deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-31130
Published: 2023-05-25
Description: c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue.  C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-124, CWE-787
References: https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1; https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v; https://lists.debian.org/debian-lts-announce/2023/06/msg00034.html
CVE: CVE-2023-31147
Published: 2023-05-25
Description: c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-330, CWE-330
References: https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1; https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/
CVE: CVE-2023-2903
Published: 2023-05-25
Description: A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/Role/GetGridJson?keyword=&page=1&rows=20. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229977 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/NFine%20rapid%20development%20platform%20Role-GetGridJson%20has%20unauthorized%20access%20vulnerability.md; https://vuldb.com/?ctiid.229977; https://vuldb.com/?id.229977
CVE: CVE-2023-32067
Published: 2023-05-25
Description: c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1; https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc; https://lists.debian.org/debian-lts-announce/2023/06/msg00034.html
CVE: CVE-2023-32074
Published: 2023-05-25
Description: user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.2


CVSS Score: 8.0 (HIGH)
CWE: CWE-307, CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x8mc-84wj-rf34; https://github.com/nextcloud/user_oidc/pull/615; https://hackerone.com/reports/1954711
CVE: CVE-2023-28382
Published: 2023-05-26
Description: Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server. Affected products and versions are as follows: ESS REC Agent Server Edition for Linux V1.0.0 to V1.4.3, ESS REC Agent Server Edition for Solaris V1.1.0 to V1.4.0, ESS REC Agent Server Edition for HP-UX V1.1.0 to V1.4.0, and ESS REC Agent Server Edition for AIX V1.2.0 to V1.4.1
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://customer.et-x.jp/app/answers/detail/a_id/2260; https://jvn.jp/en/jp/JVN19243534/; https://customer.et-x.jp/app/answers/detail/a_id/2260
CVE: CVE-2023-23714
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/uncanny-learndash-toolkit/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/uncanny-learndash-toolkit/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-24007
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in TheOnlineHero - Tom Skroza Admin Block Country plugin <= 7.1.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/admin-block-country/wordpress-admin-block-country-plugin-7-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/admin-block-country/wordpress-admin-block-country-plugin-7-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25781
Published: 2023-05-26
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sebastian Krysmanski Upload File Type Settings plugin <= 1.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/upload-file-type-settings-plugin/wordpress-upload-file-type-settings-plugin-plugin-1-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/upload-file-type-settings-plugin/wordpress-upload-file-type-settings-plugin-plugin-1-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25971
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in FixBD Educare plugin <= 1.4.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/educare/wordpress-educare-students-result-management-system-plugin-1-4-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/educare/wordpress-educare-students-result-management-system-plugin-1-4-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-25976
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.2.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/cf7-zoho/wordpress-integration-for-contact-form-7-and-zoho-crm-bigin-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cf7-zoho/wordpress-integration-for-contact-form-7-and-zoho-crm-bigin-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-22693
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in conlabzgmbh WP Google Tag Manager plugin <= 1.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-google-tag-manager/wordpress-wp-google-tag-manager-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-google-tag-manager/wordpress-wp-google-tag-manager-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-24008
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in yonifre Maspik – Spam Blacklist plugin <= 0.7.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-7-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-7-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25038
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in 984.Ru For the visually impaired plugin <= 0.58 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/for-the-visually-impaired/wordpress-for-the-visually-impaired-plugin-0-58-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/for-the-visually-impaired/wordpress-for-the-visually-impaired-plugin-0-58-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-39335
Published: 2023-05-26
Description: Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are legitimate and permitted in their room. However, in versions of Synapse up to and including 1.68.0, a Synapse homeserver answering a query for authorization events does not sufficiently check that the requesting server should be able to access them. The issue was patched in Synapse 1.69.0. Homeserver administrators are advised to upgrade.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://github.com/matrix-org/synapse/issues/13288; https://github.com/matrix-org/synapse/pull/13823; https://github.com/matrix-org/synapse/security/advisories/GHSA-45cj-f97f-ggwv
CVE: CVE-2022-39374
Published: 2023-05-26
Description: Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/matrix-org/synapse/pull/13723; https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/
CVE: CVE-2023-25029
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in utahta WP Social Bookmarking Light plugin <= 2.0.7 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-social-bookmarking-light/wordpress-wp-social-bookmarking-light-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-social-bookmarking-light/wordpress-wp-social-bookmarking-light-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25470
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Anton Skorobogatov Rus-To-Lat plugin <= 0.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/rustolat/wordpress-rus-to-lat-plugin-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rustolat/wordpress-rus-to-lat-plugin-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-32323
