deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-25533
Published: 2024-05-08
Description: Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx). This vulnerability can allow attackers to write files to the server or execute arbitrary commands via crafted SQL statements.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#information-leakage-and-unauthorized-access-to-sensitive-data; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#information-leakage-and-unauthorized-access-to-sensitive-data
CVE: CVE-2024-33382
Published: 2024-05-08
Description: An issue in Open5GS v.2.7.0 allows an attacker to cause a denial of service via the 64 unsuccessful UE/gnb registration
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/open5gs/open5gs/issues/2733; https://github.com/open5gs/open5gs/issues/2733
CVE: CVE-2024-34244
Published: 2024-05-08
Description: libmodbus v3.1.10 is vulnerable to Buffer Overflow via the modbus_write_bits function. This issue can be triggered when the function is fed with specially crafted input, which leads to out-of-bounds read and can potentially cause a crash or other unintended behaviors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-125
References: https://github.com/stephane/libmodbus/issues/743; https://github.com/stephane/libmodbus/issues/743
CVE: CVE-2024-34257
Published: 2024-05-08
Description: TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: https://github.com/ZackSecurity/VulnerReport/blob/cve/totolink/EX1800T/1.md; https://immense-mirror-b42.notion.site/TOTOLINK-EX1800T-has-an-unauthorized-arbitrary-command-execution-vulnerability-2f3e308f5e1d45a2b8a64f198cacc350; https://github.com/ZackSecurity/VulnerReport/blob/cve/totolink/EX1800T/1.md
CVE: CVE-2020-18305
Published: 2024-05-14
Description: Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges.
CVSS Score: 8.0 (HIGH)
CWE: CWE-287
References: https://gist.github.com/yasinyilmaz/1fe3fe58dd275edb77dcbe890fce2f2c; https://gist.github.com/yasinyilmaz/1fe3fe58dd275edb77dcbe890fce2f2c
CVE: CVE-2020-36662
Published: 2024-05-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-32502
Published: 2024-05-14
Description: An issue was discovered on certain Nuki Home Solutions devices. There is a buffer overflow over the encrypted token parsing logic in the HTTP service that allows remote code execution. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-121
References: https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/; https://nuki.io/en/security-updates/; https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
CVE: CVE-2022-32503
Published: 2024-05-14
Description: An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to this JTAG port may be able to connect to the device and bypass both hardware and software security protections. This affects Nuki Keypad before 1.9.2 and Nuki Fob before 1.8.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-306
References: https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/; https://nuki.io/en/security-updates/; https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
CVE: CVE-2022-32504
Published: 2024-05-14
Description: An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary code execution on a KeyTurner device. This affects Nuki Smart Lock 3.0 before 3.3.5 and 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/; https://nuki.io/en/security-updates/; https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
CVE: CVE-2022-32505
Published: 2024-05-14
Description: An issue was discovered on certain Nuki Home Solutions devices. It is possible to send multiple BLE malformed packets to block some of the functionality and reboot the device. This affects Nuki Smart Lock 3.0 before 3.3.5 and Nuki Smart Lock 2.0 before 2.12.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-400
References: https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/; https://nuki.io/en/security-updates/; https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
CVE: CVE-2022-32506
Published: 2024-05-14
Description: An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to the circuit board could use the SWD debug features to control the execution of code on the processor and debug the firmware, as well as read or alter the content of the internal and external flash memory. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Smart Lock 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-1263
References: https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/; https://nuki.io/en/security-updates/; https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
CVE: CVE-2022-32507
Published: 2024-05-14
Description: An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to be only called from privileged accounts, could also be called from unprivileged accounts. This demonstrates that no access controls were implemented for the different BLE commands across the different accounts. This affects Nuki Smart Lock 3.0 before 3.3.5 and Nuki Smart Lock 2.0 before 2.12.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/; https://nuki.io/en/security-updates/; https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
CVE: CVE-2022-32508
Published: 2024-05-14
Description: An issue was discovered on certain Nuki Home Solutions devices. By sending a malformed HTTP verb, it is possible to force a reboot of the device. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/; https://nuki.io/en/security-updates/; https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
CVE: CVE-2022-32509
