deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-42801
Published: 2023-12-14
Description: Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit f57bd745b4cbed577ea654fad4701bea4d38b44c. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client. Achieving RCE is possible but unlikely, due to stack canaries in use by modern compiler toolchains. The published binaries for official clients Qt, Android, iOS/tvOS, and Embedded are built with stack canaries, but some unofficial clients may not use stack canaries. This vulnerability takes place after the pairing process, so it requires the client to be tricked into pairing to a malicious host. It is not possible to perform using a man-in-the-middle due to public key pinning that takes place during the pairing process. The bug was addressed in commit b2497a3918a6d79808d9fd0c04734786e70d5954.
CVSS Score: 7.6 (HIGH)
CWE: CWE-120
References: https://github.com/moonlight-stream/moonlight-common-c/blob/c1744de06938b5a5c8897a705be1bc6508dc7580/src/Misc.c#L82-L88; https://github.com/moonlight-stream/moonlight-common-c/commit/b2497a3918a6d79808d9fd0c04734786e70d5954; https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c
CVE: CVE-2023-47261
Published: 2023-12-14
Description: Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled.
CVSS Score: 9.8 (CRITICAL)
References: https://h3x0s3.github.io/CVE2023~47261/; https://www.dokmee.com/Support-Learn/Updates-Change-Log; https://h3x0s3.github.io/CVE2023~47261/
CVE: CVE-2023-48671
Published: 2023-12-14
Description: 
Dell vApp Manager, versions prior to 9.2.4.x contain an information disclosure vulnerability. A remote attacker could potentially exploit this vulnerability leading to obtain sensitive information that may aid in further attacks.


CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-solutions-enabler-virtual-appliance-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-solutions-enabler-virtual-appliance-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-48756
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor allows Reflected XSS.This issue affects JetBlocks For Elementor: from n/a through 1.3.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/jet-blocks/wordpress-jetblocks-for-elementor-plugin-1-3-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jet-blocks/wordpress-jetblocks-for-elementor-plugin-1-3-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48767
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raghu Goriya MyTube PlayList allows Reflected XSS.This issue affects MyTube PlayList: from n/a through 2.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/mytube/wordpress-mytube-playlist-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mytube/wordpress-mytube-playlist-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48770
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nima Saberi Aparat allows Stored XSS.This issue affects Aparat: from n/a through 1.7.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/aparat/wordpress-aparat-plugin-1-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/aparat/wordpress-aparat-plugin-1-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48771
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno "Aesqe" Babic File Gallery allows Reflected XSS.This issue affects File Gallery: from n/a through 1.8.5.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/file-gallery/wordpress-file-gallery-plugin-1-8-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/file-gallery/wordpress-file-gallery-plugin-1-8-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48780
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnigmaWeb WP Catalogue allows Stored XSS.This issue affects WP Catalogue: from n/a through 1.7.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-catalogue/wordpress-wp-catalogue-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-catalogue/wordpress-wp-catalogue-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49149
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Currency Converter Calculator allows Stored XSS.This issue affects Currency Converter Calculator: from n/a through 1.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/currency-converter-calculator/wordpress-currency-converter-calculator-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/currency-converter-calculator/wordpress-currency-converter-calculator-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49150
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored XSS.This issue affects Crypto Converter Widget: from n/a through 1.8.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/crypto-converter-widget/wordpress-crypto-converter-widget-plugin-1-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/crypto-converter-widget/wordpress-crypto-converter-widget-plugin-1-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49842
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpexpertsio Rocket Maintenance Mode & Coming Soon Page allows Stored XSS.This issue affects Rocket Maintenance Mode & Coming Soon Page: from n/a through 4.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/rocket-maintenance-mode/wordpress-rocket-maintenance-mode-coming-soon-page-plugin-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rocket-maintenance-mode/wordpress-rocket-maintenance-mode-coming-soon-page-plugin-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49860
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: from n/a through 2.6.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wedevs-project-manager/wordpress-wp-project-manager-plugin-2-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wedevs-project-manager/wordpress-wp-project-manager-plugin-2-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5769
Published: 2023-12-14
Description: 
A vulnerability exists in the webserver that affects the 
RTU500 series product versions listed below. A malicious 
actor could perform cross-site scripting on the webserver 
due to user input being improperly sanitized.



CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000176&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000176&languageCode=en&Preview=true
CVE: CVE-2023-49151
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Calendar Simple Calendar – Google Calendar Plugin allows Stored XSS.This issue affects Simple Calendar – Google Calendar Plugin: from n/a through 3.2.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/google-calendar-events/wordpress-google-calendar-events-plugin-3-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/google-calendar-events/wordpress-google-calendar-events-plugin-3-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49152
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labs64 Credit Tracker allows Stored XSS.This issue affects Credit Tracker: from n/a through 1.1.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/credit-tracker/wordpress-credit-tracker-plugin-1-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/credit-tracker/wordpress-credit-tracker-plugin-1-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-49157
Published: 2023-12-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andreas Münch Multiple Post Passwords allows Stored XSS.This issue affects Multiple Post Passwords: from n/a through 1.1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/multiple-post-passwords/wordpress-multiple-post-passwords-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/multiple-post-passwords/wordpress-multiple-post-passwords-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50269
Published: 2023-12-14
Description: Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.
CVSS Score: 8.6 (HIGH)
CWE: CWE-674
References: http://www.squid-cache.org/Versions/v5/SQUID-2023_10.patch; http://www.squid-cache.org/Versions/v6/SQUID-2023_10.patch; https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3
CVE: CVE-2023-50710
Published: 2023-12-14
Description: Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter. Version 3.11.7 includes the change to fix this issue. As a workaround, avoid using TrieRouter directly.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-94
References: https://github.com/honojs/hono/commit/8e2b6b[PII_REDACTED]3f66d31db4f21b1b1eecc4c8; https://github.com/honojs/hono/releases/tag/v3.11.7; https://github.com/honojs/hono/security/advisories/GHSA-f6gv-hh8j-q8vq
CVE: CVE-2023-6563
Published: 2023-12-14
Description: An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
CVSS Score: 7.7 (HIGH)
CWE: CWE-770, CWE-770
References: https://access.redhat.com/errata/RHSA-2023:7854; https://access.redhat.com/errata/RHSA-2023:7855; https://access.redhat.com/errata/RHSA-2023:7856
CVE: CVE-2023-41151
Published: 2023-12-14
Description: An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wants to send an error packet, while socket is blocked on writing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-400
References: https://industrial.softing.com/fileadmin/psirt/downloads/2023/syt-2023-3.html; https://industrial.softing.com/fileadmin/psirt/downloads/2023/syt-2023-3.html
CVE: CVE-2023-4694
Published: 2023-12-14
Description: Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when sending a SOAP message to the service on TCP port 3911 that contains a body but no header.
CVSS Score: 7.5 (HIGH)
References: https://support.hp.com/us-en/document/ish_9[PII_REDACTED]677-16/hpsbpi03894; https://support.hp.com/us-en/document/ish_9[PII_REDACTED]677-16/hpsbpi03894
CVE: CVE-2023-50017
Published: 2023-12-14
Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/849200701/cms/blob/main/CSRF%20exists%20in%20the%20backup%20and%20restore%20location.md; https://github.com/849200701/cms/blob/main/CSRF%20exists%20in%20the%20backup%20and%20restore%20location.md
CVE: CVE-2023-50713
Published: 2023-12-14
Description: Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17.6 affects users who: authorized an application which requested a 'token write' scope or, using frontend-2, created a Personal Access Token (PAT) with `token write` scope. When creating a new token an agent needs to authorise the request with an existing token (the 'requesting token').  The requesting token is required to have token write scope in order to generate new tokens. However, Speckle server was not verifying that other privileges granted to the new token were not in excess of the privileges of the requesting token. A malicious actor could use a token with only token write scope to subsequently generate further tokens with additional privileges. These privileges would only grant privileges up to the existing privileges of the user. This vulnerability cannot be used to escalate a user's privileges or grant privileges on behalf of other users.

This has been patched as of version 2.17.6. All operators of Speckle servers should upgrade their server to version 2.17.6 or higher. Any users who authorized an application with 'token write' scope, or created a token in frontend-2 with `token write` scope should review existing tokens and permanently revoke any they do not recognize, revoke existing tokens and create new tokens, and review usage of their account for suspicious activity. No known workarounds for this issue exist.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1220
References: https://github.com/specklesystems/speckle-server/commit/3689e1cd58ec4f06abee836af34889d6ce474571; https://github.com/specklesystems/speckle-server/releases/tag/2.17.6; https://github.com/specklesystems/speckle-server/security/advisories/GHSA-xpf3-5q5x-3qwh
CVE: CVE-2023-37457
Published: 2023-12-14
Description: Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca[PII_REDACTED]b515fa5992f01340f7717113fa.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/asterisk/asterisk/commit/a1ca[PII_REDACTED]b515fa5992f01340f7717113fa; https://github.com/asterisk/asterisk/security/advisories/GHSA-98rc-4j27-74hh; https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html
CVE: CVE-2023-45894
Published: 2023-12-14
Description: The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to achieve remote code execution via standard kiosk breakout techniques.
CVSS Score: 10.0 (CRITICAL)
References: https://github.com/Oracle-Security/CVEs/blob/main/Parallels%20Remote%20Server/readme.md; https://github.com/Oracle-Security/CVEs/blob/main/Parallels%20Remote%20Server/readme.md
CVE: CVE-2023-49294
Published: 2023-12-14
Description: Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://github.com/asterisk/asterisk/blob/master/main/manager.c#L3757; https://github.com/asterisk/asterisk/commit/424be345639d75c6cb7d0bd2da5f0f407dbd0bd5; https://github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8f
CVE: CVE-2023-49786
Published: 2023-12-14
Description: Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1; as well as certified-asterisk prior to 18.9-cert6; Asterisk is susceptible to a DoS due to a race condition in the hello handshake phase of the DTLS protocol when handling DTLS-SRTP for media setup. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable Asterisk servers for calls that rely on DTLS-SRTP. Commit d7d7764cb07c8a[PII_REDACTED]02ef93bf62cba05 contains a fix, which is part of versions 18.20.1, 20.5.1, 21.0.1, amd 18.9-cert6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-703, CWE-362
References: http://packetstormsecurity.com/files/176251/Asterisk-20.1.0-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2023/Dec/24; http://www.openwall.com/lists/oss-security/2023/12/15/7
CVE: CVE-2023-50471
Published: 2023-12-14
Description: cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/DaveGamble/cJSON/issues/802; https://lists.debian.org/debian-lts-announce/2023/12/msg00023.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EO4XCUTY3ZMVW4YBG6DBYVS5NSMNP6JY/
CVE: CVE-2023-50472
Published: 2023-12-14
Description: cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/DaveGamble/cJSON/issues/803; https://github.com/DaveGamble/cJSON/issues/803
CVE: CVE-2023-0248
Published: 2023-12-14
Description: An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.


CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-401, CWE-401
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02
CVE: CVE-2023-49342
Published: 2023-12-14
Description: Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-377, CWE-668, CWE-668
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49342; https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-2vfg-p2h9-wg39; https://ubuntu.com/security/notices/USN-6556-1
CVE: CVE-2023-49343
Published: 2023-12-14
Description: Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-337, CWE-668, CWE-335, CWE-668
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49343; https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-27g2-7x65-3cc5; https://ubuntu.com/security/notices/USN-6556-1
CVE: CVE-2023-49344
Published: 2023-12-14
Description: Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-377, CWE-668, CWE-668
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49344; https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-rhwf-6fc9-9jvm; https://ubuntu.com/security/notices/USN-6556-1
CVE: CVE-2023-49345
Published: 2023-12-14
Description: Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-377, CWE-668, CWE-668
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49345; https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-rvhc-rch9-j943; https://ubuntu.com/security/notices/USN-6556-1