alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2023-20756 (published 2023-07-04)
In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07510064; Issue ID: ALPS07549928.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6735, mt6737, mt6739, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853
CVE-2023-20757 (published 2023-07-04)
In cmdq, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07636133; Issue ID: ALPS07636133.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6739, mt6768, mt6771, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6883, mt6885, mt6889, mt6893, mt8786, mt8789, mt8797
CVE-2023-20758 (published 2023-07-04)
In cmdq, there is a possible memory corruption due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07636133; Issue ID: ALPS07636130.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6739, mt6768, mt6771, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6883, mt6885, mt6889, mt6893, mt8786, mt8789, mt8797
CVE-2023-20759 (published 2023-07-04)
In cmdq, there is a possible memory corruption due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07636133; Issue ID: ALPS07634601.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6739, mt6768, mt6771, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6883, mt6885, mt6889, mt6893, mt8786, mt8789, mt8797
CVE-2023-2076 (published 2023-04-14)
A vulnerability classified as problematic was found in Campcodes Online Traffic Offense Management System 1.0. This vulnerability affects unknown code of the file /classes/Users.phpp. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226054 is the identifier assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: campcodes
Affected products: online_traffic_offense_management_system
CVE-2023-20760 (published 2023-07-04)
In apu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629578; Issue ID: ALPS07629578.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6879, mt6895, mt6983, mt8195
CVE-2023-20761 (published 2023-07-04)
In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628604; Issue ID: ALPS07628582.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6739, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6886
CVE-2023-20766 (published 2023-07-04)
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07573237; Issue ID: ALPS07573202.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6739, mt6753, mt6757, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879
CVE-2023-20767 (published 2023-07-04)
In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629585; Issue ID: ALPS07629584.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6879, mt6886, mt6895, mt6983, mt6985, mt8167, mt8168, mt8195, mt8673
CVE-2023-20768 (published 2023-07-04)
In ion, there is a possible out of bounds read due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07560720; Issue ID: ALPS07559800.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-843
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6737, mt6739, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6875
CVE-2023-2077 (published 2023-04-14)
A vulnerability, which was classified as problematic, has been found in Campcodes Online Traffic Offense Management System 1.0. This issue affects some unknown processing of the file /admin/offenses/view_details.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226055.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: campcodes
Affected products: online_traffic_offense_management_system
CVE-2023-20771 (published 2023-07-04)
In display, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07671046; Issue ID: ALPS07671046.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6765, mt6768, mt6771, mt6779, mt6785, mt8168, mt8781
CVE-2023-20772 (published 2023-07-04)
In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441796; Issue ID: ALPS07441796.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6737, mt6739, mt6753, mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6886
CVE-2023-20773 (published 2023-07-04)
In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07611449; Issue ID: ALPS07441735.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6737, mt6739, mt6753, mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6886
CVE-2023-20774 (published 2023-07-04)
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07292228; Issue ID: ALPS07292228.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: google, mediatek
Affected products: android, mt6789, mt6835, mt6855, mt6886, mt6895, mt6983, mt6985, mt8195, mt8673, mt8781
CVE-2023-20775 (published 2023-07-04)
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07978760; Issue ID: ALPS07363410.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek, openwrt
Affected products: android, mt6739, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6763, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6877, mt6879, mt6885, mt6886
CVE-2023-2078 (published 2023-07-11)
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to update the plugins settings. CVE-2023-25030 may be a duplicate of this issue.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-862