Published: 2024-05-14
Description: An issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on HTTP communications allows attackers to intercept and tamper data. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Bridge v1 before 1.22.0 and Nuki Bridge v2 before 2.13.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/; https://nuki.io/en/security-updates/; https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
CVE: CVE-2022-32510
Published: 2024-05-14
Description: An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API endpoints. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-319
References: https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/; https://nuki.io/en/security-updates/; https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
CVE: CVE-2022-4967
Published: 2024-05-14
Description: strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clients in TLS-based EAP methods, the IKE or EAP identity supplied by a client is not enforced to be contained in the client's certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their own. This is problematic if the identity is used to make policy decisions. A fix was released in strongSwan version 5.9.6 in August 2022 (e4b4aabc4996fc61c37deab7858d07bc4d220136).
CVSS Score: 7.7 (HIGH)
References: https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.cve.org/CVERecord?id=CVE-2022-4967
CVE: CVE-2023-26566
Published: 2024-05-14
Description: Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure Asterisk and make external and internal calls via HTTP and WebSocket requests sent to the API.
CVSS Score: 8.6 (HIGH)
CWE: CWE-798
References: https://qsecure.com.cy/resources/advisories/sangoma-freepbx-linux-hardcoded-credentials; https://qsecure.com.cy/resources/advisories/sangoma-freepbx-linux-hardcoded-credentials
CVE: CVE-2023-26863
Published: 2024-05-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-29881
Published: 2024-05-14
Description: phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/Northind/97522a49ae4bb0c8e6e2a49e75fd637a; https://github.com/qinggan/phpok/issues/15; https://gist.github.com/Northind/97522a49ae4bb0c8e6e2a49e75fd637a
CVE: CVE-2023-37526
Published: 2024-05-14
Description: HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-942
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113032; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113032
CVE: CVE-2023-38264
Published: 2024-05-14
Description: The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters.  IBM X-Force ID:  260578.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260578; https://www.ibm.com/support/pages/node/7150727; https://exchange.xforce.ibmcloud.com/vulnerabilities/260578
CVE: CVE-2023-42955
Published: 2024-05-14
Description: Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console with an administrator role.  This issue has been fixed in FileMaker Server 20.3.1 by eliminating the send of Admin Role passwords in the Node.js socket.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522, CWE-257
References: https://support.claris.com/s/article/Administrator-role-passwords-being-exposed-when-logged-into-the-Admin-Console?language=en_US; https://support.claris.com/s/article/Administrator-role-passwords-being-exposed-when-logged-into-the-Admin-Console?language=en_US
CVE: CVE-2023-43040
Published: 2024-05-14
Description: IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access.  IBM X-Force ID:  266807.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1220
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266807; https://www.ibm.com/support/pages/node/7151040; https://exchange.xforce.ibmcloud.com/vulnerabilities/266807
CVE: CVE-2023-46870
Published: 2024-05-14
Description: extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1.0, 4.0.0, 4.1.0, and 4.1.1 have set incorrect file permission, which allows attackers to do code execution via modified bash and python scripts.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://github.com/Chapoly1305/CVE-2023-46870; https://github.com/Chapoly1305/CVE-2023-46870
CVE: CVE-2023-47709
Published: 2024-05-14
Description: IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  IBM X-Force ID:  271524.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271524; https://www.ibm.com/support/pages/node/7150840; https://exchange.xforce.ibmcloud.com/vulnerabilities/271524
CVE: CVE-2023-47711
Published: 2024-05-14
Description: IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow an authenticated user to upload files that would cause a denial of service.  IBM X-Force ID:  271526.
CVSS Score: 2.7 (LOW)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271526; https://www.ibm.com/support/pages/node/7150840; https://exchange.xforce.ibmcloud.com/vulnerabilities/271526
CVE: CVE-2023-47712
Published: 2024-05-14
Description: IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a local user to gain elevated privileges on the system due to improper permissions control.  IBM X-Force ID:  271527.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271524; https://www.ibm.com/support/pages/node/7150840; https://exchange.xforce.ibmcloud.com/vulnerabilities/271524
CVE: CVE-2023-49781
Published: 2024-05-14
Description: NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink(). This function recognizes the pattern URI::(XXX) and creates a hyperlink tag <a> with href=XXX. However, it leaves all the other contents outside of the pattern URI::(XXX) unchanged. This vulnerability is fixed in 0.202.9.

CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/nocodb/nocodb/commit/7f58ce3726dfec71537d8b80474a0f95a48a1574; https://github.com/nocodb/nocodb/security/advisories/GHSA-h6r4-xvw6-jc5h; https://github.com/nocodb/nocodb/commit/7f58ce3726dfec71537d8b80474a0f95a48a1574
CVE: CVE-2023-50717
Published: 2024-05-14
Description: NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading  stored cross-site scripting attack. This allows remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form. Version 0.202.10 contains a patch for the issue.

CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-434, CWE-434
References: https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh; https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh
CVE: CVE-2023-50718
Published: 2024-05-14
Description: NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8; https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8
CVE: CVE-2023-52383
Published: 2024-05-14
Description: Double-free vulnerability in the RSMC module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://consumer.huawei.com/en/support/bulletin/2024/5/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/5/
CVE: CVE-2023-52384
Published: 2024-05-14
Description: Double-free vulnerability in the RSMC module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://consumer.huawei.com/en/support/bulletin/2024/5/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/5/
CVE: CVE-2023-52654
Published: 2024-05-14
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring/af_unix: disable sending io_uring over sockets

File reference cycles have caused lots of problems for io_uring
in the past, and it still doesn't work exactly right and races with
unix_stream_read_generic(). The safest fix would be to completely
disallow sending io_uring files via sockets via SCM_RIGHT, so there
are no possible cycles invloving registered files and thus rendering
SCM accounting on the io_uring side unnecessary.
CVSS Score: 4.7 (MEDIUM)
References: https://git.kernel.org/stable/c/18824f592aad4124d79751bbc1500ea86ac3ff29; https://git.kernel.org/stable/c/3fe1ea5f921bf5b71cbfdc4469fb96c05936610e; https://git.kernel.org/stable/c/5a33d385eb36991a91e3dddb189d8679e2aac2be
CVE: CVE-2023-52655
Published: 2024-05-14
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: aqc111: check packet for fixup for true limit

If a device sends a packet that is inbetween 0
and sizeof(u64) the value passed to skb_trim()
as length will wrap around ending up as some very
large value.

The driver will then proceed to parse the header
located at that position, which will either oops or
process some random value.

The fix is to check against sizeof(u64) rather than
0, which the driver currently does. The issue exists
since the introduction of the driver.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2ebf775f0541ae0d474836fa0cf3220e502f8e3e; https://git.kernel.org/stable/c/46412b2fb1f9cc895d6d4036bf24f640b5d86dab; https://git.kernel.org/stable/c/82c386d73689a45d5ee8c1290827bce64056dddd
CVE: CVE-2023-52656
Published: 2024-05-14
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring: drop any code related to SCM_RIGHTS

This is dead code after we dropped support for passing io_uring fds
over SCM_RIGHTS, get rid of it.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6e5e6d274956305f1fc0340522b38f5f5be74bdb; https://git.kernel.org/stable/c/6fc19b3d8a45ff0e5d50ec8184cee1d5eac1a8ba; https://git.kernel.org/stable/c/88c49d9c896143cdc0f77197c4dcf24140375e89
CVE: CVE-2023-52719
Published: 2024-05-14
Description: Privilege escalation vulnerability in the PMS module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.1 (HIGH)
CWE: CWE-16
References: https://consumer.huawei.com/en/support/bulletin/2024/5/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/5/
CVE: CVE-2023-52720
Published: 2024-05-14
Description: Race condition vulnerability in the soundtrigger module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2024/5/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/5/
CVE: CVE-2023-52721
Published: 2024-05-14
Description: The WindowManager module has a vulnerability in permission control.
Impact: Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2024/5/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/5/
CVE: CVE-2023-5052
Published: 2024-05-14
Description: vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /us_extra/phpinfo.php page. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and partially take over their session details.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-uniform-server-zero; https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-uniform-server-zero
CVE: CVE-2023-5447
Published: 2024-05-14
Description: Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in denial of service for the Synaptics Hardware Support App.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-414, CWE-416
References: https://www.synaptics.com/sites/default/files/2023-10/fingerprint-driver-HSAService-security-brief-2023-10-13.pdf; https://www.synaptics.com/sites/default/files/2023-10/fingerprint-driver-HSAService-security-brief-2023-10-13.pdf