deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-34970
Published: 2023-10-03
Description: A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416, CWE-787, CWE-787
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2023-4732
Published: 2023-10-03
Description: A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-366, CWE-362
References: https://access.redhat.com/errata/RHSA-2023:6901; https://access.redhat.com/errata/RHSA-2023:7077; https://access.redhat.com/errata/RHSA-2023:7539
CVE: CVE-2023-4911
Published: 2023-10-03
Description: A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/errata/RHSA-2023:5453; https://access.redhat.com/errata/RHSA-2023:5454; https://access.redhat.com/errata/RHSA-2023:5455
CVE: CVE-2023-5255
Published: 2023-10-03
Description: For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. 
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates; https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates
CVE: CVE-2023-43976
Published: 2023-10-03
Description: An issue in CatoNetworks CatoClient before v.5.4.0 allows attackers to escalate privileges and winning the race condition (TOCTOU) via the PrivilegedHelperTool component.
CVSS Score: 8.1 (HIGH)
CWE: CWE-367
References: https://www.catonetworks.com; https://www.ns-echo.com/posts/cve_2023_43976.html; https://www.catonetworks.com
CVE: CVE-2023-40830
Published: 2023-10-03
Description: Tenda AC6 v15.03.05.19 is vulnerable to Buffer Overflow as the Index parameter does not verify the length.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/BugAlice01/CVE/tree/main/CVE-2023-40830; https://reference1.example.com/goform/WifiWpsOOB
CVE: CVE-2023-33268
Published: 2023-10-03
Description: An issue was discovered in DTS Monitoring 3.57.0. The parameter port within the SSL Certificate check function is vulnerable to OS command injection (blind).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33268.md; https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33268.md
CVE: CVE-2023-33269
Published: 2023-10-03
Description: An issue was discovered in DTS Monitoring 3.57.0. The parameter options within the WGET check function is vulnerable to OS command injection (blind).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33269.md; https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33269.md
CVE: CVE-2023-33270
Published: 2023-10-03
Description: An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the Curl check function is vulnerable to OS command injection (blind).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33270.md; https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33270.md
CVE: CVE-2023-33271
Published: 2023-10-03
Description: An issue was discovered in DTS Monitoring 3.57.0. The parameter common_name within the SSL Certificate check function is vulnerable to OS command injection (blind).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33271.md; https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33271.md
CVE: CVE-2023-33272
Published: 2023-10-03
Description: An issue was discovered in DTS Monitoring 3.57.0. The parameter ip within the Ping check function is vulnerable to OS command injection (blind).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33272.md; https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33272.md
CVE: CVE-2023-33273
Published: 2023-10-03
Description: An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the WGET check function is vulnerable to OS command injection (blind).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33273.md; https://github.com/l4rRyxz/CVE-Disclosures/blob/main/CVE-2023-33273.md
CVE: CVE-2023-39645
Published: 2023-10-03
Description: Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module “Theme Volty CMS Payment Icon” (tvcmspaymenticon) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/09/26/tvcmspaymenticon.html; https://security.friendsofpresta.org/modules/2023/09/26/tvcmspaymenticon.html
CVE: CVE-2023-40519
Published: 2023-10-03
Description: A cross-site scripting (XSS) vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management Auth Agent 01.01.00.19219575_ee9195b0, 01.01.01.30097902_fd999e76, and 00.12.01.9565588_1254b459 allows remote attackers to inject arbitrary web script or HTML via the disconnectMessage parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/munchy-bytes/security-disclosure-of-vulnerabilities-cve-2023-40519-2fc319737dfa; https://medium.com/munchy-bytes/security-disclosure-of-vulnerabilities-cve-2023-40519-2fc319737dfa
CVE: CVE-2023-43176
Published: 2023-10-03
Description: A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://afterlogic.com; http://aurora.com; https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H&version=3.1
CVE: CVE-2023-43898
Published: 2023-10-03
Description: Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted pic file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/nothings/stb/issues/1452; https://github.com/nothings/stb/pull/1454; https://github.com/peccc/null-stb
CVE: CVE-2023-43951
Published: 2023-10-03
Description: SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-43951; https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-43951
CVE: CVE-2023-43952
