alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2023-43545 (published 2024-06-03)
Memory corruption when more scan frequency list or channels are sent from the user space.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, fastconnect_7800, fastconnect_7800_firmware, qca6554a, qca6554a_firmware, qca6564au, qca6564au_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6584au, qca6584au_firmware, qca6595, qca6595_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca8081, qca8081_firmware, qca8337
CVE-2023-43546 (published 2024-03-04)
Memory corruption while invoking HGSL IOCTL context create.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, flight_rb5_5g, flight_rb5_5g_firmware, mdm9628, mdm9628_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8650p, qam8650p_firmware, qam8775p
CVE-2023-43547 (published 2024-03-04)
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, flight_rb5_5g, flight_rb5_5g_firmware, mdm9628, mdm9628_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8650p, qam8650p_firmware, qam8775p
CVE-2023-43548 (published 2024-03-04)
Memory corruption while parsing qcp clip with invalid chunk data size.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6800, fastconnect_6800_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8650p, qam8650p_firmware, qam8775p, qam8775p_firmware, qamsrv1h, qamsrv1h_firmware, qamsrv1m, qamsrv1m_firmware, qca6310
CVE-2023-43549 (published 2024-03-04)
Memory corruption while processing TPC target power table in FTM TPC.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, csr8811, csr8811_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6800, fastconnect_6800_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, immersive_home_214, immersive_home_214_firmware, immersive_home_216, immersive_home_216_firmware, immersive_home_316, immersive_home_316_firmware, immersive_home_318, immersive_home_318_firmware, immersive_home_3210, immersive_home_3210_firmware, immersive_home_326, immersive_home_326_firmware, ipq5010
CVE-2023-4355 (published 2023-08-15)
Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2023-43550 (published 2024-03-04)
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, flight_rb5_5g, flight_rb5_5g_firmware, mdm9628, mdm9628_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8650p, qam8650p_firmware, qam8775p
CVE-2023-43551 (published 2024-06-03)
Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-287
Affected vendors: qualcomm
Affected products: 205_mobile, 205_mobile_firmware, 215_mobile, 215_mobile_firmware, 315_5g_iot_modem, 315_5g_iot_modem_firmware, 9205_lte_modem, 9205_lte_modem_firmware, 9206_lte_modem, 9206_lte_modem_firmware, 9207_lte_modem, 9207_lte_modem_firmware, apq8017, apq8017_firmware, apq8037, apq8037_firmware, aqt1000, aqt1000_firmware, ar6003, ar6003_firmware, ar8035, ar8035_firmware, c-v2x_9150, c-v2x_9150_firmware, csra6620
CVE-2023-43552 (published 2024-03-04)
Memory corruption while processing MBSSID beacon containing several subelement IE.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, csr8811, csr8811_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, flight_rb5_5g, flight_rb5_5g_firmware, immersive_home_214, immersive_home_214_firmware, immersive_home_216, immersive_home_216_firmware, immersive_home_316, immersive_home_316_firmware, immersive_home_318, immersive_home_318_firmware, immersive_home_3210, immersive_home_3210_firmware, immersive_home_326, immersive_home_326_firmware, ipq5010, ipq5010_firmware, ipq5028
CVE-2023-43553 (published 2024-03-04)
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-823
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, csr8811, csr8811_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, immersive_home_214, immersive_home_214_firmware, immersive_home_216, immersive_home_216_firmware, immersive_home_316, immersive_home_316_firmware, immersive_home_318, immersive_home_318_firmware, immersive_home_3210, immersive_home_3210_firmware, immersive_home_326, immersive_home_326_firmware, ipq5010, ipq5010_firmware, ipq5028, ipq5028_firmware, ipq5302
CVE-2023-43554 (published 2024-07-01)
Memory corruption while processing IOCTL handler in FastRPC.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6800, fastconnect_6800_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6430, qca6430_firmware, qcm5430, qcm5430_firmware, qcm6490, qcm6490_firmware, qcs5430, qcs5430_firmware, qcs6490
CVE-2023-43555 (published 2024-06-03)
Information disclosure in Video while parsing mp2 clip with invalid section length.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-126
Affected vendors: qualcomm
Affected products: 215_mobile, 215_mobile_firmware, aqt1000, aqt1000_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6800, fastconnect_6800_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, msm8996au, msm8996au_firmware, qam8295p, qam8295p_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430
CVE-2023-43556 (published 2024-06-03)
Memory corruption in Hypervisor when platform information mentioned is not aligned.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, flight_rb5_5g, flight_rb5_5g_firmware, qam8295p, qam8295p_firmware, qca6391, qca6391_firmware, qca6574au, qca6574au_firmware, qca6595, qca6595_firmware, qca6696, qca6696_firmware, qca6698aq, qca6698aq_firmware, qca8081, qca8081_firmware, qca8337
CVE-2023-4356 (published 2023-08-15)
Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2023-43566 (published 2023-09-19)
In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jetbrains
Affected products: teamcity
CVE-2023-43567 (published 2023-11-08)
A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43568 (published 2023-11-08)
A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-126
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43569 (published 2023-11-08)
A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-4357 (published 2023-08-15)
Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2023-43570 (published 2023-11-08)

A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute arbitrary code. 


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43571 (published 2023-11-08)
A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43572 (published 2023-11-08)
A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-126
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43573 (published 2023-11-08)
A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43574 (published 2023-11-08)
A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges

to disclose sensitive information.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-126
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43575 (published 2023-11-08)
A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43576 (published 2023-11-08)
A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43577 (published 2023-11-08)
A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43578 (published 2023-11-08)
A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43579 (published 2023-11-08)
A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-4358 (published 2023-08-15)
Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2023-43580 (published 2023-11-08)
A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43581 (published 2023-11-08)
A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_5_14irb8, ideacentre_5_14irb8_firmware, ideacentre_aio_3-22iil5, ideacentre_aio_3-22iil5_firmware, ideacentre_aio_3-22imb05, ideacentre_aio_3-22imb05_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24alc6, ideacentre_aio_3-24alc6_firmware, ideacentre_aio_3-24iil5, ideacentre_aio_3-24iil5_firmware, ideacentre_aio_3-24imb05
CVE-2023-43582 (published 2023-11-15)
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-939
Affected vendors: zoom
Affected products: meetings, rooms, virtual_desktop_infrastructure, zoom
CVE-2023-43583 (published 2023-12-13)
Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-798
Affected vendors: zoom
Affected products: meeting_software_development_kit, video_software_development_kit, zoom
CVE-2023-43585 (published 2023-12-13)
Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-449
Affected vendors: zoom
Affected products: meeting_software_development_kit, video_software_development_kit, zoom
CVE-2023-43586 (published 2023-12-13)
Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-426
Affected vendors: zoom
Affected products: meeting_software_development_kit, video_software_development_kit, virtual_desktop_infrastructure, zoom
CVE-2023-43588 (published 2023-11-15)
Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-449
Affected vendors: zoom
Affected products: meetings, virtual_desktop_infrastructure, zoom
CVE-2023-4359 (published 2023-08-15)
Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: apple, debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora, iphone_os
CVE-2023-43590 (published 2023-11-15)
Link following  in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-59
Affected vendors: zoom
Affected products: rooms
CVE-2023-43591 (published 2023-11-15)
Improper privilege management  in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-280
Affected vendors: zoom
Affected products: rooms
CVE-2023-4360 (published 2023-08-15)
Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, google
Affected products: chrome, debian_linux, fedora
CVE-2023-43608 (published 2023-12-05)
A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-494
Affected vendors: buildroot
Affected products: buildroot
CVE-2023-43609 (published 2024-02-09)
In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could obtain access to sensitive information or cause a denial-of-service condition.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-863
Affected vendors: emerson
Affected products: gc1500xa, gc1500xa_firmware, gc370xa, gc370xa_firmware, gc700xa, gc700xa_firmware
CVE-2023-4361 (published 2023-08-15)
Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, google
Affected products: android, chrome, debian_linux, fedora
CVE-2023-43610 (published 2023-09-27)
SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority) or higher privilege to perform unintended database operations.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: welcart
Affected products: welcart_e-commerce
CVE-2023-43611 (published 2023-10-10)

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.  This vulnerability is due to an incomplete fix for CVE-2023-38418.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-347
Affected vendors: apple, f5
Affected products: big-ip_access_policy_manager, big-ip_advanced_firewall_manager, big-ip_advanced_web_application_firewall, big-ip_analytics, big-ip_application_acceleration_manager, big-ip_application_security_manager, big-ip_application_visibility_and_reporting, big-ip_carrier-grade_nat, big-ip_ddos_hybrid_defender, big-ip_domain_name_system, big-ip_edge_gateway, big-ip_fraud_protection_service, big-ip_global_traffic_manager, big-ip_link_controller, big-ip_local_traffic_manager, big-ip_policy_enforcement_manager, big-ip_ssl_orchestrator, big-ip_webaccelerator, big-ip_websafe, macos
CVE-2023-43612 (published 2023-11-20)
in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-281
Affected vendors: openatom
Affected products: openharmony
CVE-2023-43614 (published 2023-09-27)
Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: welcart
Affected products: welcart_e-commerce
CVE-2023-43615 (published 2023-10-07)
Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-120
Affected vendors: arm, fedoraproject, trustedfirmware
Affected products: fedora, mbed_tls
CVE-2023-43616 (published 2023-09-20)
An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-22
Affected vendors: schollz
Affected products: croc
CVE-2023-43617 (published 2023-09-20)
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: schollz
Affected products: croc
CVE-2023-43618 (published 2023-09-20)
An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-311
Affected vendors: schollz
Affected products: croc
CVE-2023-43619 (published 2023-09-20)
An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: schollz
Affected products: croc
CVE-2023-4362 (published 2023-08-15)
Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2023-43620 (published 2023-09-20)
An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-116
Affected vendors: schollz
Affected products: croc
CVE-2023-43621 (published 2023-09-20)
An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: schollz
Affected products: croc
CVE-2023-43622 (published 2023-10-23)
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.
This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.

Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: apache
Affected products: http_server
CVE-2023-43623 (published 2023-10-10)
A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions < V5.4.0), Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.3), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.3), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.4.0). Applications using the affected module are vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-203
Affected vendors: mendix
Affected products: forgot_password
CVE-2023-43624 (published 2023-10-23)
CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4)  contains an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Designer is installed may be disclosed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-611
Affected vendors: omrom
Affected products: cx-designer
CVE-2023-43625 (published 2023-10-10)
A vulnerability has been identified in Simcenter Amesim (All versions < V2021.1). The affected application contains a SOAP endpoint that could allow an unauthenticated remote attacker to perform DLL injection and execute arbitrary code in the context of the affected application process.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: siemens
Affected products: simcenter_amesim
CVE-2023-43626 (published 2024-09-16)
Improper access control in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-284
CVE-2023-43627 (published 2023-10-03)
Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-22
Affected vendors: furunosystems
Affected products: acera_1310, acera_1310_firmware, acera_1320, acera_1320_firmware
CVE-2023-43628 (published 2023-12-05)
An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev. A specially crafted network packet can lead to memory corruption. An attacker can send a malicious packet to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-191
Affected vendors: gpsd_project
Affected products: gpsd
CVE-2023-43629 (published 2024-05-16)
Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: graphics_performance_analyzers
CVE-2023-4363 (published 2023-08-15)
Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, google
Affected products: android, chrome, debian_linux, fedora
CVE-2023-43630 (published 2023-09-20)
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but
due to the change that was implemented in commit
“7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the
problem of the config partition not being measured correctly.

Also, the “vault” key is sealed/unsealed with SHA1 PCRs instead of
SHA256. 
This issue was somewhat mitigated due to all of the PCR extend functions
updating both the values of SHA256 and SHA1 for a given PCR ID.

However, due to the change that was implemented in commit
“7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, this is no longer the case for PCR14, as
the code in “measurefs.go” explicitly updates only the SHA256 instance of PCR14, which
means that even if PCR14 were to be added to the list of PCRs sealing/unsealing the “vault”
key, changes to the config partition would still not be measured.



