deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49289
Published: 2023-12-05
Description: Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 are affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2b; https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-8v6j-gc74-fmpp; https://www.nuget.org/packages/AjaxNetProfessional/
CVE: CVE-2023-49290
Published: 2023-12-05
Description: lestrrat-go/jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. A p2c parameter set too high in JWE's algorithm PBES2-* could lead to a denial of service. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource- intensive. Therefore, if an attacker sets the p2c parameter in JWE to a very large number, it can cause a lot of computational consumption, resulting in a denial of service. This vulnerability has been addressed in commit `64f2a229b` which has been included in release version 1.2.27 and 2.0.18. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/lestrrat-go/jwx/commit/64f2a229b8e18605f47361d292b526bdc4aee01c; https://github.com/lestrrat-go/jwx/security/advisories/GHSA-7f9x-gw85-8grf; https://github.com/lestrrat-go/jwx/commit/64f2a229b8e18605f47361d292b526bdc4aee01c
CVE: CVE-2023-49291
Published: 2023-12-05
Description: tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. As a result an attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions. This vulnerability has been addressed in version 7.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-20
References: https://github.com/tj-actions/branch-names/commit/4923d1ca41f928c24f1c1b3af9daaadfb71e6337; https://github.com/tj-actions/branch-names/commit/6c999acf206f5561e19f46301bb310e9e70d8815; https://github.com/tj-actions/branch-names/commit/726fe9ba5e9da4fcc716223b7994ffd0358af060
CVE: CVE-2023-49292
Published: 2023-12-05
Description: ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/ashutosh1206/Crypton/blob/master/Diffie-Hellman-Key-Exchange/Attack-Invalid-Curve-Point/README.md; https://github.com/ecies/go/commit/c6e775163866d6ea5233eb8ec8530a9122101ebd; https://github.com/ecies/go/releases/tag/v2.0.8
CVE: CVE-2023-5808
Published: 2023-12-05
Description: SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would normally be barred to that specific administrative role.
CVSS Score: 7.6 (HIGH)
CWE: CWE-285, CWE-287
References: https://knowledge.hitachivantara.com/Security/System_Management_Unit_(SMU)_versions_prior_to_14.8.7825.01%2C_used_to_manage_Hitachi_Vantara_NAS_products_are_susceptible_to_unintended_information_disclosure_via_unprivileged_access_to_HNAS_configuration_backup_and_diagnostic_data.; https://knowledge.hitachivantara.com/Security/System_Management_Unit_(SMU)_versions_prior_to_14.8.7825.01%2C_used_to_manage_Hitachi_Vantara_NAS_products_are_susceptible_to_unintended_information_disclosure_via_unprivileged_access_to_HNAS_configuration_backup_and_diagnostic_data.
CVE: CVE-2023-48315
Published: 2023-12-05
Description: Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to ftp and sntp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-825
References: https://github.com/azure-rtos/netxduo/security/advisories/GHSA-rj6h-jjg2-7gf3; https://github.com/azure-rtos/netxduo/security/advisories/GHSA-rj6h-jjg2-7gf3
CVE: CVE-2023-48316
Published: 2023-12-05
Description: Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to snmp, smtp, ftp and dtls in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-825, CWE-787
References: https://github.com/azure-rtos/netxduo/security/advisories/GHSA-3cmf-r288-xhwq; https://github.com/azure-rtos/netxduo/security/advisories/GHSA-3cmf-r288-xhwq
CVE: CVE-2023-48691
Published: 2023-12-05
Description: Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause an out-of-bounds write in Azure RTOS NETX Duo, that could lead to remote code execution. The affected components include process related to IGMP protocol in RTOS v6.2.1 and below. The fix has been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://github.com/azure-rtos/netxduo/security/advisories/GHSA-fwmg-rj6g-w99p; https://github.com/azure-rtos/netxduo/security/advisories/GHSA-fwmg-rj6g-w99p
CVE: CVE-2023-48692
Published: 2023-12-05
Description: Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to icmp, tcp, snmp, dhcp, nat and ftp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-787, CWE-825
References: https://github.com/azure-rtos/netxduo/security/advisories/GHSA-m2rx-243p-9w64; https://github.com/azure-rtos/netxduo/security/advisories/GHSA-m2rx-243p-9w64
CVE: CVE-2023-48693
Published: 2023-12-05
Description:  Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications. An attacker can cause arbitrary read and write due to vulnerability in parameter checking mechanism in Azure RTOS ThreadX, which may lead to privilege escalation. The affected components include RTOS ThreadX v6.2.1 and below. The fixes have been included in ThreadX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.7 (HIGH)
CWE: CWE-20
References: https://github.com/azure-rtos/threadx/security/advisories/GHSA-p7w6-62rq-vrf9; https://github.com/azure-rtos/threadx/security/advisories/GHSA-p7w6-62rq-vrf9
CVE: CVE-2023-48694
Published: 2023-12-05
Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference and type confusion vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host class, related to device linked classes, ASIX, Prolific, SWAR, audio, CDC ECM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-825, CWE-843
References: https://github.com/azure-rtos/usbx/security/advisories/GHSA-qjw8-7w86-44qj; https://github.com/azure-rtos/usbx/security/advisories/GHSA-qjw8-7w86-44qj
CVE: CVE-2023-48695
Published: 2023-12-05
Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to out of bounds write vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host and device classes, related to CDC ECM and RNDIS in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://github.com/azure-rtos/usbx/security/advisories/GHSA-mwj9-rpph-v8wc; https://github.com/azure-rtos/usbx/security/advisories/GHSA-mwj9-rpph-v8wc