Published: 2023-10-03
Description: SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-43952; https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-43952
CVE: CVE-2023-43953
Published: 2023-10-03
Description: SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-43953; https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-43953
CVE: CVE-2023-44973
Published: 2023-10-03
Description: An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/yangliukk/emlog/blob/main/Template-getshell.md; https://github.com/yangliukk/emlog/blob/main/Template-getshell.md
CVE: CVE-2023-44974
Published: 2023-10-03
Description: An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/yangliukk/emlog/blob/main/Plugin-getshell.md; https://github.com/yangliukk/emlog/blob/main/Plugin-getshell.md
CVE: CVE-2023-39646
Published: 2023-10-03
Description: Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop. In the module “Theme Volty CMS Category Chain Slide"(tvcmscategorychainslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/09/26/tvcmscategorychainslider.html; https://security.friendsofpresta.org/modules/2023/09/26/tvcmscategorychainslider.html
CVE: CVE-2023-39648
Published: 2023-10-03
Description: Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module “Theme Volty CMS Testimonial” (tvcmstestimonial) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/09/26/tvcmstestimonial.html; https://security.friendsofpresta.org/modules/2023/09/26/tvcmstestimonial.html
CVE: CVE-2023-39649
Published: 2023-10-03
Description: Improper neutralization of SQL parameter in Theme Volty CMS Category Slider module for PrestaShop. In the module “Theme Volty CMS Category Slider” (tvcmscategoryslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/09/26/tvcmscategoryslider.html; https://security.friendsofpresta.org/modules/2023/09/26/tvcmscategoryslider.html
CVE: CVE-2023-39651
Published: 2023-10-03
Description: Improper neutralization of SQL parameter in Theme Volty CMS BrandList module for PrestaShop In the module “Theme Volty CMS BrandList” (tvcmsbrandlist) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/09/26/tvcmsbrandlist.html; https://security.friendsofpresta.org/modules/2023/09/26/tvcmsbrandlist.html
CVE: CVE-2023-39647
Published: 2023-10-03
Description: Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop. In the module “Theme Volty CMS Category Product” (tvcmscategoryproduct) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/09/26/tvcmscategoryproduct.html; https://security.friendsofpresta.org/modules/2023/09/26/tvcmscategoryproduct.html
CVE: CVE-2022-22447
Published: 2023-10-04
Description: IBM Disconnected Log Collector 1.0 through 1.8.2 is vulnerable to potential security misconfigurations that could disclose unintended information.  IBM X-Force ID:  224648.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/224648; https://https://www.ibm.com/support/pages/node/7042313; https://www.ibm.com/support/pages/node/7042313
CVE: CVE-2023-35905
Published: 2023-10-04
Description: IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  259384.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/259384; https://www.ibm.com/support/pages/node/7014389; https://exchange.xforce.ibmcloud.com/vulnerabilities/259384
CVE: CVE-2023-37404
Published: 2023-10-04
Description: IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS poisoning attack.  IBM X-Force ID:  259789.
CVSS Score: 6.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/259789; https://www.ibm.com/support/pages/node/7041863; https://exchange.xforce.ibmcloud.com/vulnerabilities/259789
CVE: CVE-2023-3213
Published: 2023-10-04
Description: The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to disclose potentially sensitive email information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://wpmailsmtp.com/docs/how-to-view-recent-changes-to-the-wp-mail-smtp-plugin-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a813251b-a4c1-4b23-ad03-dcc1f4f19eb9?source=cve; https://wpmailsmtp.com/docs/how-to-view-recent-changes-to-the-wp-mail-smtp-plugin-changelog/
CVE: CVE-2023-5291
Published: 2023-10-04
Description: The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'AWL-BlogFilter' shortcode in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/blog-filter/tags/1.5.3/blog-filter-output.php#L128; https://plugins.trac.wordpress.org/changeset/2974261/blog-filter#file54; https://www.wordfence.com/threat-intel/vulnerabilities/id/b95c1bf7-bb05-44d3-a185-7e38e62b7201?source=cve
CVE: CVE-2023-5357
Published: 2023-10-04
Description: The Instagram for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/instagram-for-wordpress/tags/2.1.6/templates/instagramPost.php#L12; https://www.wordfence.com/threat-intel/vulnerabilities/id/3991d8d0-57a8-42e7-a53c-97508f7e137f?source=cve; https://plugins.trac.wordpress.org/browser/instagram-for-wordpress/tags/2.1.6/templates/instagramPost.php#L12
CVE: CVE-2023-30690
Published: 2023-10-04
Description: Improper input validation vulnerability in Duo prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10
CVE: CVE-2023-30692
Published: 2023-10-04
Description: Improper input validation vulnerability in Evaluator prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities.
