assistant] CVE-2023-1400


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1400.

[Assistant] The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1400?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1400?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1401 mean in the context of cybersecurity?

[Assistant] CVE-2023-1401


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1401.

[Assistant] An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1401?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1401?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1402 mean in the context of cybersecurity?

[Assistant] CVE-2023-1402


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1402.

[Assistant] The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1402?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1402?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1403 mean in the context of cybersecurity?

[Assistant] CVE-2023-1403


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1403.

[Assistant] The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 5.0.7. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1403?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1403?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1404 mean in the context of cybersecurity?

[Assistant] CVE-2023-1404


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1404.

[Assistant] The Weaver Show Posts Plugin for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 1.6. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1404?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1404?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1405 mean in the context of cybersecurity?

[Assistant] CVE-2023-1405


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1405.

[Assistant] The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1405?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1405?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1406 mean in the context of cybersecurity?

[Assistant] CVE-2023-1406


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1406.

[Assistant] The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1406?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1406?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1407 mean in the context of cybersecurity?

[Assistant] CVE-2023-1407


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1407.

[Assistant] A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223111.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1407?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1407?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1408 mean in the context of cybersecurity?

[Assistant] CVE-2023-1408


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1408.

[Assistant] The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1408?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1408?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1409 mean in the context of cybersecurity?

[Assistant] CVE-2023-1409


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1409.

[Assistant]
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate.

This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1409?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1409?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1410 mean in the context of cybersecurity?

[Assistant] CVE-2023-1410


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1410.

[Assistant]
Grafana is an open-source platform for monitoring and observability.

Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip.

The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.

An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description.

  Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1410?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1410?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1412 mean in the context of cybersecurity?

[Assistant] CVE-2023-1412


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1412.

[Assistant]
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks (oplock) and symbolic links (which can both be created by an unprivileged user).

After installing the Cloudflare WARP Client (admin privileges required), an MSI-Installer is placed under C:\Windows\Installer. The vulnerability lies in the repair function of this MSI.

ImpactAn unprivileged (non-admin) user can exploit this vulnerability to perform privileged operations with SYSTEM context, including deleting arbitrary files and reading arbitrary file content. This can lead to a variety of attacks, including the manipulation of system files and privilege escalation.

PatchesA new installer with a fix that addresses this vulnerability was released in version 2023.3.381.0. While the WARP Client itself is not vulnerable (only the installer), users are encouraged to upgrade to the latest version and delete any older installers present in their systems.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1412?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1412?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1413 mean in the context of cybersecurity?

[Assistant] CVE-2023-1413


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1413.

[Assistant] The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1413?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1413?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1414 mean in the context of cybersecurity?

[Assistant] CVE-2023-1414


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1414.

[Assistant] The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1414?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1414?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1415 mean in the context of cybersecurity?

[Assistant] CVE-2023-1415


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1415.

[Assistant] A vulnerability was found in Simple Art Gallery 1.0. It has been declared as critical. This vulnerability affects the function sliderPicSubmit of the file adminHome.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. VDB-223126 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1415?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1415?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1416 mean in the context of cybersecurity?

[Assistant] CVE-2023-1416


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1416.

[Assistant] A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Affected is an unknown function of the file adminHome.php. The manipulation of the argument social_facebook leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223128.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1416?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1416?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1417 mean in the context of cybersecurity?

[Assistant] CVE-2023-1417


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1417.

[Assistant] An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1417?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1417?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1418 mean in the context of cybersecurity?

[Assistant] CVE-2023-1418


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1418.

[Assistant] A vulnerability classified as problematic was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file cashconfirm.php of the component POST Parameter Handler. The manipulation of the argument transactioncode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223129 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1418?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1418?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1419 mean in the context of cybersecurity?

[Assistant] CVE-2023-1419


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1419.

[Assistant] A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1419?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1419?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1420 mean in the context of cybersecurity?

[Assistant] CVE-2023-1420


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1420.

[Assistant] The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1420?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1420?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1421 mean in the context of cybersecurity?

[Assistant] CVE-2023-1421


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1421.

[Assistant] A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1421?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1421?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1424 mean in the context of cybersecurity?

[Assistant] CVE-2023-1424


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1424.

[Assistant] Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules and MELSEC iQ-R Series CPU modules allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on a target product by sending specially crafted packets. A system reset of the product is required for recovery from a denial of service (DoS) condition and malicious code execution.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1424?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1424?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1425 mean in the context of cybersecurity?

[Assistant] CVE-2023-1425


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1425.

[Assistant] The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1425?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1425?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1426 mean in the context of cybersecurity?

[Assistant] CVE-2023-1426


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1426.

[Assistant] The WP Tiles WordPress plugin through 1.1.2 does not ensure that posts to be displayed are not draft/private, allowing any authenticated users, such as subscriber to retrieve the titles of draft and privates posts for example. AN attacker could also retrieve the title of any other type of post.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1426?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1426?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1427 mean in the context of cybersecurity?

[Assistant] CVE-2023-1427


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1427.

[Assistant] - The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1427?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1427?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1428 mean in the context of cybersecurity?

[Assistant] CVE-2023-1428


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1428.

[Assistant]
There exists an vulnerability causing an abort() to be called in gRPC.
The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1428?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1428?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1429 mean in the context of cybersecurity?

[Assistant] CVE-2023-1429


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1429.

[Assistant] Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1429?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1429?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1430 mean in the context of cybersecurity?

[Assistant] CVE-2023-1430


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1430.

[Assistant] The FluentCRM - Marketing Automation For WordPress  plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.7.40 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1430?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1430?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1431 mean in the context of cybersecurity?

[Assistant] CVE-2023-1431


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1431.

[Assistant] The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 due to the plugin saving shopping cart data exports in a publicly accessible location (/wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/). This makes it possible for unauthenticated attackers to view information that should be limited to administrators only and can include data like first name, last name, email, address, IP Address, and more.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1431?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1431?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1432 mean in the context of cybersecurity?

[Assistant] CVE-2023-1432


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1432.

[Assistant] A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /fos/admin/ajax.php?action=save_settings of the component POST Request Handler. The manipulation leads to improper access controls. The attack may be launched remotely. VDB-223214 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1432?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1432?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1433 mean in the context of cybersecurity?

[Assistant] CVE-2023-1433


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1433.

[Assistant] A vulnerability was found in SourceCodester Gadget Works Online Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file admin/products/controller.php?action=add of the component Products Handler. The manipulation of the argument filename leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223215.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1433?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1433?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1435 mean in the context of cybersecurity?

[Assistant] CVE-2023-1435


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1435.

[Assistant] The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1435?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1435?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1436 mean in the context of cybersecurity?

[Assistant] CVE-2023-1436


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1436.

[Assistant] An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1436?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1436?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1437 mean in the context of cybersecurity?

[Assistant] CVE-2023-1437


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1437.

[Assistant] All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1437?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1437?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1439 mean in the context of cybersecurity?

[Assistant] CVE-2023-1439


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1439.

[Assistant] A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracker System 1.0. This issue affects some unknown processing of the file medicines/view_details.php of the component GET Parameter Handler. The manipulation of the argument GET leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223283.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1439?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1439?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1440 mean in the context of cybersecurity?

[Assistant] CVE-2023-1440


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1440.

[Assistant] A vulnerability, which was classified as critical, was found in SourceCodester Automatic Question Paper Generator System 1.0. Affected is an unknown function of the file users/user/manage_user.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223284.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1440?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1440?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1441 mean in the context of cybersecurity?

[Assistant] CVE-2023-1441


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1441.

[Assistant] A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/courses/view_course.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223285 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1441?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1441?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1442 mean in the context of cybersecurity?

[Assistant] CVE-2023-1442


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1442.

[Assistant] A vulnerability was found in Meizhou Qingyunke QYKCMS 4.3.0. It has been classified as problematic. This affects an unknown part of the file /admin_system/api.php of the component Update Handler. The manipulation of the argument downurl leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223287.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1442?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1442?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1443 mean in the context of cybersecurity?

[Assistant] CVE-2023-1443


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1443.

[Assistant] A vulnerability was found in Filseclab Twister Antivirus 8. It has been declared as problematic. This vulnerability affects the function 0x80112053 in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223288.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1443?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1443?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1444 mean in the context of cybersecurity?

[Assistant] CVE-2023-1444


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1444.

[Assistant] A vulnerability was found in Filseclab Twister Antivirus 8. It has been rated as critical. This issue affects the function 0x8011206B in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223289 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1444?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1444?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1445 mean in the context of cybersecurity?

[Assistant] CVE-2023-1445


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1445.

[Assistant] A vulnerability classified as problematic has been found in Filseclab Twister Antivirus 8. Affected is the function 0x80112053 in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. VDB-223290 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1445?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1445?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1446 mean in the context of cybersecurity?

[Assistant] CVE-2023-1446


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1446.

[Assistant] A vulnerability classified as problematic was found in Watchdog Anti-Virus 1.4.214.0. Affected by this vulnerability is the function 0x80002004/0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223291.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1446?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1446?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1447 mean in the context of cybersecurity?

[Assistant] CVE-2023-1447


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1447.