Published: 2023-05-26
Description: Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/matrix-org/synapse/issues/14492; https://github.com/matrix-org/synapse/pull/14642; https://github.com/matrix-org/synapse/security/advisories/GHSA-f3wc-3vxv-xmvr
CVE: CVE-2022-46945
Published: 2023-05-26
Description: Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/NagVis/nagvis/commit/71aba7f46f79d846e1df037f165d206a2cd1d22a; https://github.com/NagVis/nagvis/compare/nagvis-1.9.33...nagvis-1.9.34; https://www.sonarsource.com/blog/checkmk-rce-chain-3/
CVE: CVE-2023-25034
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in BoLiQuan WP Clean Up plugin <= 1.2.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-clean-up/wordpress-wp-clean-up-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-clean-up/wordpress-wp-clean-up-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25058
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Schema – All In One Schema Rich Snippets plugin <= 1.6.5 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/all-in-one-schemaorg-rich-snippets/wordpress-schema-all-in-one-schema-rich-snippets-plugin-1-6-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/all-in-one-schemaorg-rich-snippets/wordpress-schema-all-in-one-schema-rich-snippets-plugin-1-6-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25467
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Daniel Mores, A. Huizinga Resize at Upload Plus plugin <= 1.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/resize-at-upload-plus/wordpress-resize-at-upload-plus-plugin-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/resize-at-upload-plus/wordpress-resize-at-upload-plus-plugin-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-29098
Published: 2023-05-26
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ArtistScope CopySafe Web Protection plugin <= 3.13 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-copysafe-web/wordpress-copysafe-web-protection-plugin-3-13-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-copysafe-web/wordpress-copysafe-web-protection-plugin-3-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30145
Published: 2023-05-26
Description: Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html; https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection; https://drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view?usp=share_link
CVE: CVE-2023-32964
Published: 2023-05-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <= 1.9.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/bnfw/wordpress-better-notifications-for-wp-plugin-1-9-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bnfw/wordpress-better-notifications-for-wp-plugin-1-9-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-33394
Published: 2023-05-26
Description: skycaiji v2.5.4 is vulnerable to Cross Site Scripting (XSS). Attackers can achieve backend XSS by deploying malicious JSON data.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wanheiqiyihu.top/2023/05/02/skycaiji-v2-5-4-has-a-backend-xss-vulnerability/; https://wanheiqiyihu.top/2023/05/02/skycaiji-v2-5-4-has-a-backend-xss-vulnerability/; https://wanheiqiyihu.top/2023/05/02/skycaiji-v2-5-4-has-a-backend-xss-vulnerability/
CVE: CVE-2023-33439
Published: 2023-05-26
Description: Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/F14me7wq/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-1.md; https://github.com/F14me7wq/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-1.md
CVE: CVE-2023-33440
Published: 2023-05-26
Description: Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/172672/Faculty-Evaluation-System-1.0-Shell-Upload.html; https://github.com/F14me7wq/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/RCE-1.md; http://packetstormsecurity.com/files/172672/Faculty-Evaluation-System-1.0-Shell-Upload.html
CVE: CVE-2023-33720
Published: 2023-05-26
Description: mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/enzo1982/mp4v2/issues/36; https://github.com/enzo1982/mp4v2/issues/36
CVE: CVE-2021-46881
Published: 2023-05-26
Description: The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2021-46882
Published: 2023-05-26
Description: The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2021-46883
Published: 2023-05-26
Description: The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2021-46884
Published: 2023-05-26
Description: The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2021-46885
Published: 2023-05-26
Description: The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2021-46886
Published: 2023-05-26
Description: The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2021-46887
Published: 2023-05-26
Description: Lack of length check vulnerability in the HW_KEYMASTER module. Successful exploitation of this vulnerability may cause out-of-bounds read.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2022-48478
Published: 2023-05-26
Description: The facial recognition TA of some products lacks memory length verification. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.
CVSS Score: 9.8 (CRITICAL)
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202305-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202305-[PII_REDACTED]
CVE: CVE-2022-48479
Published: 2023-05-26
Description: The facial recognition TA of some products has the out-of-bounds memory read vulnerability. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202305-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202305-[PII_REDACTED]
CVE: CVE-2022-48480
Published: 2023-05-26
Description: Integer overflow vulnerability in some phones. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2023-0116
Published: 2023-05-26
Description: The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2023-0117
Published: 2023-05-26
Description: The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this vulnerability may affect availability of features,such as MeeTime.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2023-20882
Published: 2023-05-26
Description: In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected backend as failed and removes it from the routing pool.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: https://www.cloudfoundry.org/blog/cve-2023-20882-gorouter-pruning-via-client-disconnect-resulting-in-dos/; https://www.cloudfoundry.org/blog/cve-2023-20882-gorouter-pruning-via-client-disconnect-resulting-in-dos/
CVE: CVE-2023-20883
Published: 2023-05-26
Description: In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://spring.io/security/cve-2023-20883; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/