CVE-2023-3937

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-393705.4StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79)CVE-2023-393716.1StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601)CVE-2023-393728.8StarTrinity Softswitch version 2023-02-16 - Multiple CSRF (CWE-352)CVE-2023-393736.5A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.CVE-2023-393747.8ForeScout NAC SecureConnector version 11.2 - CWE-427: Uncontrolled Search Path Element CVE-2023-393759.8SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges CVE-2023-393766.5SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network CVE-2023-393777.2SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to uplo CVE-2023-393788.8SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') by an unauthenticated user CVE-2023-393797.5Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As CVE-2023-39384.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZkTeco-based OEM devices allows an a CVE-2023-393807.5Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnor