deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-46732
Published: 2023-11-06
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. The patch in commit `04e325d57` can be manually applied without upgrading (or restarting) the instance. Users are advised to upgrade or to manually apply the patch. There are no known workarounds for this vulnerability.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/04e325d57d4bcb6ab79bddcafbb19032474c2a55; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9rc-w3wv-fv62; https://jira.xwiki.org/browse/XWIKI-21095
CVE: CVE-2022-48192
Published: 2023-11-06
Description: Cross-site Scripting vulnerability in Softing smartLink SW-HT before 1.30, which allows an attacker to execute a dynamic script (JavaScript, VBScript) in the context of the application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-11.html; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-11.json; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-11.html
CVE: CVE-2022-48193
Published: 2023-11-06
Description: Weak ciphers in Softing smartLink SW-HT before 1.30 are enabled during secure communication (SSL).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-11.html; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-11.json; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-11.html
CVE: CVE-2023-5719
Published: 2023-11-06
Description: 
The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. Note that passwords entered via the Crimson system web server do not suffer from this vulnerability.


CVSS Score: 8.8 (HIGH)
CWE: CWE-158
References: https://support.redlion.net/hc/en-us/categories/[PII_REDACTED]71-Security-Advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01; https://support.redlion.net/hc/en-us/categories/[PII_REDACTED]71-Security-Advisories
CVE: CVE-2023-5777
Published: 2023-11-06
Description: 


Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-05
CVE: CVE-2023-4810
Published: 2023-11-06
Description: The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://portswigger.net/web-security/cross-site-scripting/stored; https://wpscan.com/vulnerability/dfde5436-dd5c-4c70-a9c2-3cb85cc99c0a; https://portswigger.net/web-security/cross-site-scripting/stored
CVE: CVE-2023-4858
Published: 2023-11-06
Description: The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/nightcloudos/bug_report/blob/main/vendors/poc2.md; https://wpscan.com/vulnerability/ef8029e0-9282-401a-a77d-10b6656adaa6; https://github.com/nightcloudos/bug_report/blob/main/vendors/poc2.md
CVE: CVE-2023-4930
Published: 2023-11-06
Description: The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://wpscan.com/vulnerability/c73b3276-e6f1-4f22-a888-025e5d0504f2; https://wpscan.com/vulnerability/c73b3276-e6f1-4f22-a888-025e5d0504f2
CVE: CVE-2023-5082
Published: 2023-11-06
Description: The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/13a196ba-49c7-4575-9a49-3ef9eb2348f3; https://wpscan.com/vulnerability/13a196ba-49c7-4575-9a49-3ef9eb2348f3
CVE: CVE-2023-5181
Published: 2023-11-06
Description: The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/564ad2b0-6ba6-4415-98d7-8d41bc1c3d44; https://wpscan.com/vulnerability/564ad2b0-6ba6-4415-98d7-8d41bc1c3d44
CVE: CVE-2023-5228
Published: 2023-11-06
Description: The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/50ae7008-46f0-4f89-ae98-65dcabe4ef09; https://wpscan.com/vulnerability/50ae7008-46f0-4f89-ae98-65dcabe4ef09
CVE: CVE-2023-5352
Published: 2023-11-06
Description: The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not have permission.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-683
References: https://wpscan.com/vulnerability/d32b2136-d923-4f36-bd76-af4578deb23b; https://wpscan.com/vulnerability/d32b2136-d923-4f36-bd76-af4578deb23b
CVE: CVE-2023-5354
Published: 2023-11-06
Description: The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/aa380524-031d-4e49-9d0b-96e62d54557f; https://wpscan.com/vulnerability/aa380524-031d-4e49-9d0b-96e62d54557f
CVE: CVE-2023-5355
Published: 2023-11-06
Description: The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://wpscan.com/vulnerability/d6f7faca-dacf-4455-a[PII_REDACTED]d0f25; https://wpscan.com/vulnerability/d6f7faca-dacf-4455-a[PII_REDACTED]d0f25
CVE: CVE-2023-5454
Published: 2023-11-06
Description: The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://wpscan.com/vulnerability/1854f77f-e12a-4370-9c44-73d16d493685; https://wpscan.com/vulnerability/1854f77f-e12a-4370-9c44-73d16d493685
CVE: CVE-2023-5530
Published: 2023-11-06
Description: The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://ninjaforms.com/blog/saturday-drive-x-edition/; https://wpscan.com/vulnerability/a642f313-cc3e-4d75-b207-1dceb6a7fbae; https://ninjaforms.com/blog/saturday-drive-x-edition/
CVE: CVE-2023-5601
Published: 2023-11-06
Description: The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://wpscan.com/vulnerability/0035ec5e-d405-4eb7-8fe4-29dd0c71e4bc; https://wpscan.com/vulnerability/0035ec5e-d405-4eb7-8fe4-29dd0c71e4bc
CVE: CVE-2023-5605
Published: 2023-11-06
Description: The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9ec03ef0-0c04-4517-b761-df87af722a64; https://wpscan.com/vulnerability/9ec03ef0-0c04-4517-b761-df87af722a64
CVE: CVE-2023-5771
Published: 2023-11-06
Description: Proofpoint Enterprise Protection contains a stored XSS vulnerability in the AdminUI. An unauthenticated attacker can send a specially crafted email with HTML in the subject which triggers XSS when viewing quarantined messages.  This issue affects Proofpoint Enterprise Protection: from 8.20.0 before patch 4796, from 8.18.6 before patch 4795 and all other prior versions.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0010; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0010
CVE: CVE-2023-45556
Published: 2023-11-06
Description: Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Or4ngm4n/Mybb/blob/main/MyBB%201.8.33%20Cross%20Site%20Scripting.txt; https://github.com/mybb/mybb/security/advisories/GHSA-4xqm-3cm2-5xgf; https://raw.githubusercontent.com/Or4ngm4n/Mybb/main/Screenshot%202023-10-08%20012112.png
CVE: CVE-2023-47004
Published: 2023-11-06
Description: Buffer Overflow vulnerability in Redis RedisGraph v.2.x through v.2.12.8 and fixed in v.2.12.9 allows an attacker to execute arbitrary code via the code logic after valid authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-120, CWE-787
References: https://github.com/RedisGraph/RedisGraph/issues/3178; https://github.com/RedisGraph/RedisGraph/issues/3178
CVE: CVE-2023-36769
Published: 2023-11-06
Description: Microsoft OneNote Spoofing Vulnerability
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36769; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36769
CVE: CVE-2023-36409
Published: 2023-11-07
Description: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36409; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36409; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2019-25155
Published: 2023-11-07
Description: DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/cure53/DOMPurify/compare/1.0.10...1.0.11; https://github.com/cure53/DOMPurify/pull/337/files; https://github.com/cure53/DOMPurify/compare/1.0.10...1.0.11
CVE: CVE-2023-2675
Published: 2023-11-07
Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 2023.Q1.1223.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/linagora/twake/commit/0770da3b184b5d5e71fee8251a5847a04c7cb9bc; https://huntr.dev/bounties/474d3b39-1882-4d2c-b8f7-ff9f68f14cee; https://github.com/linagora/twake/commit/0770da3b184b5d5e71fee8251a5847a04c7cb9bc
CVE: CVE-2023-38509
Published: 2023-11-07
Description: XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10.9 and 15.3-rc-1, the mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. This has been patched in XWiki 14.10.9 and XWiki 15.3-rc-1. A workaround is to modify the page `XWiki.LiveTableResultsMacros` following the patch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-402
References: https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0; https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0c; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g9w4-prf3-m25g
CVE: CVE-2023-40453
Published: 2023-11-07
Description: Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administrator into performing an unsafe action (via escape sequence injection), or might have a data size that causes a denial of service to a bastion node. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: https://github.com/docker/machine/releases; https://hackerone.com/reports/1916285; https://vin01.github.io/piptagole/docker/security/gitlab/docker-machine/2023/07/07/docker-machine-attack-surface.html
CVE: CVE-2023-41036
Published: 2023-11-07
Description: Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to vend an interface to another program. What is not made clear in the documentation is that this service can vend this interface to any other program on the machine. The impact of exploitation is a privilege escalation to root - this is likely to affect anyone who is not careful about the software they download and use MacVim to edit files that would require root privileges. Version 178 contains a fix for this issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://github.com/macvim-dev/macvim/blob/d9de087dddadbfd82fcb5dc9734380a2f829bd0a/src/MacVim/MMAppController.h#L28; https://github.com/macvim-dev/macvim/blob/d9de087dddadbfd82fcb5dc9734380a2f829bd0a/src/MacVim/MMBackend.h; https://github.com/macvim-dev/macvim/commit/399b43e9e1dbf656a1780e87344f4d3c875e4cda
CVE: CVE-2023-5748
Published: 2023-11-07
Description: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local users to conduct denial-of-service attacks via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-120
References: https://www.synology.com/en-global/security/advisory/Synology_SA_23_12; https://www.synology.com/en-global/security/advisory/Synology_SA_23_12
CVE: CVE-2023-5900
Published: 2023-11-07
Description: Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.


