deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28164
Published: 2023-06-02
Description: Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1809122; https://www.mozilla.org/security/advisories/mfsa2023-09/; https://www.mozilla.org/security/advisories/mfsa2023-10/
CVE: CVE-2023-28176
Published: 2023-06-02
Description: Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1808352%2C1811637%2C1815904%2C1817442%2C1818674; https://www.mozilla.org/security/advisories/mfsa2023-09/; https://www.mozilla.org/security/advisories/mfsa2023-10/
CVE: CVE-2023-28177
Published: 2023-06-02
Description: Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1803109%2C1808832%2C1809542%2C1817336; https://www.mozilla.org/security/advisories/mfsa2023-09/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1803109%2C1808832%2C1809542%2C1817336
CVE: CVE-2023-29533
Published: 2023-06-02
Description: A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1798219; https://bugzilla.mozilla.org/show_bug.cgi?id=1814597; https://www.mozilla.org/security/advisories/mfsa2023-13/
CVE: CVE-2023-29535
Published: 2023-06-02
Description: Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1820543; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://www.mozilla.org/security/advisories/mfsa2023-14/
CVE: CVE-2023-29536
Published: 2023-06-02
Description: An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1821959; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://www.mozilla.org/security/advisories/mfsa2023-14/
CVE: CVE-2023-29537
Published: 2023-06-02
Description: Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1823365; https://bugzilla.mozilla.org/show_bug.cgi?id=1824200; https://bugzilla.mozilla.org/show_bug.cgi?id=1825569
CVE: CVE-2023-29538
Published: 2023-06-02
Description: Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1685403; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1685403
CVE: CVE-2023-29539
Published: 2023-06-02
Description: When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1784348; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://www.mozilla.org/security/advisories/mfsa2023-14/
CVE: CVE-2023-29540
Published: 2023-06-02
Description: Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1790542; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1790542
CVE: CVE-2023-29541
Published: 2023-06-02
Description: Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
CVSS Score: 8.8 (HIGH)
CWE: CWE-116, CWE-116
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1810191; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://www.mozilla.org/security/advisories/mfsa2023-14/
CVE: CVE-2023-29543
Published: 2023-06-02
Description: An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-116
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1816158; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1816158
CVE: CVE-2023-29544
Published: 2023-06-02
Description: If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1818781; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1818781
CVE: CVE-2023-29547
Published: 2023-06-02
Description: When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed. This could have led to a desynchronization in expected results when reading from the secure cookie. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1783536; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1783536
CVE: CVE-2023-29548
Published: 2023-06-02
Description: A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1822754; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://www.mozilla.org/security/advisories/mfsa2023-14/
CVE: CVE-2023-29549
Published: 2023-06-02
Description: Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1823042; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1823042
CVE: CVE-2023-29550
Published: 2023-06-02
Description: Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1720594%2C1812498%2C1814217%2C1818357%2C1751945%2C1818762%2C1819493%2C1820389%2C1820602%2C1821448%2C1822413%2C1824828; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://www.mozilla.org/security/advisories/mfsa2023-14/
CVE: CVE-2023-29551
Published: 2023-06-02
Description: Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1763625%2C1814314%2C1815798%2C1815890%2C1819239%2C1819465%2C1819486%2C1819492%2C1819957%2C1820514%2C1820776%2C1821838%2C1822175%2C1823547; https://www.mozilla.org/security/advisories/mfsa2023-13/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1763625%2C1814314%2C1815798%2C1815890%2C1819239%2C1819465%2C1819486%2C1819492%2C1819957%2C1820514%2C1820776%2C1821838%2C1822175%2C1823547
CVE: CVE-2023-32205
Published: 2023-06-02
Description: In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1753339; https://bugzilla.mozilla.org/show_bug.cgi?id=1753341; https://security.gentoo.org/glsa/202312-03
CVE: CVE-2023-32206
Published: 2023-06-02
Description: An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1824892; https://security.gentoo.org/glsa/202312-03; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-32207
Published: 2023-06-02
Description: A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-290, CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1826116; https://security.gentoo.org/glsa/202312-03; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-32211
Published: 2023-06-02
Description: A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1823379; https://security.gentoo.org/glsa/202312-03; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-32212
Published: 2023-06-02
Description: An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1826622; https://security.gentoo.org/glsa/202312-03; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-32213
Published: 2023-06-02
Description: When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-908
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1826666; https://security.gentoo.org/glsa/202312-03; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-32215
Published: 2023-06-02
Description: Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1540883%2C1751943%2C1814856%2C1820210%2C1821480%2C1827019%2C1827024%2C1827144%2C1827359%2C1830186; https://security.gentoo.org/glsa/202312-03; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-3069
