deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4718
Published: 2023-09-02
Description: The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/font-awesome-4-menus/trunk/n9m-font-awesome-4.php?rev=1526295#L197; https://plugins.trac.wordpress.org/browser/font-awesome-4-menus/trunk/n9m-font-awesome-4.php?rev=1526295#L214; https://www.wordfence.com/threat-intel/vulnerabilities/id/dc59510c-6eaf-4526-8acb-c07e39923ad9?source=cve
CVE: CVE-2023-39979
Published: 2023-09-02
Description: There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.  


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-334, CWE-330
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities
CVE: CVE-2023-39980
Published: 2023-09-02
Description: A vulnerability that allows the unauthorized disclosure of authenticated information has been identified in MXsecurity versions prior to v1.0.1. This vulnerability arises when special elements are not neutralized correctly, allowing remote attackers to alter SQL commands.


CVSS Score: 7.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities
CVE: CVE-2023-39981
Published: 2023-09-02
Description: A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authentication measures, potentially leading to the disclosure of device information by a remote attacker.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-287
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities
CVE: CVE-2023-39982
Published: 2023-09-02
Description: A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications at risk on the affected device. This vulnerability is attributed to a hard-coded SSH host key, which might facilitate man-in-the-middle attacks and enable the decryption of SSH traffic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-321, CWE-798
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities
CVE: CVE-2023-39983
Published: 2023-09-02
Description: A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to v1.0.1. This vulnerability might allow an unauthenticated remote attacker to register or add devices via the nsm-web application.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-915, CWE-913
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities
CVE: CVE-2023-4734
Published: 2023-09-02
Description: Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://seclists.org/fulldisclosure/2023/Oct/24; https://github.com/vim/vim/commit/4c6fe2e2ea62469642ed1d80b16d39e616b25cf5; https://huntr.dev/bounties/688e4382-d2b6-439a-a54e-484780f82217
CVE: CVE-2023-4735
Published: 2023-09-02
Description: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Oct/24; https://github.com/vim/vim/commit/889f6af[PII_REDACTED]2e33b233a90e86fd3df0f57; https://huntr.dev/bounties/fc83bde3-f621-42bd-aecb-8c1ae44cba51
CVE: CVE-2023-4736
Published: 2023-09-02
Description: Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://seclists.org/fulldisclosure/2023/Oct/24; https://github.com/vim/vim/commit/816fbcc262687b81fc46f82f7bbeb1453addfe0c; https://huntr.dev/bounties/e1ce0995-4df4-4dec-9cd7-3136ac3e8e71
CVE: CVE-2023-4738
Published: 2023-09-02
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://seclists.org/fulldisclosure/2023/Oct/24; https://github.com/vim/vim/commit/ced2c7394aafdc90fb7845e09b3a3fee23d48cb1; https://huntr.dev/bounties/9fc7dced-a7bb-4479-9718-f956df20f612
CVE: CVE-2023-38387
Published: 2023-09-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Elastic Email Sender plugin <= 1.2.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/elastic-email-sender/wordpress-elastic-email-sender-plugin-1-2-6-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/elastic-email-sender/wordpress-elastic-email-sender-plugin-1-2-6-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-38476
Published: 2023-09-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SuiteDash :: ONE Dashboard® Client Portal : SuiteDash Direct Login plugin <= 1.7.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/client-portal-suitedash-login/wordpress-client-portal-suitedash-direct-login-plugin-1-7-3-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/client-portal-suitedash-login/wordpress-client-portal-suitedash-direct-login-plugin-1-7-3-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-38482
Published: 2023-09-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QualityUnit Post Affiliate Pro plugin <= 1.25.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/postaffiliatepro/wordpress-post-affiliate-pro-plugin-1-24-9-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/postaffiliatepro/wordpress-post-affiliate-pro-plugin-1-24-9-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-38516
Published: 2023-09-03
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <= 1.2.2 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/audio-player-with-playlist-ultimate/wordpress-audio-player-with-playlist-ultimate-plugin-1-2-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/audio-player-with-playlist-ultimate/wordpress-audio-player-with-playlist-ultimate-plugin-1-2-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-38517
Published: 2023-09-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Realwebcare WRC Pricing Tables plugin <= 2.3.7 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wrc-pricing-tables/wordpress-wrc-pricing-tables-plugin-2-3-4-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wrc-pricing-tables/wordpress-wrc-pricing-tables-plugin-2-3-4-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-38518
Published: 2023-09-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Visualmodo Borderless plugin <= 1.4.8 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/borderless/wordpress-borderless-plugin-1-4-7-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/borderless/wordpress-borderless-plugin-1-4-7-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-38521
Published: 2023-09-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Exifography plugin <= 1.3.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/thesography/wordpress-exifography-plugin-1-3-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/thesography/wordpress-exifography-plugin-1-3-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-37220
Published: 2023-09-03
Description: 
Synel Terminals - CWE-494: Download of Code Without Integrity Check


CVSS Score: 7.2 (HIGH)
CWE: CWE-494
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-37221
Published: 2023-09-03
Description: 
7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').


CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-37222
Published: 2023-09-03
Description: 




Farsight Tech Nordic AB ProVide version 14.5 - Multiple XSS vulnerabilities (CWE-79) can be exploited by a user with administrator privilege.




CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-39369
Published: 2023-09-03
Description: 
StarTrinity Softswitch version 2023-02-16 - Multiple Reflected XSS (CWE-79)



CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-39370
Published: 2023-09-03
Description: 


StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79)





CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-39371
Published: 2023-09-03
Description: 


StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601)




CVSS Score: 8.8 (HIGH)
CWE: CWE-601, CWE-601
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-39372
Published: 2023-09-03
Description: 


StarTrinity Softswitch version 2023-02-16 - Multiple CSRF (CWE-352)






CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-39373
Published: 2023-09-03
Description: 
 A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.



CVSS Score: 7.4 (HIGH)
CWE: CWE-294
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-39374
Published: 2023-09-03
Description: 
ForeScout NAC SecureConnector version 11.2 - CWE-427: Uncontrolled Search Path Element



CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-3703
Published: 2023-09-03
Description: 








Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default Credentials
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1392
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2023-41180
Published: 2023-09-03
Description: Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped,  disabling verification by default, when using HTTPS.

Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://lists.apache.org/thread/b51f8csysg1pvgs6xjjrq5hrjrvfot1y; https://lists.apache.org/thread/b51f8csysg1pvgs6xjjrq5hrjrvfot1y
CVE: CVE-2023-4751
Published: 2023-09-03
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://seclists.org/fulldisclosure/2023/Oct/24; https://github.com/vim/vim/commit/e1121b139480f53d1b06f84f3e[PII_REDACTED]fa0b; https://huntr.dev/bounties/db7be8d6-6cb7-4ae5-9c4e-805423afa378
CVE: CVE-2023-4739
Published: 2023-09-03
Description: A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238628. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/Meizhi-hua/cve/blob/main/upload_file.md; https://vuldb.com/?ctiid.238628; https://vuldb.com/?id.238628
CVE: CVE-2023-4740
Published: 2023-09-03
Description: A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the component Delete Draft Handler. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238629 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/RCEraser/cve/blob/main/sql_inject.md; https://vuldb.com/?ctiid.238629; https://vuldb.com/?id.238629
CVE: CVE-2023-4741
Published: 2023-09-03
Description: A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects unknown code of the file ?r=diary/default/del of the component Delete Logs Handler. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-238630 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/wudidike/cve/blob/main/sql.md; https://vuldb.com/?ctiid.238630; https://vuldb.com/?id.238630
CVE: CVE-2023-4742
Published: 2023-09-03
Description: A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/user/export&uid=X. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238631. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/gatsby2003/cve/blob/main/sql.md; https://vuldb.com/?ctiid.238631; https://vuldb.com/?id.238631
CVE: CVE-2023-4743
Published: 2023-09-03
Description: A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238632. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-552
References: https://github.com/FFR66/Dreamer-CMS_Unauthorized-access-vulnerability; https://vuldb.com/?ctiid.238632; https://vuldb.com/?id.238632
CVE: CVE-2023-4744
Published: 2023-09-04
Description: A vulnerability was found in Tenda AC8 16.03.34.06_cn_TDC01. It has been declared as critical. Affected by this vulnerability is the function formSetDeviceName. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238633 was assigned to this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://github.com/GleamingEyes/vul/blob/main/tenda_ac8/ac8_1.md; https://vuldb.com/?ctiid.238633; https://vuldb.com/?id.238633
CVE: CVE-2023-4745
Published: 2023-09-04
Description: A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230822. It has been rated as critical. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-238634 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Jacky-Y/vuls/blob/main/vul6.md; https://vuldb.com/?ctiid.238634; https://vuldb.com/?id.238634
CVE: CVE-2023-4746
Published: 2023-09-04
Description: A vulnerability classified as critical has been found in TOTOLINK N200RE V5 9.3.5u.6437_B20230519. This affects the function Validity_check. The manipulation leads to format string. It is possible to initiate the attack remotely. The root-cause of the vulnerability is a format string issue. But the impact is to bypass the validation which leads to to OS command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238635.
CVSS Score: 8.8 (HIGH)
CWE: CWE-134, CWE-134
References: https://gist.github.com/dmknght/8f3b6aa65e9d08f45b5236c6e9ab8d80; https://vuldb.com/?ctiid.238635; https://vuldb.com/?id.238635
CVE: CVE-2023-4747
Published: 2023-09-04
Description: A vulnerability classified as critical was found in DedeCMS 5.7.110. This vulnerability affects unknown code of the file /uploads/tags.php. The manipulation of the argument tag_alias leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238636.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/laoquanshi/cve; https://github.com/laoquanshi/cve/blob/main/dedecms%20%20sql%20%20injection; https://vuldb.com/?ctiid.238636
CVE: CVE-2023-4749
Published: 2023-09-04
Description: A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238638 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-73
References: https://skypoc.wordpress.com/2023/09/03/%e3%80%90code-audit%e3%80%91open-source-ample-inventory-management-system-v1-0-by-mayuri_k-has-a-file-inclusion-vulnerability/; https://vuldb.com/?ctiid.238638; https://vuldb.com/?id.238638
CVE: CVE-2022-47352
Published: 2023-09-04
Description: In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434
CVE: CVE-2022-47353
Published: 2023-09-04
Description: In vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434
CVE: CVE-2022-48452
Published: 2023-09-04
Description: In Ifaa service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434
CVE: CVE-2022-48453
Published: 2023-09-04
Description: In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434
CVE: CVE-2023-33914
Published: 2023-09-04
Description: In NIA0 algorithm in Security Mode Command, there is a possible missing verification incorrect input. This could lead to remote information disclosure no additional execution privileges needed
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434
CVE: CVE-2023-33915
Published: 2023-09-04
Description: In LTE protocol stack, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434
CVE: CVE-2023-33916
Published: 2023-09-04
Description: In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]53522434