deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-47745
Published: 2024-03-03
Description: IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or transmits user credentials in plain clear text which can be read by a local user using a trace command.  IBM X-Force ID:  272638.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/272638; https://www.ibm.com/support/pages/node/7126571; https://exchange.xforce.ibmcloud.com/vulnerabilities/272638
CVE: CVE-2024-27255
Published: 2024-03-03
Description: IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  283905.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/283905; https://www.ibm.com/support/pages/node/7126571; https://exchange.xforce.ibmcloud.com/vulnerabilities/283905
CVE: CVE-2023-43054
Published: 2024-03-03
Description: IBM Engineering Test Management 7.0.2 and 7.0.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  267459.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267459; https://www.ibm.com/support/pages/node/7122399; https://exchange.xforce.ibmcloud.com/vulnerabilities/267459
CVE: CVE-2023-47742
Published: 2024-03-03
Description: IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances.  IBM X-Force ID:  272533.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/272533; https://www.ibm.com/support/pages/node/7129328; https://exchange.xforce.ibmcloud.com/vulnerabilities/272533
CVE: CVE-2024-22355
Published: 2024-03-03
Description: IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.  IBM X-Force ID:  280781.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-521
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/280781; https://www.ibm.com/support/pages/node/7129328; https://exchange.xforce.ibmcloud.com/vulnerabilities/280781
CVE: CVE-2024-2145
Published: 2024-03-03
Description: A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been classified as problematic. Affected is an unknown function of the file /endpoint/update-tracker.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255498 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/Stored%20XSS%20Mobile%20Management%20Store.md; https://vuldb.com/?ctiid.255498; https://vuldb.com/?id.255498
CVE: CVE-2024-0765
Published: 2024-03-03
Description: As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state.

This would require the attacked to be granted explicit access to the system, but they can do this at any role. Additionally, post-download, the data is deleted so no evidence would exist that the exfiltration occured.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/mintplex-labs/anything-llm/commit/08d33cfd8fc47c5052b6ea29597c964a9da641e2; https://huntr.com/bounties/8978ab27-710c-44ce-bfd8-a2ea416dc786; https://github.com/mintplex-labs/anything-llm/commit/08d33cfd8fc47c5052b6ea29597c964a9da641e2
CVE: CVE-2024-2146
Published: 2024-03-03
Description: A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /?p=products. The manipulation of the argument search leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255499.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/Reflected%20XSS%20in%20Mobile%20Management%20Store.md; https://vuldb.com/?ctiid.255499; https://vuldb.com/?id.255499
CVE: CVE-2022-43880
Published: 2024-03-03
Description: IBM QRadar WinCollect Agent 10.0 through 10.1.2 could allow a privileged user to cause a denial of service.  IBM X-Force ID:  240151.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-400, CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240151; https://www.ibm.com/support/pages/node/6980843; https://exchange.xforce.ibmcloud.com/vulnerabilities/240151
CVE: CVE-2023-27291
Published: 2024-03-03
Description: IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 does not encrypt sensitive or critical information before storage or transmission which could allow an attacker to obtain sensitive information.  IBM X-Force ID:  248740.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248740; https://www.ibm.com/support/pages/node/6965458; https://exchange.xforce.ibmcloud.com/vulnerabilities/248740
CVE: CVE-2023-28512
Published: 2024-03-03
Description: IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input validation.  IBM X-Force ID:  250396.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-472
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/250396; https://www.ibm.com/support/pages/node/6965456; https://exchange.xforce.ibmcloud.com/vulnerabilities/250396
CVE: CVE-2024-2147
Published: 2024-03-03
Description: A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255500.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/Sql%20Injection%20Authentication%20Bypass%20in%20Mobile%20Management%20Store.md; https://vuldb.com/?ctiid.255500; https://vuldb.com/?id.255500
CVE: CVE-2024-2148
Published: 2024-03-03
Description: A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255501 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/RCE%20via%20Arbitrary%20File%20Upload%20in%20Mobile%20Management%20Store.md; https://vuldb.com/?ctiid.255501; https://vuldb.com/?id.255501
CVE: CVE-2024-2149
Published: 2024-03-03
Description: A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file settings.php. The manipulation of the argument currency leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-255502 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/JiaDongGao1/CVE_Hunter/blob/main/SQLi-2.md; https://vuldb.com/?ctiid.255502; https://vuldb.com/?id.255502
CVE: CVE-2024-2150
Published: 2024-03-03
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255503.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-73
References: https://github.com/wkeyi0x1/vul-report/blob/main/Insurance%20Management%20System%20PHP%20and%20MySQL/Insurance%20Management%20System%20PHP%20and%20MySQL%20v1.0%20-%20File%20Inclusion.md; https://vuldb.com/?ctiid.255503; https://vuldb.com/?id.255503
CVE: CVE-2019-25210
Published: 2024-03-03
Description: An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD environment whose output is visible to unauthorized persons.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/helm/helm/issues/7275; https://helm.sh/blog/response-cve-2019-25210/; https://www.cncf.io/projects/helm/
CVE: CVE-2024-28084
Published: 2024-03-03
Description: p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact because of initialization issues in situations where parsing of advertised service information fails.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665, CWE-665
References: https://git.kernel.org/pub/scm/network/wireless/iwd.git/commit/?id=52a47c9fd428904de611a90cbf8b223af879684d; https://git.kernel.org/pub/scm/network/wireless/iwd.git/commit/?id=d34b4e16e045142590ed7cb653e01ed0ae5362eb; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KSGT4IZ23CJBOQA3AFYEMBJ5OHFZBMK/
CVE: CVE-2024-28088
Published: 2024-03-04
Description: LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution. (A patch is available as of release 0.1.29 of langchain-core.)