CVSS Score: 8.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10
CVE: CVE-2023-30727
Published: 2023-10-04
Description: Improper access control vulnerability in SecSettings prior to SMR Oct-2023 Release 1 allows attackers to enable Wi-Fi and connect arbitrary Wi-Fi without User Interaction.
CVSS Score: 6.7 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10
CVE: CVE-2023-30731
Published: 2023-10-04
Description: Logic error in package installation via debugger command prior to SMR Oct-2023 Release 1 allows physical attacker to install an application that has different build type.
CVSS Score: 5.7 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10
CVE: CVE-2023-30732
Published: 2023-10-04
Description: Improper access control in system property prior to SMR Oct-2023 Release 1 allows local attacker to get CPU serial number.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10
CVE: CVE-2023-30733
Published: 2023-10-04
Description: Stack-based Buffer Overflow in vulnerability HDCP trustlet prior to SMR Oct-2023 Release 1 allows local privileged attackers to perform code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=10
CVE: CVE-2023-30734
Published: 2023-10-04
Description: Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via implicit intent.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10
CVE: CVE-2023-30735
Published: 2023-10-04
Description: Improper Preservation of Permissions vulnerability in SAssistant prior to version 8.7 allows local attackers to access backup data in SAssistant.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-281
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10
CVE: CVE-2023-30736
Published: 2023-10-04
Description: Improper authorization in PushMsgReceiver of Samsung Assistant prior to version 8.7.00.1 allows attacker to execute javascript interface. To trigger this vulnerability, user interaction is required.
CVSS Score: 4.4 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10
CVE: CVE-2023-30737
Published: 2023-10-04
Description: Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via implicit intent.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10
CVE: CVE-2023-30738
Published: 2023-10-04
Description: An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Odyssey allows local attacker to execute SMM memory corruption.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10
CVE: CVE-2023-5368
Published: 2023-10-04
Description: On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated data from the underlying disk device, rather than zero bytes.

This may permit a user with write access to files on a msdosfs filesystem to read unintended data (e.g. from a previously deleted file).


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1188, CWE-1188
References: https://dfir.ru/2023/11/01/bringing-unallocated-data-back-the-fat12-16-32-case/; https://security.FreeBSD.org/advisories/FreeBSD-SA-23:12.msdosfs.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-5369
Published: 2023-10-04
Description: Before correction, the copy_file_range system call checked only for the CAP_READ and CAP_WRITE capabilities on the input and output file descriptors, respectively.  Using an offset is logically equivalent to seeking, and the system call must additionally require the CAP_SEEK capability.

This incorrect privilege check enabled sandboxed processes with only read or write but no seek capability on a file descriptor to read data from or write data to an arbitrary location within the file corresponding to that file descriptor.
CVSS Score: 7.1 (HIGH)
CWE: CWE-273, CWE-273
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-23:13.capsicum.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-23:13.capsicum.asc
CVE: CVE-2023-5370
Published: 2023-10-04
Description: On CPU 0 the check for the SMCCC workaround is called before SMCCC support has been initialized. This resulted in no speculative execution workarounds being installed on CPU 0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665, CWE-665
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-23:14.smccc.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-23:14.smccc.asc
CVE: CVE-2023-44272
Published: 2023-10-04
Description: A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the script may be executed on the web browser of the victim user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://code.citadel.org/citadel/citadel; https://code.citadel.org/citadel/citadel/-/commit/f0dac5ff074ad686fa71ea663c8ead107bd3041e; https://jvn.jp/en/jp/JVN08237727/
CVE: CVE-2023-5375
Published: 2023-10-04
Description: Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/mosparo/mosparo/commit/9d5da367b78b8c883bfef5f332ffea26292f99e8; https://huntr.dev/bounties/3fa2abde-cb58-45a3-a115-1727ece9acb9; https://github.com/mosparo/mosparo/commit/9d5da367b78b8c883bfef5f332ffea26292f99e8
CVE: CVE-2023-5377
Published: 2023-10-04
Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/gpac/gpac/commit/8e9d6b38c036a97020c462ad48e1132e0ddc57ce; https://huntr.dev/bounties/fe778df4-3867-41d6-954b-211c81bccbbf; https://github.com/gpac/gpac/commit/8e9d6b38c036a97020c462ad48e1132e0ddc57ce
CVE: CVE-2023-1584
Published: 2023-10-04
Description: A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2023:3809; https://access.redhat.com/errata/RHSA-2023:7653; https://access.redhat.com/security/cve/CVE-2023-1584