CVE: CVE-2023-48696
Published: 2023-12-05
Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include components in host class, related to CDC ACM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-754, CWE-825
References: https://github.com/azure-rtos/usbx/security/advisories/GHSA-h733-98hq-f884; https://github.com/azure-rtos/usbx/security/advisories/GHSA-h733-98hq-f884
CVE: CVE-2023-48697
Published: 2023-12-05
Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to memory buffer and pointer vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in pictbridge and host class, related to PIMA, storage, CDC ACM, ECM, audio, hub in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-476, CWE-787, CWE-825
References: https://github.com/azure-rtos/usbx/security/advisories/GHSA-p2p9-wp2q-wjv4; https://github.com/azure-rtos/usbx/security/advisories/GHSA-p2p9-wp2q-wjv4
CVE: CVE-2023-48698
Published: 2023-12-05
Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host classes, related to device linked classes, GSER and HID in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-754, CWE-825
References: https://github.com/azure-rtos/usbx/security/advisories/GHSA-grhp-f66q-x857; https://github.com/azure-rtos/usbx/security/advisories/GHSA-grhp-f66q-x857
CVE: CVE-2023-21634
Published: 2023-12-05
Description: Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-22383
Published: 2023-12-05
Description: Memory Corruption in camera while installing a fd for a particular DMA buffer.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-22668
Published: 2023-12-05
Description: Memory Corruption in Audio while invoking IOCTLs calls from the user-space.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-28546
Published: 2023-12-05
Description: Memory Corruption in SPS Application while exporting public key in sorter TA.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-28550
Published: 2023-12-05
Description: Memory corruption in MPP performance while accessing DSM watermark using external memory address.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-28551
Published: 2023-12-05
Description: Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-28579
Published: 2023-12-05
Description: Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-28580
Published: 2023-12-05
Description: Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-28585
Published: 2023-12-05
Description: Memory corruption while loading an ELF segment in TEE Kernel.
CVSS Score: 8.2 (HIGH)
CWE: CWE-680, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-28586
Published: 2023-12-05
Description: Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-28587
Published: 2023-12-05
Description: Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-28588
Published: 2023-12-05
Description: Transient DOS in Bluetooth Host while rfc slot allocation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33017
Published: 2023-12-05
Description: Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33018
Published: 2023-12-05
Description: Memory corruption while using the UIM diag command to get the operators name.
CVSS Score: 7.8 (HIGH)
CWE: CWE-680, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33022
Published: 2023-12-05
Description: Memory corruption in HLOS while invoking IOCTL calls from user-space.
CVSS Score: 8.4 (HIGH)
CWE: CWE-680, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33024
Published: 2023-12-05
Description: Memory corruption while sending SMS from AP firmware.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33041
Published: 2023-12-05
Description: Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33042
Published: 2023-12-05
Description: Transient DOS in Modem after RRC Setup message is received.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33043
Published: 2023-12-05
Description: Transient DOS in Modem when a Beam switch request is made with a non-configured BWP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33044
Published: 2023-12-05
Description: Transient DOS in Data modem while handling TLB control messages from the Network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33053
Published: 2023-12-05
Description: Memory corruption in Kernel while parsing metadata.
CVSS Score: 8.4 (HIGH)
CWE: CWE-129, CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33054
Published: 2023-12-05
Description: Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33063
Published: 2023-12-05
Description: Memory corruption in DSP Services during a remote call from HLOS to DSP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33063
CVE: CVE-2023-33070
Published: 2023-12-05
Description: Transient DOS in Automotive OS due to improper authentication to the secure IO calls.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33071
Published: 2023-12-05
Description: Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284, CWE-863
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33079
Published: 2023-12-05
Description: Memory corruption in Audio while running invalid audio recording from ADSP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-823, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33080
Published: 2023-12-05
Description: Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33081
Published: 2023-12-05
Description: Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33082
Published: 2023-12-05
Description: Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33083
Published: 2023-12-05
Description: Memory corruption in WLAN Host while processing RRM beacon on the AP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33087
Published: 2023-12-05
Description: Memory corruption in Core while processing RX intent request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin
CVE: CVE-2023-33088
Published: 2023-12-05
Description: Memory corruption when processing cmd parameters while parsing vdev.
CVSS Score: 8.4 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin