deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28843
Published: 2023-03-31
Description: PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support. A SQL injection vulnerability found in the PrestaShop paypal module from release from 3.12.0 to and including 3.16.3 allow a remote attacker to gain privileges, modify data, and potentially affect system availability. The cause of this issue is that SQL queries were being constructed with user input which had not been properly filtered. Only deployments on PrestaShop 1.6 are affected. Users are advised to upgrade to module version 3.16.4. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/202ecommerce/paypal/commit/2f6884ea1d0fe4b58441699fcc1d6c56c7d733eb; https://github.com/202ecommerce/paypal/security/advisories/GHSA-66pc-8gh8-mx7m; https://github.com/202ecommerce/paypal/commit/2f6884ea1d0fe4b58441699fcc1d6c56c7d733eb
CVE: CVE-2023-23594
Published: 2023-03-31
Description: An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remote unauthenticated attackers with access to execute commands intended only for valid/authenticated users, such as file uploads and configuration changes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://d2n1rly8br52rx.cloudfront.net/content-blocks/files/pages/Vulnerability-Disclosure.pdf; https://hackandpwn.com/disclosures/CVE-2023-23594.pdf; https://www.satoamerica.com/products/printers/industrial-thermal-printers/cl4nx-plus
CVE: CVE-2023-26925
Published: 2023-03-31
Description: An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-882 1.30. A specially crafted network request can lead to the disclosure of sensitive information.
CVSS Score: 7.5 (HIGH)
References: https://github.com/laotun-s/POC/blob/main/CVE-2023-26925.txt; https://www.dlink.com/en/security-bulletin/; https://github.com/laotun-s/POC/blob/main/CVE-2023-26925.txt
CVE: CVE-2023-27159
Published: 2023-03-31
Description: Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: http://appwrite.com; https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a; https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb
CVE: CVE-2023-27160
Published: 2023-03-31
Description: forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /articles/{id}. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918, CWE-918
References: http://forem.com; https://gist.github.com/b33t1e/[PII_REDACTED]a4486b5888f3cbbdc6316d; https://github.com/forem/forem
CVE: CVE-2023-29137
Published: 2023-03-31
Description: An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The UserImpactHandler for GrowthExperiments inadvertently returns the timezone preference for arbitrary users, which can be used to de-anonymize users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://phabricator.wikimedia.org/T328643; https://phabricator.wikimedia.org/T328643
CVE: CVE-2023-29139
Published: 2023-03-31
Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissions makes many CheckUserLog API requests in some configurations, denial of service can occur (RequestTimeoutException or upstream request timeout).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://phabricator.wikimedia.org/T326293; https://phabricator.wikimedia.org/T326293; https://phabricator.wikimedia.org/T326293
CVE: CVE-2023-29140
Published: 2023-03-31
Description: An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see edits for which the username has been hidden, because there is no check for rev_deleted.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://phabricator.wikimedia.org/T327613; https://phabricator.wikimedia.org/T327613
CVE: CVE-2023-29141
Published: 2023-03-31
Description: An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_39/RELEASE-NOTES-1.39; https://lists.debian.org/debian-lts-announce/2023/08/msg00029.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONWHGOBFD6CQAEGOP5O375XAP2N6RUHT/
CVE: CVE-2022-4899
Published: 2023-03-31
Description: A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400, CWE-400
References: https://github.com/facebook/zstd/issues/3200; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/
CVE: CVE-2023-1784
Published: 2023-03-31
Description: A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224699.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://note.youdao.com/ynoteshare/index.html?id=7eb8fc804ea3544d8add43749a09173e; https://vuldb.com/?ctiid.224699; https://vuldb.com/?id.224699
CVE: CVE-2023-1785
Published: 2023-03-31
Description: A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as critical. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-224700.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/web-zxl/img/blob/main/4.png; https://vuldb.com/?ctiid.224700; https://vuldb.com/?id.224700
CVE: CVE-2023-26858
Published: 2023-03-31
Description: SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxGenerateBudget component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/en/faq-frequently-asked-questions/16036-frequently-asked-questions-faq-page.html; https://friends-of-presta.github.io/security-advisories/modules/2023/03/28/faqs.html; https://addons.prestashop.com/en/faq-frequently-asked-questions/16036-frequently-asked-questions-faq-page.html
CVE: CVE-2023-27162
Published: 2023-03-31
Description: openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918, CWE-918
References: http://openapi-generator.com; https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08; https://github.com/OpenAPITools/openapi-generator
CVE: CVE-2023-27163
Published: 2023-03-31
Description: request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html; http://packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html; http://request-baskets.com
CVE: CVE-2022-46021
Published: 2023-03-31
Description: X-Man 1.0 has a SQL injection vulnerability, which can cause data leakage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Howard512966/x-man-injection; https://github.com/Howard512966/x-man-injection/blob/main/README.md; https://github.com/Howard512966/x-man-injection
CVE: CVE-2022-47188
Published: 2023-03-31
Description: There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-59
References: https://www.generex.de/support/changelogs/cs141/2-12; https://www.generex.de/support/changelogs/cs141/page:2; https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141
CVE: CVE-2022-47189
Published: 2023-03-31
Description: Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.generex.de/support/changelogs/cs141/2-12; https://www.generex.de/support/changelogs/cs141/page:2; https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141
CVE: CVE-2022-47190
Published: 2023-03-31
Description: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20, CWE-434
References: https://www.generex.de/support/changelogs/cs141/2-12; https://www.generex.de/support/changelogs/cs141/page:2; https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141
CVE: CVE-2022-47191
Published: 2023-03-31
Description: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-434
References: https://www.generex.de/support/changelogs/cs141/2-12; https://www.generex.de/support/changelogs/cs141/page:2; https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141
CVE: CVE-2022-47192
Published: 2023-03-31
Description: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://www.generex.de/support/changelogs/cs141/2-12; https://www.generex.de/support/changelogs/cs141/page:2; https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141
CVE: CVE-2023-24824
Published: 2023-03-31
Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-407
References: https://github.com/github/cmark-gfm/commit/2300c1bd2c[PII_REDACTED]bf019655c4159cf26b59; https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh; https://github.com/github/cmark-gfm/commit/2300c1bd2c[PII_REDACTED]bf019655c4159cf26b59
CVE: CVE-2023-26485
Published: 2023-03-31
Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.