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-31
References: https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.md; https://github.com/langchain-ai/langchain/blob/f96dd[PII_REDACTED]0b713ed7c2e86cbf1ddc2761f/libs/core/langchain_core/utils/loading.py; https://github.com/langchain-ai/langchain/pull/18600
CVE: CVE-2024-2151
Published: 2024-03-04
Description: A vulnerability classified as problematic was found in SourceCodester Online Mobile Management Store 1.0. Affected by this vulnerability is an unknown functionality of the component Product Price Handler. The manipulation of the argument quantity with the input -1 leads to business logic errors. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255583.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/Business%20Logic%20in%20Mobile%20Management%20Store.md; https://vuldb.com/?ctiid.255583; https://vuldb.com/?id.255583
CVE: CVE-2024-2152
Published: 2024-03-04
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Mobile Management Store 1.0. Affected by this issue is some unknown functionality of the file /admin/product/manage_product.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255584.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/SQL%20Injection%20in%20Mobile%20Management%20Store.md; https://vuldb.com/?ctiid.255584; https://vuldb.com/?id.255584
CVE: CVE-2024-2153
Published: 2024-03-04
Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /admin/orders/view_order.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255585 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/SQL%20Injection%20in%20View%20Order%20-%20Mobile%20Management%20Store.md; https://vuldb.com/?ctiid.255585; https://vuldb.com/?id.255585
CVE: CVE-2024-2154
Published: 2024-03-04
Description: A vulnerability has been found in SourceCodester Online Mobile Management Store 1.0 and classified as critical. This vulnerability affects unknown code of the file view_product.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-255586 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/Unauthenticated%20SQL%20Injection%20-%20Mobile%20Management%20Store.md; https://vuldb.com/?ctiid.255586; https://vuldb.com/?id.255586
CVE: CVE-2024-2155
Published: 2024-03-04
Description: A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255587.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-73
References: https://github.com/wkeyi0x1/vul-report/blob/main/Best%20pos%20management%20system%20in%20php/report.md; https://vuldb.com/?ctiid.255587; https://vuldb.com/?id.255587
CVE: CVE-2024-2156
Published: 2024-03-04
Description: A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. Affected is an unknown function of the file admin_class.php. The manipulation of the argument img leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255588.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/wkeyi0x1/vul-report/blob/main/Best%20pos%20management%20system%20in%20php/Report-SQLI-1.md; https://vuldb.com/?ctiid.255588; https://vuldb.com/?id.255588
CVE: CVE-2024-20005
Published: 2024-03-04
Description: In da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08355599; Issue ID: ALPS08355599.
CVSS Score: 8.2 (HIGH)
CWE: CWE-276
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20017
Published: 2024-03-04
Description: In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html; https://blog.sonicwall.com/en-us/2024/09/critical-exploit-in-mediatek-wi-fi-chipsets-zero-click-vulnerability-cve-2024-20017-threatens-routers-and-smartphones/
CVE: CVE-2024-20018
Published: 2024-03-04
Description: In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00348479; Issue ID: MSV-1019.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20019
Published: 2024-03-04
Description: In wlan driver, there is a possible memory leak due to improper input handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00351241; Issue ID: MSV-1173.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20020
Published: 2024-03-04
Description: In OPTEE, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08522504; Issue ID: ALPS08522504.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20022
Published: 2024-03-04
Description: In lk, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08528255; Issue ID: ALPS08528255.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20023
Published: 2024-03-04
Description: In flashc, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541638; Issue ID: ALPS08541638.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20024
Published: 2024-03-04
Description: In flashc, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541635; Issue ID: ALPS08541635.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20025
Published: 2024-03-04
Description: In da, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541686; Issue ID: ALPS08541686.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20026
Published: 2024-03-04
Description: In da, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541632; Issue ID: ALPS08541632.
CVSS Score: 4.2 (MEDIUM)
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20027
Published: 2024-03-04
Description: In da, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541632; Issue ID: ALPS08541633.
CVSS Score: 7.9 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20028
Published: 2024-03-04
Description: In da, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541632; Issue ID: ALPS08541687.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20029
Published: 2024-03-04
Description: In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08477406; Issue ID: MSV-1010.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20030
Published: 2024-03-04
Description: In da, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541632; Issue ID: ALPS08541741.
CVSS Score: 4.4 (MEDIUM)
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20031
Published: 2024-03-04
Description: In da, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541632; Issue ID: ALPS08541742.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20032
Published: 2024-03-04
Description: In aee, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08487630; Issue ID: MSV-1020.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20033
Published: 2024-03-04
Description: In nvram, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08499945; Issue ID: ALPS08499945.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024