{"vulnerability": "cve-2023-3819", "sightings": [{"uuid": "aa773bb4-552a-49f3-9bb8-5ab7a36abcb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38192", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-04)", "content": "", "creation_timestamp": "2025-02-04T00:00:00.000000Z"}, {"uuid": "4797257d-9c03-4996-a9b7-8b7d931b2641", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38199", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mfhjl3rkrk2o", "content": "", "creation_timestamp": "2026-02-22T16:09:51.463710Z"}, {"uuid": "302c9b4a-ff94-4a32-87bc-af2655d81922", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38197", "type": "seen", "source": "https://gist.github.com/jakirkham/b16b96bb6b20b7a5405e686931fd28cd", "content": "", "creation_timestamp": "2026-01-14T19:38:38.000000Z"}, {"uuid": "90bd233a-59b2-4ba7-b85d-dc1cd0e604b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38191", "type": "seen", "source": "https://t.me/cibsecurity/72721", "content": "\u203c CVE-2023-38191 \u203c\n\nAn issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-21T02:35:32.000000Z"}, {"uuid": "8c83d280-f567-4b02-bc3b-641ccc62fdb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-3819", "type": "seen", "source": "https://t.me/cibsecurity/67097", "content": "\u203c CVE-2023-3819 \u203c\n\nExposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-21T18:23:36.000000Z"}, {"uuid": "d6d2f031-f9b9-4dc2-b83c-75b861800bd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38195", "type": "seen", "source": "https://t.me/cibsecurity/67116", "content": "\u203c CVE-2023-38195 \u203c\n\nDatalust Seq before 2023.2.9489 allows insertion of sensitive information into an externally accessible file or directory. This is exploitable only when external (SQL Server or PostgreSQL) metadata storage is used. Exploitation can only occur from a high-privileged user account.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-22T20:24:32.000000Z"}, {"uuid": "a82560ec-f42e-40a9-a1c9-2dc1f226de3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38199", "type": "seen", "source": "https://t.me/cibsecurity/66617", "content": "\u203c CVE-2023-38199 \u203c\n\ncoreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not block multiple Content-Type headers, which might allow attackers to bypass a WAF with a crafted payload, aka \"Content-Type confusion.\" This occurs when the web application relies on only the last Content-Type header.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-13T07:45:14.000000Z"}, {"uuid": "98bd8a07-bfe6-410e-a38f-5662d852715f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38198", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e4a880d8-9274-45cd-885b-1deb63543f25", "content": "", "creation_timestamp": "2026-06-19T12:46:51.717440Z"}, {"uuid": "cb9466fb-32a3-4b97-8fa0-c6e8ed68ac85", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38192", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4839be45-b35b-45a6-b4ad-924573f4e183", "content": "", "creation_timestamp": "2026-06-23T14:06:12.448107Z"}, {"uuid": "bf2ebbae-0575-4ff5-b048-329e7f80c5bb", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2023-38192", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/43210a69-c5f7-4dc5-a195-e28f44d26368", "content": "", "creation_timestamp": "2026-06-30T09:23:57.328539Z"}, {"uuid": "3c084a7a-1096-49db-863e-7a341339fa77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38198", "type": "seen", "source": "https://t.me/hn_best_comments/19085", "content": "Re: The Bogus CVE Problem\n        \nThis resonates. Unfortunately, the CVE database(s) are too noisy to be useful. It could benefit from higher standards and more thorough vetting. (Maybe take some lessons from academia.)\n\nA \"security researcher\" once filed a CVE for a regular bug in Caddy [0], making claims that were totally provably false. It was assigned 7.5... the same as Heartbleed [1] -- yes, the one that leaked almost all the private encryption keys on the Internet back in 2014. When I appealed to NVD for retraction (or whatever they do in this case), I never heard back, despite several emails / form submissions. It is not well-maintained. It is poorly managed. There is virtually no oversight. NVD is a trainwreck.\n\nMore recently I inadvertently discovered a 0-day RCE in acme.sh [2]. (ACME clients are security-sensitive contexts since they typically deal with private keys and download signed credentials.) Anyway, it was assigned a CVSS 3.x score of * 9.8 * [3] -- I imagine that should be like \"cyber-nuclear meltdown\" territory, but no, this was actually benign as far as we can tell. Probably deserves more like a 4 or 5 or something. So, again: There is virtually no oversight. NVD is a trainwreck.\n\nAnyway, the whole system is broken, and I'm effectively ignoring CVEs now. But if someone just tells me to patch my , I'll probably do it, and that's good enough for me.\n\n[0]: https://github.com/caddyserver/caddy/issues/4775\n\n[1]: https://nvd.nist.gov/vuln/detail/cve-2014-0160\n\n[2]: https://matt.life/writing/the-acme-protocol-in-practice-and-reality\n\n[3]: https://nvd.nist.gov/vuln/detail/CVE-2023-38198\n        \nmholt, 1 day ago", "creation_timestamp": "2026-07-29T12:01:07.148763Z"}, {"uuid": "47492b80-7ca9-43d9-85db-f45d02fe8581", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38198", "type": "seen", "source": "https://t.me/hn_best_comments/19085", "content": "Re: The Bogus CVE Problem\n        \nThis resonates. Unfortunately, the CVE database(s) are too noisy to be useful. It could benefit from higher standards and more thorough vetting. (Maybe take some lessons from academia.)\n\nA \"security researcher\" once filed a CVE for a regular bug in Caddy [0], making claims that were totally provably false. It was assigned 7.5... the same as Heartbleed [1] -- yes, the one that leaked almost all the private encryption keys on the Internet back in 2014. When I appealed to NVD for retraction (or whatever they do in this case), I never heard back, despite several emails / form submissions. It is not well-maintained. It is poorly managed. There is virtually no oversight. NVD is a trainwreck.\n\nMore recently I inadvertently discovered a 0-day RCE in acme.sh [2]. (ACME clients are security-sensitive contexts since they typically deal with private keys and download signed credentials.) Anyway, it was assigned a CVSS 3.x score of * 9.8 * [3] -- I imagine that should be like \"cyber-nuclear meltdown\" territory, but no, this was actually benign as far as we can tell. Probably deserves more like a 4 or 5 or something. So, again: There is virtually no oversight. NVD is a trainwreck.\n\nAnyway, the whole system is broken, and I'm effectively ignoring CVEs now. But if someone just tells me to patch my , I'll probably do it, and that's good enough for me.\n\n[0]: https://github.com/caddyserver/caddy/issues/4775\n\n[1]: https://nvd.nist.gov/vuln/detail/cve-2014-0160\n\n[2]: https://matt.life/writing/the-acme-protocol-in-practice-and-reality\n\n[3]: https://nvd.nist.gov/vuln/detail/CVE-2023-38198\n        \nmholt, 1 day ago", "creation_timestamp": "2026-07-30T00:01:47.347807Z"}]}