deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2788
Published: 2023-06-16
Description: Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-862, CWE-613
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-2791
Published: 2023-06-16
Description: When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-2785
Published: 2023-06-16
Description: Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in Denial of Service


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-2792
Published: 2023-06-16
Description: Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command.



CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-2793
Published: 2023-06-16
Description: Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-2797
Published: 2023-06-16
Description: Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel.



CVSS Score: 3.1 (LOW)
CWE: CWE-74, CWE-74
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-2831
Published: 2023-06-16
Description: Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a large number of escaped characters.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-33306
Published: 2023-06-16
Description: A null pointer dereference in Fortinet FortiOS before 7.2.5,  before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to denial of sslvpn service via specifically crafted request in bookmark parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://fortiguard.com/psirt/FG-IR-23-015; https://fortiguard.com/psirt/FG-IR-23-015
CVE: CVE-2023-33307
Published: 2023-06-16
Description: A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://fortiguard.com/psirt/FG-IR-23-015; https://exchange.xforce.ibmcloud.com/vulnerabilities/258201; https://fortiguard.com/psirt/FG-IR-23-015
CVE: CVE-2023-26515
Published: 2023-06-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ko Takagi Simple Slug Translate plugin <= 2.7.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-slug-translate/wordpress-simple-slug-translate-plugin-2-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-slug-translate/wordpress-simple-slug-translate-plugin-2-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27420
Published: 2023-06-16
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Arya Multipurpose theme <= 1.0.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/arya-multipurpose/wordpress-arya-multipurpose-theme-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/arya-multipurpose/wordpress-arya-multipurpose-theme-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-3293
Published: 2023-06-16
Description: Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/salesagility/suitecrm-core/commit/1f949f1ac2b7fe82f3c2c6071f842b804ba91929; https://huntr.dev/bounties/22cb0ee3-e5da-40e0-9d2c-ace9b759f171; https://github.com/salesagility/suitecrm-core/commit/1f949f1ac2b7fe82f3c2c6071f842b804ba91929
CVE: CVE-2023-25974
Published: 2023-06-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in psicosi448 wp2syslog plugin <= 1.0.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp2syslog/wordpress-wp2syslog-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp2syslog/wordpress-wp2syslog-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26527
Published: 2023-06-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPIndeed Debug Assistant plugin <= 1.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/debug-assistant/wordpress-debug-assistant-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/debug-assistant/wordpress-debug-assistant-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26537
Published: 2023-06-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nicolly WP No External Links plugin <= 1.0.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/no-external-links/wordpress-wp-no-external-links-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/no-external-links/wordpress-wp-no-external-links-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-3294
Published: 2023-06-16
Description: Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/saleor/react-storefront/commit/c29aab226f07ca980cc19787dcef101e11b83ef7; https://huntr.dev/bounties/9d308ebb-4289-411f-ac22-990383d98932; https://github.com/saleor/react-storefront/commit/c29aab226f07ca980cc19787dcef101e11b83ef7
CVE: CVE-2022-48330
Published: 2023-06-16
Description: A Huawei sound box product has an out-of-bounds write vulnerability. Attackers can exploit this vulnerability to cause buffer overflow. Affected product versions include:FLMG-10 versions FLMG-10 10.0.1.0(H100SP22C00).
CVSS Score: 8.0 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-oobwviatp-89e403d4-en; https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-oobwviatp-89e403d4-en
CVE: CVE-2022-48469
Published: 2023-06-16
Description: There is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers. 
