deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-21503
Published: 2023-05-04
Description: Potential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-20, CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=05; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=05
CVE: CVE-2023-21504
Published: 2023-05-04
Description: Potential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-20, CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=05; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=05
CVE: CVE-2023-21505
Published: 2023-05-04
Description: Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in sandbox.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05
CVE: CVE-2023-21506
Published: 2023-05-04
Description: Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05
CVE: CVE-2023-21507
Published: 2023-05-04
Description: Out-of-bounds Read vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05
CVE: CVE-2023-21508
Published: 2023-05-04
Description: Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA command in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05
CVE: CVE-2023-21509
Published: 2023-05-04
Description: Out-of-bounds Write vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05
CVE: CVE-2023-21510
Published: 2023-05-04
Description: Out-of-bounds Read vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05
CVE: CVE-2023-21511
Published: 2023-05-04
Description: Out-of-bounds Read vulnerability while processing CMD_COLDWALLET_BTC_SET_PRV_UTXO in bc_core trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=05
CVE: CVE-2023-25289
Published: 2023-05-04
Description: Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1_rtm[PII_REDACTED] 6.1.7601.1.0.65792 in embedded web server, allows attacker to gain sensitive information via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.exploit-db.com/exploits/51142; https://www.exploit-db.com/exploits/51142
CVE: CVE-2023-30216
Published: 2023-05-04
Description: Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/newbee-ltd/newbee-mall/issues/76; https://github.com/newbee-ltd/newbee-mall/issues/76
CVE: CVE-2023-30328
Published: 2023-05-04
Description: An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/rand0mIdas/randomideas/blob/main/ShimoVPN.md; https://raw.githubusercontent.com/rand0mIdas/randomideas/main/ShimoVPN.md?token=GHSAT0AAAAAACA3WX4SPH2YYOCWGV6LLVSGZBIEKEQ; https://github.com/rand0mIdas/randomideas/blob/main/ShimoVPN.md
CVE: CVE-2023-30399
Published: 2023-05-04
Description: Insecure permissions in the settings page of GARO Wallbox GLB/GTB/GTC before v189 allows attackers to redirect users to a crafted update package link via a man-in-the-middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-732, CWE-732
References: http://garocharging.com/glb-wallbox/; https://github.com/Yof3ng/IoT/blob/master/Garo/CVE-2023-30399.md; https://www.garo.se/
CVE: CVE-2023-31413
Published: 2023-05-04
Description: Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logging is enabled.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-532
References: https://discuss.elastic.co/t/elastic-stack-8-7-0-7-17-10-security-updates/332327; https://www.elastic.co/community/security/; https://discuss.elastic.co/t/elastic-stack-8-7-0-7-17-10-security-updates/332327
CVE: CVE-2023-31414
Published: 2023-05-04
Description: Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330; https://www.elastic.co/community/security/; https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330
CVE: CVE-2023-31415
Published: 2023-05-04
Description: Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330; https://www.elastic.co/community/security/; https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330
CVE: CVE-2023-30093
Published: 2023-05-04
Description: A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.edoardoottavianelli.it/CVE-2023-30093/; https://www.youtube.com/watch?v=jZr2JhDd_S8; https://www.edoardoottavianelli.it/CVE-2023-30093/
CVE: CVE-2023-30282
Published: 2023-05-04
Description: PrestaShop scexportcustomers <= 3.6.1 is vulnerable to Incorrect Access Control. Due to a lack of permissions' control, a guest can access exports from the module which can lead to leak of personal information from customer table.