Affected vendors: buymeacoffee
Affected products: buy_me_a_coffee
CVE-2023-20780 (published 2023-08-07)
In keyinstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017756; Issue ID: ALPS08017756.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6735, mt6737, mt6739, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853
CVE-2023-20781 (published 2023-08-07)
In keyinstall, there is a possible memory corruption due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017756; Issue ID: ALPS07905323.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6735, mt6737, mt6739, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853
CVE-2023-20782 (published 2023-08-07)
In keyinstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07550104; Issue ID: ALPS07550103.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6735, mt6737, mt6739, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853
CVE-2023-20783 (published 2023-08-07)
In keyinstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07826905; Issue ID: ALPS07826905.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6735, mt6737, mt6739, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853
CVE-2023-20784 (published 2023-08-07)
In keyinstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07826989; Issue ID: ALPS07826989.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6735, mt6737, mt6739, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853
CVE-2023-20785 (published 2023-08-07)
In audio, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628524; Issue ID: ALPS07628524.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: google, mediatek
Affected products: android, mt6779, mt6781, mt6785, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893, mt6895, mt8168, mt8781, mt8791, mt8797
CVE-2023-20786 (published 2023-08-07)
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07767811; Issue ID: ALPS07767811.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt2713, mt6580, mt6739, mt6761, mt6765, mt6768, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6893, mt6895, mt6983
CVE-2023-20787 (published 2023-08-07)
In thermal, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07648734; Issue ID: ALPS07648734.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: google, mediatek
Affected products: android, mt6739, mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6873, mt6877, mt6883, mt8167, mt8167s, mt8168, mt8321, mt8362a, mt8365
CVE-2023-20788 (published 2023-08-07)
In thermal, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07648734; Issue ID: ALPS07648735.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: google, mediatek
Affected products: android, mt6739, mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6873, mt6877, mt6883, mt8167, mt8167s, mt8168, mt8321, mt8362a, mt8365
CVE-2023-20789 (published 2023-08-07)
In jpeg, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07693193; Issue ID: ALPS07693193.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: google, mediatek
Affected products: android, mt6789, mt6835, mt6855, mt6879, mt6886, mt6895, mt6983, mt6985, mt8188, mt8195, mt8195z
CVE-2023-2079 (published 2023-07-11)
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for unauthenticated attackers to update the plugins settings, via a forged request granted the attacker can trick a site's administrator into performing an action such as clicking on a link.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-352
Affected vendors: buymeacoffee
Affected products: buy_me_a_coffee
CVE-2023-20790 (published 2023-08-07)
In nvram, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07740194; Issue ID: ALPS07740194.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek, openwrt, rdkcentral
Affected products: android, mt2713, mt2735, mt2737, mt6739, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879
CVE-2023-20793 (published 2023-08-07)
In apu, there is a possible memory corruption due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07767818; Issue ID: ALPS07767818.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8183, mt8188, mt8195
CVE-2023-20795 (published 2023-08-07)
In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07864900; Issue ID: ALPS07864900.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6739, mt6761, mt6762, mt6768, mt6769, mt6779, mt6781, mt6785, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6885, mt6886, mt6889, mt6891, mt6893, mt6895, mt6983
CVE-2023-20796 (published 2023-08-07)
In power, there is a possible memory corruption due to an incorrect bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07929790; Issue ID: ALPS07929790.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek, openwrt, rdkcentral
Affected products: android, mt2735, mt2737, mt6789, mt6833, mt6835, mt6853, mt6855, mt6873, mt6877, mt6879, mt6880, mt6886, mt6890, mt6893, mt6895, mt6980, mt6983, mt6985, mt6990, mt8168, mt8321, mt8768, mt8781, mt8786
CVE-2023-20797 (published 2023-08-07)
