deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-32677
Published: 2023-05-19
Description: Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite a new user also allows them to set the streams that the new user is invited to -- even if the inviting user would not have permissions to add an existing user to streams. While such a configuration is likely rare in practice, the behavior does violate security-related controls. This does not let a user invite new users to streams they cannot see, or would not be able to add users to if they had that general permission. This issue has been addressed in version 6.2. Users are advised to upgrade. Users unable to upgrade may limit sending of invitations down to users who also have the permission to add users to streams.
CVSS Score: 3.1 (LOW)
CWE: CWE-862, CWE-862
References: https://github.com/zulip/zulip/commit/7c2693a2c64904d1d0af8503b[PII_REDACTED]8cbe5; https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc; https://zulip.com/help/configure-who-can-invite-to-streams
CVE: CVE-2023-28623
Published: 2023-05-19
Description: Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only ones enabled in `AUTHENTICATION_BACKENDS` in `/etc/zulip/settings.py` and 2: The organization permissions don't require invitations to join. An attacker can create a new account in the organization with an arbitrary email address in their control that's not in the organization's LDAP directory. The impact is limited to installations which have this specific combination of authentication backends as described above in addition to having `Invitations are required for joining this organization` organization permission disabled. This issue has been addressed in version 6.2. Users are advised to upgrade. Users unable to upgrade may enable the `Invitations are required for joining this organization` organization permission to prevent this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285, CWE-862, CWE-862
References: https://github.com/zulip/zulip/commit/3df1b4dd7c210c21deb6f829df19412b74573f8d; https://github.com/zulip/zulip/security/advisories/GHSA-7p62-pjwg-56rv; https://github.com/zulip/zulip/commit/3df1b4dd7c210c21deb6f829df19412b74573f8d
CVE: CVE-2023-2714
Published: 2023-05-20
Description: The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_license' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the license key and support license key, but it can only be changed to a valid license key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/guided-setup/guided-setup.php#L111; https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L41; https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.php
CVE: CVE-2023-2715
Published: 2023-05-20
Description: The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's data to the plugin developer, and it is also possible to create an admin access with an auto login link that is also sent to the plugin developer with the ticket. It only works if the plugin is activated with a valid license.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L220; https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/24747507-8f24-499e-a257-d379dc171e18?source=cve
CVE: CVE-2023-2716
Published: 2023-05-20
Description: The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajax_upload_file' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload a file to the contact, and then lists all the other uploaded files related to the contact.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/contacts/contacts-page.php#L458; https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/contacts/contacts-page.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3c5bde0e-3138-4995-92ae-6deaf6b7be5b?source=cve
CVE: CVE-2023-2717
Published: 2023-05-20
Description: The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation on the 'enable_safe_mode' function. This makes it possible for unauthenticated attackers to enable safe mode, which disables all other plugins, via a forged request if they can successfully trick an administrator into performing an action such as clicking on a link. A warning message about safe mode is displayed to the admin, which can be easily disabled.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/help/help-page.php#L67; https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/help/help-page.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/af73240c-b711-4e91-9998-5f7e6a9a4fb9?source=cve
CVE: CVE-2023-2735
Published: 2023-05-20
Description: The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gh_form' shortcode in versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only works with legacy contact forms.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/includes/form/form.php#L187; https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/includes/shortcodes.php#L51; https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/trunk/includes/better-meta-compat.php
CVE: CVE-2023-2736
Published: 2023-05-20