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-thvihr-7015cbae-en; https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-thvihr-7015cbae-en
CVE: CVE-2022-48471
Published: 2023-06-16
Description: There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-436, CWE-436
References: https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-moivihp-73cabdde-en; https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-moivihp-73cabdde-en
CVE: CVE-2022-48472
Published: 2023-06-16
Description: A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution. Affected product versions include:BiSheng-WNM versions OTA-BiSheng-FW-2.0.0.211-beta,BiSheng-WNM FW 3.0.0.325,BiSheng-WNM FW 2.0.0.211.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-sciviahpp-6bcddec5-en; https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-sciviahpp-6bcddec5-en
CVE: CVE-2022-48473
Published: 2023-06-16
Description: There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-436
References: https://https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-moivihp-2f201af9-en; https://https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-moivihp-2f201af9-en
CVE: CVE-2023-20885
Published: 2023-06-16
Description: Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.cloudfoundry.org/blog/cve-2023-20885-cf-workflows-leak-credentials-in-system-audit-logs/; https://www.cloudfoundry.org/blog/cve-2023-20885-cf-workflows-leak-credentials-in-system-audit-logs/
CVE: CVE-2023-34548
Published: 2023-06-16
Description: Simple Customer Relationship Management 1.0 is vulnerable to SQL Injection via the email parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/SCRMS-2023-05-27-1.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/SCRMS-2023-05-27-1.0
CVE: CVE-2023-35782
Published: 2023-06-16
Description: The ipandlanguageredirect extension before 5.1.2 for TYPO3 allows SQL Injection.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://typo3.org/security/advisory/typo3-ext-sa-2023-005; https://typo3.org/security/advisory/typo3-ext-sa-2023-005
CVE: CVE-2023-35783
Published: 2023-06-16
Description: The ke_search (aka Faceted Search) extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://typo3.org/security/advisory/typo3-ext-sa-2023-004; https://typo3.org/security/advisory/typo3-ext-sa-2023-004
CVE: CVE-2023-25366
Published: 2023-06-16
Description: In Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25366.md; https://siglent.com; https://github.com/BretMcDanel/CVE/blob/main/CVE-2023-25366.md
CVE: CVE-2023-30453
Published: 2023-06-16
Description: The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://marketplace.atlassian.com/apps/1217030/reminder-for-jira-follow-up-issues?tab=overview&hosting=cloud; https://y-security.de/news-en/reminder-for-jira-cross-site-scripting-cve-2023-30453/index.html; https://marketplace.atlassian.com/apps/1217030/reminder-for-jira-follow-up-issues?tab=overview&hosting=cloud
CVE: CVE-2023-34795
Published: 2023-06-16
Description: xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/brechtsanders/xlsxio/commit/d653f1604b54532f11b45dca1fa164b4a1f15e2d; https://github.com/brechtsanders/xlsxio/issues/121; https://github.com/xf1les/cve-advisories/blob/main/2023/CVE-2023-34795.md
CVE: CVE-2023-24243
Published: 2023-06-16
Description: CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF).
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://arc.cdata.com/; https://arc.cdata.com/trial/; https://gist.github.com/d3vc0r3/6460a5f006e32a2ebffe739e411ab1b8
CVE: CVE-2023-2918
Published: 2023-06-16
Description: Rejected reason: Duplicate Assignment.
CVE: CVE-2023-30222
Published: 2023-06-16
Description: An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to retrieve password hashes for all users via eavesdropping.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://blog.4d.com/security-bulletin-two-cves-and-how-to-stay-secure/; https://packetstormsecurity.com; https://www.infigo.is/en/insights/42/information-disclosure-and-broken-authentication-in-4d-sas-4d-server/
CVE: CVE-2023-30223
Published: 2023-06-16
Description: A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packets containing requests to perform arbitrary actions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://blog.4d.com/security-bulletin-two-cves-and-how-to-stay-secure/; https://packetstormsecurity.com; https://www.infigo.is/en/insights/42/information-disclosure-and-broken-authentication-in-4d-sas-4d-server/
CVE: CVE-2023-30625
Published: 2023-06-16
Description: rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/173837/Rudder-Server-SQL-Injection-Remote-Code-Execution.html; https://github.com/rudderlabs/rudder-server/commit/0d061ff2d8c16845179d215bf8012afceba12a30; https://github.com/rudderlabs/rudder-server/commit/2f956b7eb3d5eb2de3e79d7df2c87405af25071e
CVE: CVE-2023-34733
Published: 2023-06-16
Description: A lack of exception handling in the Volkswagen Discover Media Infotainment System Software Version 0876 allows attackers to cause a Denial of Service (DoS) via supplying crafted media files when connecting a device to the vehicle's USB plug and play feature.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-754
References: https://github.com/zj3t/Automotive-vulnerabilities/tree/main/VW/jetta2021; https://github.com/zj3t/Automotive-vulnerabilities/tree/main/VW/jetta2021
CVE: CVE-2023-34645
Published: 2023-06-16
Description: jfinal CMS 5.1.0 has an arbitrary file read vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552, CWE-22
References: https://github.com/jflyfox/jfinal_cms/issues/57; https://github.com/jflyfox/jfinal_cms/issues/57
CVE: CVE-2023-34659
Published: 2023-06-16
Description: jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jeecgboot/jeecg-boot/issues/4976; https://github.com/jeecgboot/jeecg-boot/issues/4976
CVE: CVE-2023-34660
Published: 2023-06-16
Description: jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/jeecgboot/jeecg-boot/issues/4990; https://github.com/jeecgboot/jeecg-boot/issues/4990
CVE: CVE-2023-34832
Published: 2023-06-16
Description: TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://archer.com; http://packetstormsecurity.com/files/172989/TP-Link-Archer-AX10-EU-_V1.2_230220-Buffer-Overflow.html; http://tp-link.com
CVE: CVE-2023-25185
Published: 2023-06-16
Description: An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software releases. Certain software processes in the BTS internal software design have unnecessarily high privileges to BTS embedded operating system (OS) resources.
CVSS Score: 3.8 (LOW)
CWE: CWE-269, CWE-863
References: https://Nokia.com; https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25185/; https://Nokia.com
CVE: CVE-2023-25186
Published: 2023-06-16
Description: An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from a Nokia Single RAN BTS baseband unit, a directory path traversal in the Nokia BTS baseband unit diagnostic tool AaShell (which is by default disabled) provides access to the BTS baseband unit internal filesystem from the mobile network solution internal BTS management network.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: https://Nokia.com; https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25186/; https://Nokia.com
CVE: CVE-2023-25188
Published: 2023-06-16
Description: An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from the Nokia Single RAN BTS baseband unit, the BTS baseband unit diagnostic tool AaShell (which is by default disabled) allows unauthenticated access from the mobile network solution internal BTS management network to the BTS embedded Linux operating-system level.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-269, CWE-346
References: https://Nokia.com; https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25188/; https://Nokia.com
CVE: CVE-2023-25645
Published: 2023-06-16
Description: There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and applications on the user's device, affecting device operation.
CVSS Score: 7.7 (HIGH)
CWE: CWE-276, CWE-276
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464
CVE: CVE-2023-3268
Published: 2023-06-16
Description: An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.2; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=43ec16f1450f4936025a9bdf1a273affdb9732c1; https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
CVE: CVE-2023-25187
Published: 2023-06-16
Description: An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factory-time installed) default SSH public/private key values that are specific to a network operator. As a result, the CSP internal BTS network SSH server (disabled by default) continues to apply the default SSH public/private key values. These keys don't give access to BTS, because service user authentication is username/password-based on top of SSH. Nokia factory installed default SSH keys are meant to be changed from operator-specific values during the BTS deployment commissioning phase. However, before the 21B release, BTS commissioning manuals did not provide instructions to change default SSH keys (to BTS operator-specific values). This leads to a possibility for malicious operations staff (inside a CSP network) to attempt MITM exploitation of BTS service user access, during the moments that SSH is enabled for Nokia service personnel to perform troubleshooting activities.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: http://packetstormsecurity.com/files/173055/Nokia-ASIKA-7.13.52-Private-Key-Disclosure.html; https://Nokia.com; https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25187/
CVE: CVE-2023-34474
Published: 2023-06-16
Description: A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/security/cve/CVE-2023-34474; https://bugzilla.redhat.com/show_bug.cgi?id=2214148; https://github.com/ImageMagick/ImageMagick/commit/1061db7f80fdc9ef572ac60b55f408f7bab6e1b0
CVE: CVE-2023-34475
Published: 2023-06-16
Description: A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user to open a specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/CVE-2023-34475; https://bugzilla.redhat.com/show_bug.cgi?id=2214149; https://github.com/ImageMagick/ImageMagick/commit/1061db7f80fdc9ef572ac60b55f408f7bab6e1b0
CVE: CVE-2023-35784
Published: 2023-06-16
Description: A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-416
References: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt; https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt; https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig
CVE: CVE-2023-3195
Published: 2023-06-16
Description: A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://access.redhat.com/security/cve/CVE-2023-3195; https://bugzilla.redhat.com/show_bug.cgi?id=2214141; https://github.com/ImageMagick/ImageMagick/commit/f[PII_REDACTED]77b28fa3f7b0ed7ed6bd86946934c
CVE: CVE-2023-30903
Published: 2023-06-16
Description: HP-UX could be exploited locally to create a Denial of Service (DoS) when any physical interface is configured with IPv6/inet6.  
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbux04474en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbux04474en_us
CVE: CVE-2023-30904
Published: 2023-06-16
Description: A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04487en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04487en_us