An attacker could modify the config partition without triggering the measured boot, this could
result in the attacker gaining full control over the device with full access to the contents of the
encrypted “vault” 





Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-328
Affected vendors: linuxfoundation
Affected products: edge_virtualization_engine
CVE-2023-43631 (published 2023-09-21)

On boot, the Pillar eve container checks for the existence and content of
“/config/authorized_keys”.

If the file is present, and contains a supported public key, the container will go on to open
port 22 and enable sshd with the given keys as the authorized keys for root login.

An attacker could easily add their own keys and gain full control over the system without
triggering the “measured boot” mechanism implemented by EVE OS, and without marking
the device as “UUD” (“Unknown Update Detected”).

This is because the “/config” partition is not protected by “measured boot”, it is mutable, and
it is not encrypted in any way.




An attacker can gain full control over the device without changing the PCR values, thus not
triggering the “measured boot” mechanism, and having full access to the vault.



Note:

This issue was partially fixed in these commits (after disclosure to Zededa), where the config
partition measurement was added to PCR13:

• aa3501d6c57206ced222c33aea15a9169d629141

• 5fef4d92e75838cc78010edaed5247dfbdae1889.

This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: linuxfoundation
Affected products: edge_virtualization_engine
CVE-2023-43632 (published 2023-09-21)

As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port
8877 in EVE, exposing limited functionality of the TPM to the clients. 
VTPM allows clients to
execute tpm2-tools binaries from a list of hardcoded options”
The communication with this server is done using protobuf, and the data is comprised of 2
parts:

1. Header

2. Data

When a connection is made, the server is waiting for 4 bytes of data, which will be the header,
and these 4 bytes would be parsed as uint32 size of the actual data to come.

Then, in the function “handleRequest” this size is then used in order to allocate a payload on
the stack for the incoming data.

As this payload is allocated on the stack, this will allow overflowing the stack size allocated for
the relevant process with freely controlled data.

* An attacker can crash the system. 
* An attacker can gain control over the system, specifically on the “vtpm_server” process
which has very high privileges.



Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-789
Affected vendors: linuxfoundation
Affected products: edge_virtualization_engine
CVE-2023-43633 (published 2023-09-21)

On boot, the Pillar eve container checks for the existence and content of
“/config/GlobalConfig/global.json”.

If the file exists, it overrides the existing configuration on the device on boot.

This allows an attacker to change the system’s configuration, which also includes some
debug functions.

This could be used to unlock the ssh with custom “authorized_keys” via the
“debug.enable.ssh” key, similar to the “authorized_keys” finding that was noted before.

Other usages include unlocking the usb to enable the keyboard via the “debug.enable.usb”
key, allowing VNC access via the “app.allow.vnc” key, and more.

An attacker could easily enable these debug functionalities without triggering the “measured
boot” mechanism implemented by EVE OS, and without marking the device as “UUD”
(“Unknown Update Detected”).
This is because the “/config” partition is not protected by “measured boot”, it is mutable and it
is not encrypted in any way.





An attacker can gain full control over the device without changing the PCR values, thereby not
triggering the “measured boot” mechanism, and having full access to the vault.




Note:

This issue was partially fixed in these commits (after disclosure to Zededa), where the config
partition measurement was added to PCR13:

• aa3501d6c57206ced222c33aea15a9169d629141

• 5fef4d92e75838cc78010edaed5247dfbdae1889.

This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: lfedge
Affected products: eve
CVE-2023-43634 (published 2023-09-21)

When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs
are used.

In a previous project, CYMOTIVE found that the configuration is not protected by the secure
boot, and in response Zededa implemented measurements on the config partition that was
mapped to PCR 13.

In that process, PCR 13 was added to the list of PCRs that seal/unseal the key.

In commit “56e589749c6ff58ded862d39535d43253b249acf”, the config partition
measurement moved from PCR 13 to PCR 14, but PCR 14 was not added to the list of
PCRs that seal/unseal the key.

This change makes the measurement of PCR 14 effectively redundant as it would not affect
the sealing/unsealing of the key.



An attacker could modify the config partition without triggering the measured boot, this could
result in the attacker gaining full control over the device with full access to the contents of the
encrypted “vault”





Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: lfedge
Affected products: eve