CVSS Score: 7.5 (HIGH)
References: https://friends-of-presta.github.io/security-advisories/modules/2023/05/02/scexportcustomers.html; https://friends-of-presta.github.io/security-advisories/modules/2023/05/02/scexportcustomers.html
CVE: CVE-2023-1894
Published: 2023-05-04
Description: A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://www.puppet.com/security/cve/cve-2023-1894-puppet-server-redos; https://www.puppet.com/security/cve/cve-2023-1894-puppet-server-redos
CVE: CVE-2017-20183
Published: 2023-05-05
Description: A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress. It has been declared as problematic. This vulnerability affects the function print_media_new_panel of the file external-media-without-import.php. The manipulation of the argument url/error/width/height/mime-type leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The patch is identified as 9d2ecd159a6e2e3f710b4f1c28e2714f66502746. It is recommended to upgrade the affected component. VDB-227950 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/zzxiang/external-media-without-import/commit/9d2ecd159a6e2e3f710b4f1c28e2714f66502746; https://github.com/zzxiang/external-media-without-import/releases/tag/v1.0.1; https://vuldb.com/?ctiid.227950
CVE: CVE-2023-2531
Published: 2023-05-05
Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/azuracast/azuracast/commit/bdb23594ad3e0c47c8568ce028a7c244a406cf9d; https://huntr.dev/bounties/20463eb2-0f9d-4ea3-a2c8-93f80e7aca02; https://github.com/azuracast/azuracast/commit/bdb23594ad3e0c47c8568ce028a7c244a406cf9d
CVE: CVE-2023-30122
Published: 2023-05-05
Description: An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/xtxxueyan/bug_report/blob/main/vendors/onetnom23/online-food-ordering-system-v2/RCE-1.md; https://github.com/xtxxueyan/bug_report/blob/main/vendors/onetnom23/online-food-ordering-system-v2/RCE-1.md
CVE: CVE-2023-30135
Published: 2023-05-05
Description: Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/DrizzlingSun/Tenda/blob/main/AC18/8/8.md; https://github.com/DrizzlingSun/Tenda/blob/main/AC18/8/8.md
CVE: CVE-2023-30090
Published: 2023-05-05
Description: Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/xlccccc/vuln/tree/master/Semcms; https://github.com/xlccccc/vuln/tree/master/Semcms
CVE: CVE-2023-32235
Published: 2023-05-05
Description: Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/TryGhost/Ghost/commit/378dd913aa8d0fd0da29b0ffced[PII_REDACTED]b0f; https://github.com/TryGhost/Ghost/compare/v5.42.0...v5.42.1; https://github.com/TryGhost/Ghost/commit/378dd913aa8d0fd0da29b0ffced[PII_REDACTED]b0f
CVE: CVE-2023-28068
Published: 2023-05-05
Description: 
Dell Command Monitor, versions 10.9 and prior, contains an improper folder permission vulnerability. A local authenticated malicious user can potentially exploit this vulnerability leading to privilege escalation by writing to a protected directory when Dell Command Monitor is installed to a non-default path


CVSS Score: 7.3 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.dell.com/support/kbdoc/en-us/000212226/dsa-2023-133; https://www.dell.com/support/kbdoc/en-us/000212226/dsa-2023-133
CVE: CVE-2021-40331
Published: 2023-05-05
Description: An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled
This issue affects Apache Ranger Hive Plugin: from 2.0.0 through 2.3.0. Users are recommended to upgrade to version 2.4.0 or later.



CVSS Score: 8.1 (HIGH)
CWE: CWE-732
References: https://lists.apache.org/thread/s68yls6cnkdmzn1k4hqt50vs6wjvt2rn; https://lists.apache.org/thread/s68yls6cnkdmzn1k4hqt50vs6wjvt2rn
CVE: CVE-2022-45048
Published: 2023-05-05
Description: Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.



CVSS Score: 8.4 (HIGH)
CWE: CWE-74
References: https://lists.apache.org/thread/6rpzwy1smdhr60tsh1ydknn3kdm45bb6; https://lists.apache.org/thread/6rpzwy1smdhr60tsh1ydknn3kdm45bb6
CVE: CVE-2023-2535
Published: 2023-05-05
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-2536
Published: 2023-05-05
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-2537
Published: 2023-05-05
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-2539
Published: 2023-05-05
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-2540
Published: 2023-05-05
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-30242
Published: 2023-05-05
Description: NS-ASG v6.3 was discovered to contain a SQL injection vulnerability via the component /admin/add_ikev2.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://ns-asg.com; https://gist.github.com/nsvizp/ccbc51253a47d79d2bc1ea72e01bdaf6; https://www.netentsec.com/
CVE: CVE-2022-38707
Published: 2023-05-05
Description: IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration.  IBM X-Force ID:  234179.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/234179; https://www.ibm.com/support/pages/node/6983274; https://exchange.xforce.ibmcloud.com/vulnerabilities/234179
CVE: CVE-2023-30013
Published: 2023-05-05
Description: TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/174799/TOTOLINK-Wireless-Routers-Remote-Command-Execution.html; https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/2; http://packetstormsecurity.com/files/174799/TOTOLINK-Wireless-Routers-Remote-Command-Execution.html
CVE: CVE-2023-30243
Published: 2023-05-05
Description: Beijing Netcon NS-ASG Application Security Gateway v6.3 is vulnerable to SQL Injection via TunnelId that allows access to sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: http://ns-asg.com; https://www.netentsec.com/; http://ns-asg.com
CVE: CVE-2022-43919
Published: 2023-05-05
Description: IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow an authenticated attacker with authorization to craft messages to cause a denial of service.  IBM X-Force ID:  241354.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/241354; https://www.ibm.com/support/pages/node/6986559; https://exchange.xforce.ibmcloud.com/vulnerabilities/241354
CVE: CVE-2023-22874
Published: 2023-05-05
Description: IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS are vulnerable to a denial of service attack when processing configuration files.  IBM X-Force ID:  244216.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244216; https://www.ibm.com/support/pages/node/6985901; https://exchange.xforce.ibmcloud.com/vulnerabilities/244216
CVE: CVE-2023-29932
Published: 2023-05-05
Description: llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpOperand.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/llvm/llvm-project/issues/58745; https://github.com/llvm/llvm-project/issues/58745; https://github.com/llvm/llvm-project/issues/58745
CVE: CVE-2023-29933
Published: 2023-05-05
Description: llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/llvm/llvm-project/issues/59442; https://github.com/llvm/llvm-project/issues/59442; https://github.com/llvm/llvm-project/issues/59442
CVE: CVE-2023-29934
Published: 2023-05-05
Description: llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/llvm/llvm-project/issues/59136; https://github.com/llvm/llvm-project/issues/59136; https://github.com/llvm/llvm-project/issues/59136
CVE: CVE-2023-29935
Published: 2023-05-05
Description: llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/llvm/llvm-project/issues/59182; https://github.com/llvm/llvm-project/issues/59182; https://github.com/llvm/llvm-project/issues/59182
CVE: CVE-2023-29939
Published: 2023-05-05
Description: llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv::TargetEnvAttr).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/llvm/llvm-project/issues/59983; https://github.com/llvm/llvm-project/issues/59983; https://github.com/llvm/llvm-project/issues/59983
CVE: CVE-2023-29941
Published: 2023-05-05
Description: llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mlir::sparse_tensor::SortOp>(mlir::sparse_tensor::SortOp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/llvm/llvm-project/issues/59988; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWCCXDZP7H2JNFULSZZWXGAZHZUPN5DS/; https://github.com/llvm/llvm-project/issues/59988
CVE: CVE-2023-29942
Published: 2023-05-05
Description: llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLVM::LLVMVoidType.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/llvm/llvm-project/issues/59990; https://github.com/llvm/llvm-project/issues/59990
CVE: CVE-2023-30053
Published: 2023-05-05
Description: TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/Am1ngl/ttt/tree/main/160; https://github.com/Am1ngl/ttt/tree/main/160
CVE: CVE-2023-30054
Published: 2023-05-05
Description: TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/Am1ngl/ttt/tree/main/161; https://github.com/Am1ngl/ttt/tree/main/161
CVE: CVE-2023-30434
Published: 2023-05-05
Description: IBM Storage Scale (IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through 6.1.6.0) could allow a local user to cause a kernel panic.  IBM X-Force  ID:  252187.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/252187; https://www.ibm.com/support/pages/node/6988363; https://www.ibm.com/support/pages/node/6988365
CVE: CVE-2023-26285
Published: 2023-05-05
Description: IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow a remote attacker to cause a denial of service due to an error processing invalid data.  IBM X-Force ID:  248418.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119, CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248418; https://www.ibm.com/support/pages/node/6986563; https://exchange.xforce.ibmcloud.com/vulnerabilities/248418
CVE: CVE-2023-29659
Published: 2023-05-05
Description: A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://github.com/strukturag/libheif/issues/794; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L/
CVE: CVE-2023-32269
Published: 2023-05-05
Description: An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.11; https://github.com/torvalds/linux/commit/[PII_REDACTED]25fb088ddccbe2783c7f92fdfb6b64; https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.11
CVE: CVE-2020-4914
Published: 2023-05-05
Description: IBM Cloud Pak System Suite 2.3.3.0 through 2.3.3.5 does not invalidate session after logout which could allow a local user to impersonate another user on the system.  IBM X-Force ID:  191290.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191290; https://www.ibm.com/support/pages/node/6967181; https://exchange.xforce.ibmcloud.com/vulnerabilities/191290
CVE: CVE-2022-43866
Published: 2023-05-05
Description: IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  239436.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239436; https://www.ibm.com/support/pages/node/6983534; https://exchange.xforce.ibmcloud.com/vulnerabilities/239436