Published: 2023-06-02
Description: Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-620, CWE-287
References: https://github.com/tsolucio/corebos/commit/e3dabd74c68646bb54538d66411fc1e633ec454b; https://huntr.dev/bounties/00544982-365a-476b-b5fe-42f02f11d367; https://github.com/tsolucio/corebos/commit/e3dabd74c68646bb54538d66411fc1e633ec454b
CVE: CVE-2023-3070
Published: 2023-06-02
Description: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/tsolucio/corebos/commit/b3a7a26c60117d7859b8d77b57fd5771a038c93a; https://huntr.dev/bounties/e193068e-0b95-403a-8453-e015241b8f1b; https://github.com/tsolucio/corebos/commit/b3a7a26c60117d7859b8d77b57fd5771a038c93a
CVE: CVE-2023-3071
Published: 2023-06-02
Description: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/tsolucio/corebos/commit/5e87fbc4292cf7a96fa5139ede88f4baefad104b; https://huntr.dev/bounties/3e8d5166-9bc6-46e7-94a8-cad52434a39e; https://github.com/tsolucio/corebos/commit/5e87fbc4292cf7a96fa5139ede88f4baefad104b
CVE: CVE-2023-3074
Published: 2023-06-02
Description: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/tsolucio/corebos/commit/659e328c06a127249e651100d2bc7ec1d2dd8533; https://huntr.dev/bounties/6132f557-3f0f-465d-990f[PII_REDACTED]a4; https://github.com/tsolucio/corebos/commit/659e328c06a127249e651100d2bc7ec1d2dd8533
CVE: CVE-2023-3075
Published: 2023-06-02
Description: Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/tsolucio/corebos/commit/2e415fb4613bc4122578dad5f40c6f819c228a48; https://huntr.dev/bounties/0f5448a6-d551-424f-887d-80f9bcfaa6e4; https://github.com/tsolucio/corebos/commit/2e415fb4613bc4122578dad5f40c6f819c228a48
CVE: CVE-2023-3073
Published: 2023-06-02
Description: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/tsolucio/corebos/commit/e87f77c64061b43186c80ad1b50d313c67d7f6cf; https://huntr.dev/bounties/a4d6a082-2ea8-49a5-8e48-6d39b5cc62e1; https://github.com/tsolucio/corebos/commit/e87f77c64061b43186c80ad1b50d313c67d7f6cf
CVE: CVE-2023-33669
Published: 2023-06-02
Description: Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N1/README.md; https://github.com/DDizzzy79/Tenda-CVE/tree/main/AC8V4.0/N1; https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N1/README.md
CVE: CVE-2023-33670
Published: 2023-06-02
Description: Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sub_4a79ec function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N3/README.md; https://github.com/DDizzzy79/Tenda-CVE/tree/main/AC8V4.0/N3; https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N3/README.md
CVE: CVE-2023-33671
Published: 2023-06-02
Description: Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N4/README.md; https://github.com/DDizzzy79/Tenda-CVE/tree/main/AC8V4.0/N4; https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N4/README.md
CVE: CVE-2023-33672
Published: 2023-06-02
Description: Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N2/README.md; https://github.com/DDizzzy79/Tenda-CVE/tree/main/AC8V4.0/N2; https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N2/README.md
CVE: CVE-2023-33673
Published: 2023-06-02
Description: Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N6/README.md; https://github.com/DDizzzy79/Tenda-CVE/tree/main/AC8V4.0/N6; https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N6/README.md
CVE: CVE-2023-33675
Published: 2023-06-02
Description: Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the get_parentControl_list_Info function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N5/README.md; https://github.com/DDizzzy79/Tenda-CVE/tree/main/AC8V4.0/N5; https://github.com/DDizzzy79/Tenda-CVE/blob/main/AC8V4.0/N5/README.md
CVE: CVE-2023-33761
Published: 2023-06-02
Description: eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /view/cb/format_642.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33761; https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33761
CVE: CVE-2023-33762
Published: 2023-06-02
Description: eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33762; https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33762
CVE: CVE-2023-33763
Published: 2023-06-02
Description: eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33763; https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33763
CVE: CVE-2023-1297
Published: 2023-06-02
Description: Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-826
References: https://discuss.hashicorp.com/t/hcsec-2023-15-consul-cluster-peering-can-result-in-denial-of-service/54515; https://discuss.hashicorp.com/t/hcsec-2023-15-consul-cluster-peering-can-result-in-denial-of-service/54515
CVE: CVE-2023-2816
Published: 2023-06-02
Description: Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
CVSS Score: 8.7 (HIGH)
CWE: CWE-266
References: https://discuss.hashicorp.com/t/hcsec-2023-16-consul-envoy-extension-downstream-proxy-configuration-by-upstream-service-owner/54525; https://discuss.hashicorp.com/t/hcsec-2023-16-consul-envoy-extension-downstream-proxy-configuration-by-upstream-service-owner/54525
CVE: CVE-2023-3044
Published: 2023-06-02
Description: An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code.




This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate.



CVSS Score: 3.3 (LOW)
CWE: CWE-369, CWE-369
References: https://github.com/baker221/poc-xpdf; https://www.xpdfreader.com/security-bug/CVE-2023-3044.html; https://github.com/baker221/poc-xpdf
CVE: CVE-2023-2781
Published: 2023-06-03
Description: The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resend_verification_email function. This allows unauthenticated attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Allow Automatic Login After Successful Verification setting to be enabled, which it is not by default.
CVSS Score: 8.1 (HIGH)
CWE: CWE-288, CWE-306
References: https://plugins.trac.wordpress.org/browser/woo-confirmation-email/tags/3.5.0/public/class-xlwuev-woocommerce-confirmation-email-public.php#L143; https://plugins.trac.wordpress.org/browser/woo-confirmation-email/tags/3.5.0/public/class-xlwuev-woocommerce-confirmation-email-public.php#L332; https://plugins.trac.wordpress.org/browser/woo-confirmation-email/tags/3.5.0/public/class-xlwuev-woocommerce-confirmation-email-public.php#L506