Description: The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation in the 'ajax_edit_contact' function. This makes it possible for authenticated attackers to receive the auto login link via shortcode and then modify the assigned user to the auto login link to elevate verified user privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/admin/contacts/contacts-page.php#L542; https://plugins.trac.wordpress.org/browser/groundhogg/tags/2.7.9.8/includes/shortcodes.php#L99; https://plugins.trac.wordpress.org/changeset/2914493/groundhogg/tags/2.7.10/admin/contacts/contacts-page.php
CVE: CVE-2023-2276
Published: 2023-05-20
Description: The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://lana.codes/lanavdb/3a841453-d083-4f97-a7f1-b398c7304284/; https://plugins.trac.wordpress.org/browser/wc-multivendor-membership/tags/2.10.7/controllers/wcfmvm-controller-memberships-registration.php#L124; https://plugins.trac.wordpress.org/changeset/2907455/
CVE: CVE-2023-2822
Published: 2023-05-20
Description: A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.10.6 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-229596.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://medium.com/@cyberninja717/685bb1675dfb; https://medium.com/@cyberninja717/reflected-cross-site-scripting-vulnerability-in-ellucian-ethos-identity-cas-logout-page-685bb1675dfb; https://vuldb.com/?ctiid.229596
CVE: CVE-2023-2823
Published: 2023-05-20
Description: A vulnerability was found in SourceCodester Class Scheduling System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit_subject.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229597 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/zhulielie/CVEReport/blob/main/SQL.md; https://vuldb.com/?ctiid.229597; https://vuldb.com/?id.229597
CVE: CVE-2023-2824
Published: 2023-05-20
Description: A vulnerability was found in SourceCodester Dental Clinic Appointment Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/service.php of the component POST Parameter Handler. The manipulation of the argument service leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-229598 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/daxian2022/CVE/blob/main/XSS.md; https://vuldb.com/?ctiid.229598; https://vuldb.com/?id.229598
CVE: CVE-2023-2712
Published: 2023-05-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability  in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Command Injection, Using Malicious Files, Upload a Web Shell to a Web Server.This issue affects Rental Module: before 23.05.15.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.usom.gov.tr/bildirim/tr-23-0276; https://www.usom.gov.tr/bildirim/tr-23-0276
CVE: CVE-2023-2713
Published: 2023-05-20
Description: Authorization Bypass Through User-Controlled Key vulnerability  in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Authentication Abuse, Authentication Bypass.This issue affects Rental Module: before 23.05.15.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-23-0276; https://www.usom.gov.tr/bildirim/tr-23-0276
CVE: CVE-2023-1692
Published: 2023-05-20
Description: The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://consumer.huawei.com/en/support/bulletin/2023/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/4/
CVE: CVE-2023-1693
Published: 2023-05-20
Description: The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2023/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/4/
CVE: CVE-2023-1694
Published: 2023-05-20
Description: The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2023/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/4/
CVE: CVE-2023-1696
Published: 2023-05-20
Description: The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://consumer.huawei.com/en/support/bulletin/2023/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/4/
CVE: CVE-2023-32700
Published: 2023-05-20
Description: LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://github.com/TeX-Live/texlive-source/releases/tag/build-svn66984; https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLY43MIRONJSJVNBDFQHQ26MP3JIOB3H/
CVE: CVE-2023-33244
Published: 2023-05-20
Description: Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page.
CVSS Score: 8.2 (HIGH)
References: https://forum.obsidian.md/t/obsidian-release-v1-2-2-insider-build/57488; https://vuln.ryotak.net/advisories/66; https://forum.obsidian.md/t/obsidian-release-v1-2-2-insider-build/57488
CVE: CVE-2022-47134
Published: 2023-05-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/gallery-metabox/wordpress-gallery-metabox-plugin-1-5-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/gallery-metabox/wordpress-gallery-metabox-plugin-1-5-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-22689
Published: 2023-05-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-auto-affiliate-links/wordpress-auto-affiliate-links-plugin-6-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-auto-affiliate-links/wordpress-auto-affiliate-links-plugin-6-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-23890
Published: 2023-05-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in LJ Apps WP Airbnb Review Slider plugin <= 3.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-airbnb-review-slider/wordpress-wp-airbnb-review-slider-plugin-3-2-cross-site-request-forgery-csrf-leading-to-reviews-removal-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-airbnb-review-slider/wordpress-wp-airbnb-review-slider-plugin-3-2-cross-site-request-forgery-csrf-leading-to-reviews-removal-vulnerability?_s_id=cve
CVE: CVE-2023-24414
Published: 2023-05-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-32589
Published: 2023-05-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in PingOnline Dyslexiefont Free plugin <= 1.0.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/dyslexiefont/wordpress-dyslexiefont-free-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dyslexiefont/wordpress-dyslexiefont-free-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-2826
Published: 2023-05-21
Description: A vulnerability has been found in SourceCodester Class Scheduling System 1.0 and classified as problematic. This vulnerability affects unknown code of the file search_teacher_result.php of the component POST Parameter Handler. The manipulation of the argument teacher leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229612.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/joicygiore/ApplyForCVE/blob/main/XSS.md; https://vuldb.com/?ctiid.229612; https://vuldb.com/?id.229612
CVE: CVE-2021-46888
Published: 2023-05-21
Description: An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/simonmichael/hledger/issues/1525; https://github.com/simonmichael/hledger/pull/1663; https://github.com/simonmichael/hledger/releases/tag/1.23
CVE: CVE-2023-33250
Published: 2023-05-21
Description: The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.suse.com/show_bug.cgi?id=1211597; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=804ca14d04df09bf7924bacc5ad22a4bed80c94f; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dbe245cdf5189e88d680379ed[PII_REDACTED]b650
CVE: CVE-2023-33251
Published: 2023-05-21
Description: When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-732
References: https://akka.io/security/akka-http-cve-2023-05-15.html; https://akka.io/security/akka-http-cve-2023-05-15.html; https://doc.akka.io/reference/security-announcements/akka-http-cve-2023-05-15.html
CVE: CVE-2023-33252
Published: 2023-05-21
Description: iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/iden3/snarkjs/commits/master/src/groth16_verify.js; https://github.com/iden3/snarkjs/tags; https://github.com/iden3/snarkjs/commits/master/src/groth16_verify.js
CVE: CVE-2023-33254
Published: 2023-05-21
Description: There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privilege level on the Active Directory domain. To exploit this, an authenticated attacker edits the user-authentication settings to specify an attacker-controlled LDAP server, clicks the Test Settings button, and captures the cleartext credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.stevencampbell.info/KACE-LDAP-Bind-Credential-Exposure/; https://www.stevencampbell.info/KACE-LDAP-Bind-Credential-Exposure/
CVE: CVE-2020-36694
Published: 2023-05-21
Description: An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace. NOTE: cc00bca was reverted in 5.12.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc00bcaa589914096edef7fb87ca5cee4a166b5c
CVE: CVE-2023-32336
Published: 2023-05-22
Description: IBM InfoSphere Information Server 11.7 is affected by a remote code execution vulnerability due to insecure deserialization in an RMI service.  IBM X-Force ID:  255285.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/255285; https://www.ibm.com/support/pages/node/6995879; https://exchange.xforce.ibmcloud.com/vulnerabilities/255285
CVE: CVE-2023-33264
Published: 2023-05-22
Description: In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://github.com/hazelcast/hazelcast/pull/24266; https://github.com/hazelcast/hazelcast/pull/24266
CVE: CVE-2023-33281
Published: 2023-05-22
Description: The remote keyfob system on Nissan Sylphy Classic 2021 sends the same RF signal for each door-open request, which allows for a replay attack. NOTE: the vendor's position is that this cannot be reproduced with genuine Nissan parts: for example, the combination of keyfob and door handle shown in the exploit demonstration does not match any technology that Nissan provides to customers.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-294
References: https://chaos-lab.blogspot.com/2023/05/nissan-sylphy-classic-2021-fixed-code.html; https://twitter.com/Kevin2600/status/[PII_REDACTED]06415365; https://www.youtube.com/watch?v=GG1utSdYG1k
CVE: CVE-2023-33285
Published: 2023-05-22
Description: An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://codereview.qt-project.org/c/qt/qtbase/+/477644; https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html; https://codereview.qt-project.org/c/qt/qtbase/+/477644
CVE: CVE-2023-33288
Published: 2023-05-22
Description: An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.9; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=47c29d69212911f50bdcdd0564b5999a559010d4; https://github.com/torvalds/linux/commit/47c29d69212911f50bdcdd0564b5999a559010d4