In camera middleware, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629582; Issue ID: ALPS07629582.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6879, mt6886, mt6895, mt6983, mt6985, mt8188, mt8195, mt8673
CVE-2023-20798 (published 2023-08-07)
In pda, there is a possible out of bounds read due to an incorrect calculation of buffer size. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07147572; Issue ID: ALPS07421076.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google, mediatek
Affected products: android, mt2713, mt6855, mt6879, mt6886, mt6895, mt6983, mt6985, mt8188, mt8195, mt8395, mt8673
CVE-2023-2080 (published 2023-06-15)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud allows Blind SQL Injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: forcepoint
Affected products: email_security, web_security
CVE-2023-20800 (published 2023-08-07)
In imgsys, there is a possible system crash due to a mssing ptr check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07420968; Issue ID: ALPS07420955.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-863
Affected vendors: google, linuxfoundation, mediatek
Affected products: android, mt6879, mt6895, mt6983, mt8188, mt8195, mt8395, mt8781, yocto
CVE-2023-20801 (published 2023-08-07)
In imgsys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07420968; Issue ID: ALPS07420968.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, linuxfoundation, mediatek
Affected products: android, mt6879, mt6895, mt6983, mt8188, mt8195, mt8395, mt8781, yocto
CVE-2023-20802 (published 2023-08-07)
In imgsys, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07420968; Issue ID: ALPS07420976.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek
Affected products: android, mt6879, mt6895, mt6983, mt8188, mt8195, mt8395, mt8781, yocto
CVE-2023-20803 (published 2023-08-07)
In imgsys, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326374.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek
Affected products: android, mt2713, mt6879, mt6895, mt6983, mt8188, mt8195, mt8395, mt8673, yocto
CVE-2023-20804 (published 2023-08-07)
In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07199773; Issue ID: ALPS07326384.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek
Affected products: android, mt2713, mt6879, mt6895, mt6983, mt8188, mt8195, mt8395, mt8673, yocto
CVE-2023-20805 (published 2023-08-07)
In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07199773; Issue ID: ALPS07326411.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek
Affected products: android, mt2713, mt6879, mt6895, mt6983, mt8188, mt8195, mt8395, mt8673, yocto
CVE-2023-20806 (published 2023-08-07)
In hcp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07537437.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt2713, mt6879, mt6895, mt6983, mt8188, mt8195, mt8395, mt8673
CVE-2023-20807 (published 2023-08-07)
In dpe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07608433; Issue ID: ALPS07608433.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt2713, mt6895, mt6983, mt8188, mt8195, mt8395, mt8673
CVE-2023-20808 (published 2023-08-07)
In OPTEE, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03645895; Issue ID: DTV03645895.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt9011, mt9022, mt9618, mt9649, mt9653
CVE-2023-20809 (published 2023-08-07)
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03751198; Issue ID: DTV03751198.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt5583, mt5691, mt5695, mt9010, mt9011, mt9012, mt9016, mt9020, mt9021, mt9022, mt9030, mt9031, mt9032, mt9215, mt9216, mt9218, mt9220, mt9221, mt9222, mt9255, mt9256, mt9266, mt9269, mt9285
CVE-2023-20810 (published 2023-08-07)
In IOMMU, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03692061; Issue ID: DTV03692061.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: google, linux, mediatek
Affected products: android, linux_kernel, mt5221, mt5583, mt5691, mt5695, mt9010, mt9011, mt9012, mt9016, mt9020, mt9021, mt9022, mt9030, mt9031, mt9032, mt9216, mt9218, mt9220, mt9221, mt9222, mt9255, mt9256, mt9266, mt9269
CVE-2023-20811 (published 2023-08-07)
In IOMMU, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03692061; Issue ID: DTV03692061.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linux, mediatek
Affected products: android, linux_kernel, mt5221, mt5583, mt5691, mt5695, mt9010, mt9011, mt9012, mt9016, mt9020, mt9021, mt9022, mt9030, mt9031, mt9032, mt9216, mt9218, mt9220, mt9221, mt9222, mt9255, mt9256, mt9266, mt9269
CVE-2023-20812 (published 2023-08-07)
In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07944987; Issue ID: ALPS07944987.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, iot_yocto, mt6761, mt6762, mt6765, mt6768, mt6769, mt6781, mt6783, mt6785, mt6789, mt6833, mt6853, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893, mt6895, mt6896
CVE-2023-20813 (published 2023-08-07)
In wlan service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07453549; Issue ID: ALPS07453549.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6765, mt6768, mt6779, mt6781, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6891, mt6893, mt6895, mt6983, mt6985
