deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-36805
Published: 2023-09-12
Description: Windows MSHTML Platform Security Feature Bypass Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36805; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36805
CVE: CVE-2023-36886
Published: 2023-09-12
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36886; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36886
CVE: CVE-2023-38139
Published: 2023-09-12
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38139; http://packetstormsecurity.com/files/174849/Microsoft-Windows-Kernel-Refcount-Overflow-Use-After-Free.html; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38139
CVE: CVE-2023-38140
Published: 2023-09-12
Description: Windows Kernel Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38140; http://packetstormsecurity.com/files/175108/Microsoft-Windows-Kernel-Paged-Pool-Memory-Disclosure.html; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38140
CVE: CVE-2023-38141
Published: 2023-09-12
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38141; http://packetstormsecurity.com/files/175096/Microsoft-Windows-Kernel-Race-Condition-Memory-Corruption.html; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38141
CVE: CVE-2023-38142
Published: 2023-09-12
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38142; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38142
CVE: CVE-2023-38143
Published: 2023-09-12
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38143; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38143
CVE: CVE-2023-38144
Published: 2023-09-12
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38144; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38144
CVE: CVE-2023-38146
Published: 2023-09-12
Description: Windows Themes Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38146; http://packetstormsecurity.com/files/176391/Themebleed-Windows-11-Themes-Arbitrary-Code-Execution.html; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38146
CVE: CVE-2023-38147
Published: 2023-09-12
Description: Windows Miracast Wireless Display Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38147; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38147
CVE: CVE-2023-38148
Published: 2023-09-12
Description: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38148; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38148
CVE: CVE-2023-38149
Published: 2023-09-12
Description: Windows TCP/IP Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38149; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38149
CVE: CVE-2023-38150
Published: 2023-09-12
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38150; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38150
CVE: CVE-2023-38152
Published: 2023-09-12
Description: DHCP Server Service Information Disclosure Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-126, CWE-668
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38152; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38152
CVE: CVE-2023-38155
Published: 2023-09-12
Description: Azure DevOps Server Remote Code Execution Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38155; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38155
CVE: CVE-2023-38156
Published: 2023-09-12
Description: Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38156; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38156
CVE: CVE-2023-38160
Published: 2023-09-12
Description: Windows TCP/IP Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38160; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38160
CVE: CVE-2023-38161
Published: 2023-09-12
Description: Windows GDI Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38161; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38161
CVE: CVE-2023-38162
Published: 2023-09-12
Description: DHCP Server Service Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-191, CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38162; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38162
CVE: CVE-2023-38163
Published: 2023-09-12
Description: Windows Defender Attack Surface Reduction Security Feature Bypass
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38163; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38163
CVE: CVE-2023-38164
Published: 2023-09-12
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38164; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38164
CVE: CVE-2023-41764
Published: 2023-09-12
Description: Microsoft Office Spoofing Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-347
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41764; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41764
CVE: CVE-2023-21521
Published: 2023-09-12
Description: 
An SQL Injection vulnerability in the Management Console  (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database, recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://support.blackberry.com/kb/articleDetail?articleNumber=000112406; https://support.blackberry.com/kb/articleDetail?articleNumber=000112406
CVE: CVE-2023-21522
Published: 2023-09-12
Description: 
A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially control a script that is executed in the victim's browser then they can execute script commands in the context of the affected user account. 
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.blackberry.com/kb/articleDetail?articleNumber=000112406; https://support.blackberry.com/kb/articleDetail?articleNumber=000112406
CVE: CVE-2023-30962
Published: 2023-09-12
Description: The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58 .
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434, CWE-79
References: https://palantir.safebase.us/?tcuUid=92dd599a-07e2-43a8-956a-9c9566794be0; https://palantir.safebase.us/?tcuUid=92dd599a-07e2-43a8-956a-9c9566794be0
CVE: CVE-2023-4501
Published: 2023-09-12
Description: User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user.

Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon.

Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-253, CWE-287, CWE-305, CWE-358, CWE-287
References: https://portal.microfocus.com/s/article/KM000021287; https://portal.microfocus.com/s/article/KM000021287
CVE: CVE-2023-21520
Published: 2023-09-12
Description: 






















A PII Enumeration via Credential Recovery in the Self Service (Credential Recovery) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially associate a list of contact details with an AtHoc IWS organization.

CVSS Score: 5.3 (MEDIUM)
References: https://http://support.blackberry.com/kb/articleDetail?articleNumber=000112406; https://http://support.blackberry.com/kb/articleDetail?articleNumber=000112406
CVE: CVE-2023-21523
Published: 2023-09-12
Description: 






















A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account.








CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://http://support.blackberry.com/kb/articleDetail?articleNumber=000112406; https://http://support.blackberry.com/kb/articleDetail?articleNumber=000112406
CVE: CVE-2023-39201
Published: 2023-09-12
Description: Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-426, CWE-426
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39208
Published: 2023-09-12
Description: Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-20
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39215
Published: 2023-09-12
Description: Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 7.1 (HIGH)
CWE: CWE-449, CWE-287
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-3710
Published: 2023-09-12
Description: Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-20, CWE-77
References: https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP[PII_REDACTED]; https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP[PII_REDACTED]A; https://www.honeywell.com/us/en/product-security
CVE: CVE-2023-3711
Published: 2023-09-12
Description: Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP[PII_REDACTED]; https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP[PII_REDACTED]A; https://www.honeywell.com/us/en/product-security
CVE: CVE-2023-3712
Published: 2023-09-12
Description: Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This issue affects PM43 versions prior to P10.19.050004. 

Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP[PII_REDACTED]; https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP[PII_REDACTED]A; https://www.honeywell.com/us/en/product-security
CVE: CVE-2023-41331
Published: 2023-09-12
Description: SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully
crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework, a blacklist is used to filter out dangerous classes encountered during the deserialization process. However, the blacklist is not comprehensive, and an actor can exploit certain native JDK classes and common third-party packages to construct gadget chains capable of achieving JNDI injection or system command execution attacks. Version 5.11.0 contains a fix for this issue. As a workaround, users can add `-Drpc_serialize_blacklist_override=javax.sound.sampled.AudioFileFormat` to the blacklist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917
References: https://github.com/sofastack/sofa-rpc/releases/tag/v5.11.0; https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-chv2-7hxj-2j86; https://github.com/sofastack/sofa-rpc/releases/tag/v5.11.0
CVE: CVE-2023-4918
Published: 2023-09-12
Description: A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.
CVSS Score: 8.8 (HIGH)
CWE: CWE-256, CWE-319
References: https://access.redhat.com/security/cve/CVE-2023-4918; https://bugzilla.redhat.com/show_bug.cgi?id=2238588; https://github.com/keycloak/keycloak/security/advisories/GHSA-5q66-v53q-pm35
CVE: CVE-2023-4921
Published: 2023-09-12
Description: A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().

We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8fc134fee27f2263988ae38920bc03da416b03d8; https://kernel.dance/8fc134fee27f2263988ae38920bc03da416b03d8; https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE: CVE-2023-41885
Published: 2023-09-12
Description: Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not also enforce strong passwords, these lists of valid accounts are likely to be used in a password spray attack with the outcome being attempted takeover of user accounts on the platform. The impact of this vulnerability is minor as it requires chaining with other attack vectors in order to gain more then simply a list of valid users on the underlying platform. The likelihood of this vulnerability is possible as it requires minimal skills to pull off, especially given the underlying login functionality for Piccolo based sites is open source. This issue has been patched in version 0.121.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://github.com/piccolo-orm/piccolo/commit/edcfe[PII_REDACTED]ba3e3b65896e6e7272f972261; https://github.com/piccolo-orm/piccolo/security/advisories/GHSA-h7cm-mrvq-wcfr; https://github.com/piccolo-orm/piccolo/commit/edcfe[PII_REDACTED]ba3e3b65896e6e7272f972261
CVE: CVE-2023-4900
Published: 2023-09-12
Description: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://crbug.com/1430867; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
CVE: CVE-2023-4901
Published: 2023-09-12
Description: Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://crbug.com/1459281; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
CVE: CVE-2023-4902
Published: 2023-09-12
Description: Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://crbug.com/1454515; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
CVE: CVE-2023-4903
Published: 2023-09-12
Description: Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://crbug.com/1446709; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
CVE: CVE-2023-4904
Published: 2023-09-12
Description: Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy restrictions via a crafted download. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://crbug.com/1453501; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
CVE: CVE-2023-4905
Published: 2023-09-12
Description: Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://crbug.com/1441228; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
CVE: CVE-2023-4906
Published: 2023-09-12
Description: Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://crbug.com/1449874; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
CVE: CVE-2023-4907
Published: 2023-09-12
Description: Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://crbug.com/1462104; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
CVE: CVE-2023-4908
Published: 2023-09-12
Description: Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://crbug.com/1451543; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
CVE: CVE-2023-4909
Published: 2023-09-12
Description: Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://crbug.com/1463293; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
CVE: CVE-2022-47637
Published: 2023-09-12
Description: The installer in XAMPP through 8.1.12 allows local users to write to the C:\xampp directory. Common use cases execute files under C:\xampp with administrative privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-281
References: https://shinnai.altervista.org/exploits/DVRT-2023-0001_CVE-2022-47637.pdf; https://shinnai.altervista.org/exploits/DVRT-2023-0001_CVE-2022-47637.pdf