### Impact

A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.

### Proof of concept

```
$ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext
```

Increasing the number 10000 in the above commands causes the running time to increase quadratically.

### Patches

This vulnerability have been patched in 0.29.0.gfm.10.

### Note on cmark and cmark-gfm

XXX: TBD

[cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`. 

### Credit

We would like to thank @gravypod for reporting this vulnerability.

### References

https://en.wikipedia.org/wiki/Time_complexity

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-407
References: https://github.com/github/cmark-gfm/commit/07a66c9bc341f902878e37d7da8647d6ef150987; https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5; https://github.com/github/cmark-gfm/commit/07a66c9bc341f902878e37d7da8647d6ef150987
CVE: CVE-2023-28645
Published: 2023-03-31
Description: Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app (richdocuments) is upgraded to 8.0.0-beta.1, 7.0.2 or 6.3.2. Users unable to upgrade may mitigate the issue by taking steps to restrict the ability to download documents. This includes ensuring that the `WOPI configuration` is configured to only serve documents between Nextcloud and Collabora. It is highly recommended to define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-284
References: https://docs.nextcloud.com/server/latest/admin_manual/office/configuration.html#wopi-settings; https://github.com/nextcloud/richdocuments/pull/2604; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-95j6-p5cj-5hh5
CVE: CVE-2023-28844
Published: 2023-03-31
Description: Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been addressed in versions 24.0.10 and 25.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w47p-f66h-h2vj; https://github.com/nextcloud/server/pull/36113; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w47p-f66h-h2vj
CVE: CVE-2023-28845
Published: 2023-03-31
Description: Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they themselves are not members. It is recommended that the Nextcloud Talk is upgraded to 14.0.9 or 15.0.4. There are no known workarounds for this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m6r-479j-4chf; https://github.com/nextcloud/spreed/pull/8651; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m6r-479j-4chf
CVE: CVE-2023-1789
Published: 2023-04-01
Description: Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/firefly-iii/firefly-iii/commit/6b05c0fbd3e8c40ae9b24dc[PII_REDACTED]fccf0c5; https://huntr.dev/bounties/2c3489f7-6b84-48f8-9368-9cea67cf373d; https://github.com/firefly-iii/firefly-iii/commit/6b05c0fbd3e8c40ae9b24dc[PII_REDACTED]fccf0c5
CVE: CVE-2023-0208
Published: 2023-04-01
Description: 
NVIDIA DCGM for Linux contains a vulnerability in HostEngine (server component) where a user may cause a heap-based buffer overflow through the bound socket. A successful exploit of this vulnerability may lead to denial of service and data tampering.


CVSS Score: 8.4 (HIGH)
CWE: CWE-122, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5453; https://nvidia.custhelp.com/app/answers/detail/a_id/5453
CVE: CVE-2023-0180
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Linux contains a vulnerability in a kernel mode layer handler, which may lead to denial of service or information disclosure.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0181
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, which may lead to denial of service and data tampering.
CVSS Score: 7.1 (HIGH)
CWE: CWE-280, CWE-276
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0182
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an out-of-bounds write can lead to denial of service, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0183
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an out-of-bounds write can lead to denial of service and data tampering.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0185
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where sign conversion issuescasting an unsigned primitive to signed may lead to denial of service or information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-196, CWE-681
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0186
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an out-of-bounds write can lead to denial of service and data tampering.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0187
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds read can lead to denial of service.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0188
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged user can cause improper restriction of operations within the bounds of a memory buffer cause an out-of-bounds read, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0189
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 8.8 (HIGH)
CWE: CWE-822
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0191
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds access may lead to denial of service or data tampering.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0192
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer handler, where improper privilege management can lead to escalation of privileges and information disclosure.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-269
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0194
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer driver, where an invalid display configuration may lead to denial of service.
CVSS Score: 2.0 (LOW)
CWE: CWE-1284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0195
Published: 2023-04-01
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer driver nvlddmkm.sys, where an can cause CWE-1284,
which may lead to hypothetical Information leak of unimportant data such as local variable data of the driver
CVSS Score: 2.0 (LOW)
CWE: CWE-1284, CWE-1284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE: CVE-2023-0197
Published: 2023-04-01
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious user in a guest VM can cause a NULL-pointer dereference, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5452; https://nvidia.custhelp.com/app/answers/detail/a_id/5452