CVE-2023-20814 (published 2023-08-07)
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07453560; Issue ID: ALPS07453560.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6765, mt6768, mt6779, mt6781, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6891, mt6893, mt6895, mt6983, mt6985
CVE-2023-20815 (published 2023-08-07)
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07453587; Issue ID: ALPS07453587.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6765, mt6768, mt6779, mt6781, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6891, mt6893, mt6895, mt6983, mt6985
CVE-2023-20816 (published 2023-08-07)
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07453589; Issue ID: ALPS07453589.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6765, mt6768, mt6779, mt6781, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6891, mt6893, mt6895, mt6983, mt6985
CVE-2023-20817 (published 2023-08-07)
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07453600; Issue ID: ALPS07453600.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6765, mt6768, mt6779, mt6781, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6891, mt6893, mt6895, mt6983, mt6985
CVE-2023-20818 (published 2023-08-07)
In wlan service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07460540; Issue ID: ALPS07460540.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6765, mt6768, mt6779, mt6781, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6891, mt6893, mt6895, mt6983, mt6985
CVE-2023-20819 (published 2023-10-02)
In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: MOLY01068234; Issue ID: ALPS08010003.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mediatek
Affected products: lr11, lr12a, lr13, mt2731, mt6570, mt6580, mt6595, mt6732, mt6735, mt6737, mt6737m, mt6738, mt6739, mt6750, mt6750s, mt6752, mt6753, mt6755, mt6757, mt6758, mt6761, mt6762, mt6762d, mt6762m, mt6763
CVE-2023-2082 (published 2023-07-14)
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmc_post_reception action. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to inject arbitrary web scripts into pages that execute whenever a victim accesses a page with the injected scripts.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: buymeacoffee
Affected products: buy_me_a_coffee
CVE-2023-20820 (published 2023-09-04)
In wlan service, there is a possible command injection due to improper input validation. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00244189; Issue ID: WCNCR00244189.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: mediatek, openwrt
Affected products: mt6890, mt7603, mt7612, mt7613, mt7615, mt7622, mt7626, mt7629, mt7915, mt7916, mt7981, mt7986, mt7990, openwrt
CVE-2023-20821 (published 2023-09-04)
In nvram, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07937113; Issue ID: ALPS07937113.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek, openwrt, rdkcentral
Affected products: android, mt2713, mt2735, mt6833, mt6835, mt6853, mt6855, mt6873, mt6875, mt6877, mt6879, mt6880, mt6883, mt6885, mt6886, mt6889, mt6890, mt6891, mt6893, mt6895, mt6980, mt6983, mt6985, mt6990, mt8167
CVE-2023-20822 (published 2023-09-04)
In netdagent, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07944012; Issue ID: ALPS07944012.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6883, mt6885, mt6889, mt6891, mt6893, mt6895, mt8167, mt8167s, mt8168, mt8175, mt8195, mt8195z, mt8362a
CVE-2023-20823 (published 2023-09-04)
In cmdq, there is a possible out of bounds read due to an incorrect status check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08021592; Issue ID: ALPS08021592.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, mediatek
Affected products: android, mt6768, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6883, mt6885, mt6889, mt6893, mt8765, mt8766, mt8768, mt8781, mt8786, mt8788, mt8789, mt8797
CVE-2023-20824 (published 2023-09-04)
In duraspeed, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: ALPS07951402; Issue ID: ALPS07951402.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt2713, mt6580, mt6735, mt6739, mt6761, mt6762, mt6765, mt6768, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889
CVE-2023-20825 (published 2023-09-04)
In duraspeed, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: ALPS07951402; Issue ID: ALPS07951413.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt2713, mt6580, mt6735, mt6739, mt6761, mt6762, mt6765, mt6768, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889
CVE-2023-20826 (published 2023-09-04)
In cta, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: ALPS07978550; Issue ID: ALPS07978550.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6761, mt6765, mt6779, mt6785, mt6789, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6886, mt6895, mt6983, mt6985, mt8168, mt8175, mt8188, mt8195
CVE-2023-20827 (published 2023-09-04)
In ims service, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07937105; Issue ID: ALPS07937105.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, mediatek
Affected products: android, mt6761, mt6762, mt6763, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6891
CVE-2023-20828 (published 2023-09-04)
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ALPS08014144.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek, openwrt, rdkcentral
Affected products: android, mt2735, mt6761, mt6762, mt6765, mt6768, mt6769, mt6779, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6880, mt6883, mt6885, mt6886, mt6889, mt6890, mt6891, mt6893
CVE-2023-20829 (published 2023-09-04)
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ALPS08014148.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek, openwrt, rdkcentral
Affected products: android, mt2735, mt6761, mt6762, mt6765, mt6768, mt6769, mt6779, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6880, mt6883, mt6885, mt6886, mt6889, mt6890, mt6891, mt6893
CVE-2023-2083 (published 2023-06-09)
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to save plugin settings. While a nonce check is present, it is only executed when a nonce is provided. Not providing a nonce results in the nonce verification to be skipped. There is no capability check.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-862
Affected vendors: wpdeveloper
Affected products: essential_blocks
CVE-2023-20830 (published 2023-09-04)
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ALPS08014156.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek, openwrt, rdkcentral
Affected products: android, mt2713, mt2735, mt6761, mt6762, mt6765, mt6768, mt6769, mt6779, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6880, mt6883, mt6885, mt6886, mt6889, mt6890, mt6891
CVE-2023-20831 (published 2023-09-04)
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ALPS08014162.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek, openwrt, rdkcentral
Affected products: android, mt2735, mt6761, mt6762, mt6765, mt6768, mt6769, mt6779, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6880, mt6883, mt6885, mt6886, mt6889, mt6890, mt6891, mt6893
CVE-2023-20832 (published 2023-09-04)
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ALPS08013530.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linuxfoundation, mediatek, openwrt, rdkcentral
Affected products: android, mt2735, mt6761, mt6762, mt6765, mt6768, mt6769, mt6779, mt6833, mt6835, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6880, mt6883, mt6885, mt6886, mt6889, mt6890, mt6891, mt6893
CVE-2023-20833 (published 2023-09-04)
In keyinstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017756; Issue ID: ALPS08017764.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6735, mt6737, mt6739, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853
CVE-2023-20834 (published 2023-09-04)
In pda, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07608514; Issue ID: ALPS07608514.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, mediatek
Affected products: android, mt6879, mt6886, mt6895, mt6983, mt6985, mt8175, mt8188, mt8195, mt8365, mt8781
CVE-2023-20835 (published 2023-09-04)
In camsys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07341261; Issue ID: ALPS07326570.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, linuxfoundation, mediatek
Affected products: android, iot_yocto, mt6895, mt6983, mt8188, mt8195, mt8395, mt8781, yocto
CVE-2023-20836 (published 2023-09-04)
In camsys, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07505629; Issue ID: ALPS07505629.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google, mediatek
Affected products: android, mt6762, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6877, mt6885, mt6893, mt8768, mt8788
CVE-2023-20837 (published 2023-09-04)
In seninf, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07992786; Issue ID: ALPS07992786.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6855, mt6873, mt6877, mt6885, mt6893, mt8185, mt8385, mt8781, mt8788, mt8789, mt8797
CVE-2023-20838 (published 2023-09-04)
In imgsys, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326418.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google, linux, linuxfoundation, mediatek
Affected products: android, linux_kernel, mt2713, mt5221, mt6833, mt6853, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6890, mt6893, mt6895, mt6983, mt8167, mt8168, mt8173, mt8175, mt8185, mt8188, mt8188t, mt8195, mt8321
CVE-2023-20839 (published 2023-09-04)
In imgsys, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326409.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google, linux, linuxfoundation, mediatek
Affected products: android, iot_yocto, linux_kernel, mt2713, mt6895, mt6897, mt6983, mt8188, mt8195, mt8395, mt8673, yocto
CVE-2023-2084 (published 2023-06-09)
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the get function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to obtain plugin settings. While a nonce check is present, it is only executed when a nonce is provided. Not providing a nonce results in the nonce verification to be skipped. There is no capability check.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-862
Affected vendors: wpdeveloper
Affected products: essential_blocks