CVSS Score: 3.5 (LOW)
CWE: CWE-352, CWE-352
References: https://github.com/pkp/pkp-lib/commit/4d77a00be9050fac7eb8d2d1cbedcdaaa1a5a803; https://huntr.com/bounties/c3f011d4-9f76-4b2b-b3d4-a5e2ecd2e354; https://github.com/pkp/pkp-lib/commit/4d77a00be9050fac7eb8d2d1cbedcdaaa1a5a803
CVE: CVE-2023-5901
Published: 2023-11-07
Description: Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.


CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/pkp/pkp-lib/commit/44d8bde60eb2575fd4087b76540aec9b49389e23; https://huntr.com/bounties/8fb9b06b-cadd-469e-862d-5ce026019597; https://github.com/pkp/pkp-lib/commit/44d8bde60eb2575fd4087b76540aec9b49389e23
CVE: CVE-2023-5902
Published: 2023-11-07
Description: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/pkp/pkp-lib/commit/2d04e770d2bbbdd899fdec382fbf2a1d4a4ffec8; https://huntr.com/bounties/8b93c7bf-5052-424a-85cc-7e5491c61f20; https://github.com/pkp/pkp-lib/commit/2d04e770d2bbbdd899fdec382fbf2a1d4a4ffec8
CVE: CVE-2023-5903
Published: 2023-11-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pkp/pkp-lib/commit/8b26ee404af3b11803a40e904f985f0a0b215a5c; https://huntr.com/bounties/5c147ff8-3cc4-4f21-9f1c-13fd50957dad; https://github.com/pkp/pkp-lib/commit/8b26ee404af3b11803a40e904f985f0a0b215a5c
CVE: CVE-2023-5904
Published: 2023-11-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pkp/pkp-lib/commit/aa5c6acb634fbe460765facb2dc26df4b0d7424b; https://huntr.com/bounties/4df6bce6-dbe3-48e4-9830-e95cdc5138b6; https://github.com/pkp/pkp-lib/commit/aa5c6acb634fbe460765facb2dc26df4b0d7424b
CVE: CVE-2023-5976
Published: 2023-11-07
Description: Improper Access Control in GitHub repository microweber/microweber prior to 2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/microweber/microweber/commit/bc537ebe235bf9924c6557a46114f5f9557cd16a; https://huntr.com/bounties/2004e4a9-c5f6-406a-89b0-571f808882fa; https://github.com/microweber/microweber/commit/bc537ebe235bf9924c6557a46114f5f9557cd16a
CVE: CVE-2023-35140
Published: 2023-11-07
Description: The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings on a vulnerable device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-gs1900-series-switches; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-gs1900-series-switches
CVE: CVE-2023-46998
Published: 2023-11-07
Description: Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), confirm(), prompt() functions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/bootboxjs/bootbox/issues/661; https://github.com/soy-oreocato/CVE-2023-46998/; https://github.com/bootboxjs/bootbox/issues/661
CVE: CVE-2019-25156
Published: 2023-11-07
Description: A vulnerability classified as problematic was found in dstar2018 Agency up to 61. Affected by this vulnerability is an unknown functionality of the file search.php. The manipulation of the argument QSType/QuickSearch leads to cross site scripting. The attack can be launched remotely. The patch is named 975b56953efabb434519d9feefcc53685fb8d0ab. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-244495.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/dstar2018/agency-code-repo/commit/975b56953efabb434519d9feefcc53685fb8d0ab; https://vuldb.com/?ctiid.244495; https://vuldb.com/?id.244495
CVE: CVE-2023-21671
Published: 2023-11-07
Description: Memory Corruption in Core during syscall for Sectools Fuse comparison feature.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-22388
Published: 2023-11-07
Description: Memory Corruption in Multi-mode Call Processor while processing bit mask API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-823, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-24852
Published: 2023-11-07
Description: Memory Corruption in Core due to secure memory access by user while loading modem image.
CVSS Score: 8.4 (HIGH)
CWE: CWE-287, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-28545
Published: 2023-11-07
Description: Memory corruption in TZ Secure OS while loading an app ELF.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-28553
Published: 2023-11-07
Description: Information Disclosure in WLAN Host when processing WMI event command.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-28554
Published: 2023-11-07
Description: Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-28556
Published: 2023-11-07
Description: Cryptographic issue in HLOS during key management.
CVSS Score: 7.1 (HIGH)
CWE: CWE-285
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-28563
Published: 2023-11-07
Description: Information disclosure in IOE Firmware while handling WMI command.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-28566
Published: 2023-11-07
Description: Information disclosure in WLAN HAL while handling the WMI state info command.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin
CVE: CVE-2023-28568
Published: 2023-11-07
Description: Information disclosure in WLAN HAL when reception status handler is called.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin