deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-35794
Published: 2023-10-27
Description: An issue was discovered in Cassia Access Controller 2.1.[PII_REDACTED]. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only Basic Authentication to the SSH console.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://blog.kscsc.online/cves/202335794/md.html; https://github.com/Dodge-MPTC/CVE-2023-35794-WebSSH-Hijacking; https://www.cassianetworks.com/products/iot-access-controller/
CVE: CVE-2023-40116
Published: 2023-10-27
Description: In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/18c3b194642f3949d09e48c21da5658fa04994c8; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/18c3b194642f3949d09e48c21da5658fa04994c8
CVE: CVE-2023-40117
Published: 2023-10-27
Description: In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://android.googlesource.com/platform/frameworks/base/+/ff86ff28cf82124f8e65833a2dd8c319aea08945; https://android.googlesource.com/platform/packages/apps/Settings/+/11815817de2f2d70fe842b108356a1bc75d44ffb; https://source.android.com/security/bulletin/2023-10-01
CVE: CVE-2023-40120
Published: 2023-10-27
Description: In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/d26544e5a4fd554b790b4d0c5964d9e95d9e626b; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/d26544e5a4fd554b790b4d0c5964d9e95d9e626b
CVE: CVE-2023-40121
Published: 2023-10-27
Description: In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-502
References: https://android.googlesource.com/platform/frameworks/base/+/3287ac2d2565dc96bf6177967f8e3aed33954253; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/3287ac2d2565dc96bf6177967f8e3aed33954253
CVE: CVE-2023-40123
Published: 2023-10-27
Description: In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/platform/frameworks/base/+/7212a4bec2d2f1a74fa54a12a04255d6a183baa9; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/7212a4bec2d2f1a74fa54a12a04255d6a183baa9
CVE: CVE-2023-40125
Published: 2023-10-27
Description: In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/packages/apps/Settings/+/63d464c3fa5c7b9900448fef[PII_REDACTED]e557eb; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/packages/apps/Settings/+/63d464c3fa5c7b9900448fef[PII_REDACTED]e557eb
CVE: CVE-2023-40127
Published: 2023-10-27
Description: In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 3.3 (LOW)
References: https://android.googlesource.com/platform/packages/providers/MediaProvider/+/[PII_REDACTED]12507e8289ae8eb1a56303e79ab678; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/packages/providers/MediaProvider/+/[PII_REDACTED]12507e8289ae8eb1a56303e79ab678
CVE: CVE-2023-40128
Published: 2023-10-27
Description: In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://android.googlesource.com/platform/external/libxml2/+/1ccf89b87a3969edd56956e2d447f896037c8be7; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/external/libxml2/+/1ccf89b87a3969edd56956e2d447f896037c8be7
CVE: CVE-2023-40129
Published: 2023-10-27
Description: In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c0151aa3ba76c785b32c7f9d16c98febe53017b1; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c0151aa3ba76c785b32c7f9d16c98febe53017b1
CVE: CVE-2023-40130
Published: 2023-10-27
Description: In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79; https://source.android.com/security/bulletin/2025-12-01; https://android.googlesource.com/platform/packages/services/Telecomm/+/5b335401d1c8de7d1c85f4a0cf353f7f9fc30218
CVE: CVE-2023-40131
Published: 2023-10-27
Description: In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-416
References: https://android.googlesource.com/platform/frameworks/native/+/0cda11569dd256ff3220b4fe44f861f8081d7116; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/native/+/0cda11569dd256ff3220b4fe44f861f8081d7116
CVE: CVE-2023-40133
Published: 2023-10-27
Description: In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33
CVE: CVE-2023-40134
Published: 2023-10-27
Description: In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 3.3 (LOW)
References: https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33
CVE: CVE-2023-40135
Published: 2023-10-27
Description: In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 3.3 (LOW)
References: https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33
CVE: CVE-2023-40136
Published: 2023-10-27
Description: In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 3.3 (LOW)
References: https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33
CVE: CVE-2023-40137
Published: 2023-10-27
Description: In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 3.3 (LOW)
References: https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33
CVE: CVE-2023-40138
Published: 2023-10-27
Description: In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 3.3 (LOW)
References: https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33
CVE: CVE-2023-40139
Published: 2023-10-27
Description: In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-610
References: https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33
CVE: CVE-2023-40140
Published: 2023-10-27
Description: In android_view_InputDevice_create of android_view_InputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://android.googlesource.com/platform/frameworks/base/+/2d88a5c481df8986dbba2e02c5bf82f105b36243; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/2d88a5c481df8986dbba2e02c5bf82f105b36243
CVE: CVE-2023-44480
Published: 2023-10-27
Description: Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setcasualleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.

CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fluidattacks.com/advisories/martin/; https://projectworlds.in/; https://fluidattacks.com/advisories/martin/
CVE: CVE-2023-46200
Published: 2023-10-27
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin <= 1.1.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/smart-app-banner/wordpress-smart-app-banner-plugin-1-1-3-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/smart-app-banner/wordpress-smart-app-banner-plugin-1-1-3-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-46208
Published: 2023-10-27
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/motors-car-dealership-classified-listings/wordpress-motors-car-dealer-classifieds-listing-plugin-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/motors-car-dealership-classified-listings/wordpress-motors-car-dealer-classifieds-listing-plugin-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46209
Published: 2023-10-27
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in G5Theme Grid Plus – Unlimited grid plugin <= 1.3.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/grid-plus/wordpress-grid-plus-plugin-1-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/grid-plus/wordpress-grid-plus-plugin-1-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46211
Published: 2023-10-27
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ultimate_vc_addons/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-19-14-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate_vc_addons/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-19-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46509
Published: 2023-10-27
Description: An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/ATonysan/d6f72e9eb90407d64bed4566aa80afb1#file-cve-2023-46509; https://gist.github.com/ATonysan/d6f72e9eb90407d64bed4566aa80afb1#file-cve-2023-46509
CVE: CVE-2023-46510
Published: 2023-10-27
Description: An issue in ZIONCOM (Hong Kong) Technology Limited A7000R v.4.1cu.4154 allows an attacker to execute arbitrary code via the cig-bin/cstecgi.cgi to the settings/setPasswordCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://gist.github.com/ATonysan/58ace23d539981441bca16ce0f7585e2; https://gist.github.com/ATonysan/58ace23d539981441bca16ce0f7585e2
CVE: CVE-2023-5830
Published: 2023-10-27
Description: A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of the component WebTools. The manipulation of the argument Server leads to improper authentication. It is possible to initiate the attack remotely. Upgrading to version 7.2 SP4 and 2021.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-243729 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://vuldb.com/?ctiid.243729; https://vuldb.com/?id.243729; https://vuldb.com/?ctiid.243729
CVE: CVE-2023-46490
Published: 2023-10-27
Description: SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the form_actions() function in the managers.php function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/ISHGARD-2/a[PII_REDACTED]8fcd7ccf7432ccb145b53; https://github.com/Cacti/cacti/security/advisories/GHSA-f4r3-53jr-654c; https://gist.github.com/ISHGARD-2/a[PII_REDACTED]8fcd7ccf7432ccb145b53
CVE: CVE-2023-5834
Published: 2023-10-27
Description: HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.
CVSS Score: 3.8 (LOW)
CWE: CWE-1386, CWE-59
References: https://discuss.hashicorp.com/t/hcsec-2023-31-vagrant-s-windows-installer-allowed-directory-junction-write/59568; https://discuss.hashicorp.com/t/hcsec-2023-31-vagrant-s-windows-installer-allowed-directory-junction-write/59568
CVE: CVE-2023-46587
Published: 2023-10-27
Description: Buffer Overflow vulnerability in XnView Classic v.2.51.5 allows a local attacker to execute arbitrary code via a crafted TIF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/nasroabd/vulns/tree/main/XnView/2.51.5; https://github.com/nasroabd/vulns/tree/main/XnView/2.51.5
CVE: CVE-2023-43322
Published: 2023-10-28
Description: ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v5.10.3 was discovered to contain a command injection vulnerability via the endpoint /v1/system/toolkit/files/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://psirt.zpesystems.com/portal/en/kb/articles/security-advisory-zpe-ng-2023-001-12-10-2023; https://psirt.zpesystems.com/portal/en/kb/articles/security-advisory-zpe-ng-2023-001-12-10-2023
CVE: CVE-2023-46467
Published: 2023-10-28
Description: Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.sumor.top/index.php/archives/872/; https://www.sumor.top/index.php/archives/872/
CVE: CVE-2023-46468
Published: 2023-10-28
Description: An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-74
References: https://www.sumor.top/index.php/archives/875/; https://www.sumor.top/index.php/archives/875/
CVE: CVE-2023-46569
Published: 2023-10-28
Description: An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://gist.github.com/gandalf4a/afeaf8cc958f95876f0ee245b8a002e8; https://github.com/radareorg/radare2/issues/22334; https://gist.github.com/gandalf4a/afeaf8cc958f95876f0ee245b8a002e8
CVE: CVE-2023-46570
Published: 2023-10-28
Description: An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://gist.github.com/gandalf4a/d7fa58f1b3418ef08ad244acccc10ba6; https://github.com/radareorg/radare2/issues/22333; https://gist.github.com/gandalf4a/d7fa58f1b3418ef08ad244acccc10ba6
CVE: CVE-2023-46215
Published: 2023-10-28
Description: Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.

Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend
Note: the vulnerability is about the information exposed in the logs not about accessing the logs.

This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.

Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://www.openwall.com/lists/oss-security/2023/10/28/1; https://github.com/apache/airflow/pull/34954; https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46n
CVE: CVE-2023-5425
Published: 2023-10-28
Description: The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain elevated (e.g., administrator) privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/2981559/post-meta-data-manager; https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f4e710-99a2-49df-a513-725e1daaa18a?source=cve; https://plugins.trac.wordpress.org/changeset/2981559/post-meta-data-manager
CVE: CVE-2023-5426
Published: 2023-10-28
Description: The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta,  pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to delete user, term, and post meta belonging to arbitrary users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/2981559/post-meta-data-manager; https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a7f882-4582-4b08-9597-329d140ad782?source=cve; https://plugins.trac.wordpress.org/changeset/2981559/post-meta-data-manager
CVE: CVE-2023-5835
Published: 2023-10-28
Description: A vulnerability classified as problematic was found in hu60t hu60wap6. Affected by this vulnerability is the function markdown of the file src/class/ubbparser.php. The manipulation leads to cross site scripting. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named a1cd9f12d7687243bfcb7ce295665acb83b9174e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-243775.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/hu60t/hu60wap6/commit/a1cd9f12d7687243bfcb7ce295665acb83b9174e; https://vuldb.com/?ctiid.243775; https://vuldb.com/?id.243775
CVE: CVE-2023-45897
Published: 2023-10-28
Description: exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/; https://github.com/exfatprogs/exfatprogs/commit/22d0e43e8d24119cbfc6efafabb0dec6517a86c4; https://github.com/exfatprogs/exfatprogs/commit/4abc55e976573991e6a1117bb2b3711e59da07ae