[Assistant] A vulnerability, which was classified as problematic, has been found in SourceCodester Medicine Tracker System 1.0. Affected by this issue is some unknown functionality of the file app/?page=medicines/manage_medicine. The manipulation of the argument name/description with the input <script>alert('2')</script> leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-223292.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1447?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1447?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1448 mean in the context of cybersecurity?

[Assistant] CVE-2023-1448


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1448.

[Assistant] A vulnerability, which was classified as problematic, was found in GPAC 2.3-DEV-rev35-gbbca86917-master. This affects the function gf_m2ts_process_sdt of the file media_tools/mpegts.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-223293 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1448?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1448?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1449 mean in the context of cybersecurity?

[Assistant] CVE-2023-1449


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1449.

[Assistant] A vulnerability has been found in GPAC 2.3-DEV-rev35-gbbca86917-master and classified as problematic. This vulnerability affects the function gf_av1_reset_state of the file media_tools/av_parsers.c. The manipulation leads to double free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223294 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1449?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1449?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1450 mean in the context of cybersecurity?

[Assistant] CVE-2023-1450


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1450.

[Assistant] A vulnerability was found in MP4v2 2.1.2 and classified as problematic. This issue affects the function DumpTrack of the file mp4trackdump.cpp. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223295.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1450?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1450?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1451 mean in the context of cybersecurity?

[Assistant] CVE-2023-1451


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1451.

[Assistant] A vulnerability was found in MP4v2 2.1.2. It has been classified as problematic. Affected is the function mp4v2::impl::MP4Track::GetSampleFileOffset of the file mp4track.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223296.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1451?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1451?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1452 mean in the context of cybersecurity?

[Assistant] CVE-2023-1452


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1452.

[Assistant] A vulnerability was found in GPAC 2.3-DEV-rev35-gbbca86917-master. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file filters/load_text.c. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-223297 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1452?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1452?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1453 mean in the context of cybersecurity?

[Assistant] CVE-2023-1453


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1453.

[Assistant] A vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is the function 0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-223298 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1453?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1453?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1454 mean in the context of cybersecurity?

[Assistant] CVE-2023-1454


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1454.

[Assistant] A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1454?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1454?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1455 mean in the context of cybersecurity?

[Assistant] CVE-2023-1455


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1455.

[Assistant] A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file admin/ajax.php?action=login2 of the component Login Page. The manipulation of the argument email with the input abc%40qq.com' AND (SELECT 9110 FROM (SELECT(SLEEP(5)))XSlc) AND 'jFNl'='jFNl leads to sql injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223300.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1455?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1455?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1456 mean in the context of cybersecurity?

[Assistant] CVE-2023-1456


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1456.

[Assistant] A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. This issue affects some unknown processing of the component NAT Configuration Handler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-223301 was assigned to this vulnerability. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1456?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1456?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1457 mean in the context of cybersecurity?

[Assistant] CVE-2023-1457


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1457.

[Assistant] A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-223302 is the identifier assigned to this vulnerability. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1457?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1457?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1458 mean in the context of cybersecurity?

[Assistant] CVE-2023-1458


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1458.

[Assistant] A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. Affected by this vulnerability is an unknown functionality of the component OSPF Handler. The manipulation of the argument area leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-223303. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1458?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1458?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1459 mean in the context of cybersecurity?

[Assistant] CVE-2023-1459


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1459.

[Assistant] A vulnerability was found in SourceCodester Canteen Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file changeUsername.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223304.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1459?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1459?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1460 mean in the context of cybersecurity?

[Assistant] CVE-2023-1460


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1460.

[Assistant] A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=save_user of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The identifier VDB-223305 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1460?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1460?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1461 mean in the context of cybersecurity?

[Assistant] CVE-2023-1461


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1461.

[Assistant] A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection. The attack can be initiated remotely. VDB-223306 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1461?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1461?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1462 mean in the context of cybersecurity?

[Assistant] CVE-2023-1462


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1462.

[Assistant] Authorization Bypass Through User-Controlled Key vulnerability in Vadi Corporate Information Systems DigiKent allows Authentication Bypass, Authentication Abuse. This issue affects DigiKent: before 23.03.20.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1462?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1462?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1463 mean in the context of cybersecurity?

[Assistant] CVE-2023-1463


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1463.

[Assistant] Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1463?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1463?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1464 mean in the context of cybersecurity?

[Assistant] CVE-2023-1464


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1464.

[Assistant] A vulnerability, which was classified as critical, was found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file Users.php?f=save_user. The manipulation of the argument firstname/middlename/lastname/username/password leads to improper authentication. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-223311.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1464?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1464?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1465 mean in the context of cybersecurity?

[Assistant] CVE-2023-1465


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1465.

[Assistant] The WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1465?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1465?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1466 mean in the context of cybersecurity?

[Assistant] CVE-2023-1466


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1466.

[Assistant] A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(SLEEP(5)))FWlC) AND 'butz'='butz leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223325 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1466?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1466?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1467 mean in the context of cybersecurity?

[Assistant] CVE-2023-1467


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1467.

[Assistant] A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223326 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1467?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1467?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1468 mean in the context of cybersecurity?

[Assistant] CVE-2023-1468


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1468.

[Assistant] A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipulation of the argument date_from/date_to leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-223327.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1468?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1468?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1469 mean in the context of cybersecurity?

[Assistant] CVE-2023-1469


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1469.

[Assistant] The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This can potentially be exploited by lower-privileged users if the `Admin Dashboard Access Permission` setting it set for those users to access the dashboard.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1469?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1469?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1470 mean in the context of cybersecurity?

[Assistant] CVE-2023-1470


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1470.

[Assistant] The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1470?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1470?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1471 mean in the context of cybersecurity?

[Assistant] CVE-2023-1471


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1471.

[Assistant] The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parameter in versions up to, and including, 1.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers with minimal permissions, such as a subscrber, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1471?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1471?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1472 mean in the context of cybersecurity?

[Assistant] CVE-2023-1472


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1472.

[Assistant] The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Actions include resetting the API key, accessing or deleting log files, and deleting cache among others.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1472?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1472?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1473 mean in the context of cybersecurity?

[Assistant] CVE-2023-1473


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1473.

[Assistant] The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1473?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1473?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1474 mean in the context of cybersecurity?

[Assistant] CVE-2023-1474


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1474.

[Assistant] A vulnerability classified as critical was found in SourceCodester Automatic Question Paper Generator System 1.0. This vulnerability affects unknown code of the file users/question_papers/manage_question_paper.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223336.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1474?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1474?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1475 mean in the context of cybersecurity?

[Assistant] CVE-2023-1475


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1475.

[Assistant] A vulnerability, which was classified as critical, has been found in SourceCodester Canteen Management System 1.0. This issue affects the function query of the file createuser.php. The manipulation of the argument uemail leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223337 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1475?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1475?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1476 mean in the context of cybersecurity?

[Assistant] CVE-2023-1476


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1476.

[Assistant] A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1476?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1476?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1477 mean in the context of cybersecurity?

[Assistant] CVE-2023-1477


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1477.

[Assistant] Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak Authenticator Extension: before 7.10.2, before 8.0.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1477?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1477?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1478 mean in the context of cybersecurity?

[Assistant] CVE-2023-1478


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1478.

[Assistant] The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path traversal vulnerability in the page cache module.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1478?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1478?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1479 mean in the context of cybersecurity?

[Assistant] CVE-2023-1479


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1479.

[Assistant] A vulnerability classified as critical has been found in SourceCodester Simple Music Player 1.0. Affected is an unknown function of the file save_music.php. The manipulation of the argument filename leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223362 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1479?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1479?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1480 mean in the context of cybersecurity?

[Assistant] CVE-2023-1480


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1480.

[Assistant] A vulnerability classified as critical was found in SourceCodester Monitoring of Students Cyber Accounts System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php of the component POST Parameter Handler. The manipulation of the argument un leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223363.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1480?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1480?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1481 mean in the context of cybersecurity?

[Assistant] CVE-2023-1481


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1481.

[Assistant] A vulnerability, which was classified as problematic, has been found in SourceCodester Monitoring of Students Cyber Accounts System 1.0. Affected by this issue is some unknown functionality of the file modules/balance/index.php?view=balancelist of the component POST Parameter Handler. The manipulation of the argument id with the input "><script>alert(111)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223364.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1481?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1481?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1482 mean in the context of cybersecurity?

[Assistant] CVE-2023-1482


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1482.

[Assistant] A vulnerability, which was classified as problematic, was found in HkCms 2.2.4.230206. This affects an unknown part of the file /admin.php/appcenter/local.html?type=addon of the component External Plugin Handler. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223365 was assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1482?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1482?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1483 mean in the context of cybersecurity?

[Assistant] CVE-2023-1483


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1483.

[Assistant] A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical. This vulnerability affects unknown code of the file /admin/getallarticleinfo. The manipulation of the argument searchInfo leads to sql injection. The attack can be initiated remotely. VDB-223366 is the identifier assigned to this vulnerability.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1483?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1483?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1484 mean in the context of cybersecurity?

[Assistant] CVE-2023-1484


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2023-1484.

[Assistant] A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipulation of the argument uploadFile leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-223367.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2023-1484?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2023-1484?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2023-1485 mean in the context of cybersecurity?

[Assistant] CVE-2023-1485