deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-40437
Published: 2024-01-10
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213841; https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213841
CVE: CVE-2023-40438
Published: 2024-01-10
Description: An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14, iOS 16.7 and iPadOS 16.7. An app may be able to access edited photos saved to a temporary directory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-379
References: https://support.apple.com/en-us/HT213927; https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213927
CVE: CVE-2023-40439
Published: 2024-01-10
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to read sensitive location information.
CVSS Score: 3.3 (LOW)
CWE: CWE-22
References: https://support.apple.com/en-us/HT213841; https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213841
CVE: CVE-2023-40529
Published: 2024-01-10
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17 and iPadOS 17. A person with physical access to a device may be able to use VoiceOver to access private calendar information.
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213938; https://support.apple.com/kb/HT213938
CVE: CVE-2023-41060
Published: 2024-01-10
Description: A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. A remote user may be able to cause kernel code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213938
CVE: CVE-2023-41069
Published: 2024-01-10
Description: This issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17 and iPadOS 17. A 3D model constructed to look like the enrolled user may authenticate via Face ID.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-290
References: https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213938; https://support.apple.com/kb/HT213938
CVE: CVE-2023-41075
Published: 2024-01-10
Description: A type confusion issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213673; https://support.apple.com/en-us/HT213675
CVE: CVE-2023-41974
Published: 2024-01-10
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://support.apple.com/en-us/120949; https://support.apple.com/en-us/126632; https://support.apple.com/en-us/HT213938
CVE: CVE-2023-41987
Published: 2024-01-10
Description: This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940; https://support.apple.com/kb/HT213940
CVE: CVE-2023-41994
Published: 2024-01-10
Description: A logic issue was addressed with improved checks This issue is fixed in macOS Sonoma 14. A camera extension may be able to access the camera view from apps other than the app for which it was granted permission.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940; https://support.apple.com/kb/HT213940
CVE: CVE-2023-42826
Published: 2024-01-10
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940; https://support.apple.com/kb/HT213940
CVE: CVE-2023-42828
Published: 2024-01-10
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.5. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213843
CVE: CVE-2023-42829
Published: 2024-01-10
Description: The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to access SSH passphrases.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213844; https://support.apple.com/en-us/HT213845
CVE: CVE-2023-42830
Published: 2024-01-10
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. An app may be able to read sensitive location information.
CVSS Score: 3.3 (LOW)
CWE: CWE-359
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213676; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-42831
Published: 2024-01-10
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to fingerprint the user.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213842; https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213844
CVE: CVE-2023-42832
Published: 2024-01-10
Description: A race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to gain root privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213844; https://support.apple.com/en-us/HT213845
CVE: CVE-2023-42833
Published: 2024-01-10
Description: A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2024/02/05/8; https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213940
CVE: CVE-2023-42862
Published: 2024-01-10
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. Processing an image may result in disclosure of process memory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213674; https://support.apple.com/en-us/HT213676
CVE: CVE-2023-42865
Published: 2024-01-10
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. Processing an image may result in disclosure of process memory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213674; https://support.apple.com/en-us/HT213676
CVE: CVE-2023-42866
Published: 2024-01-10
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, tvOS 16.6, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
References: https://support.apple.com/en-us/HT213841; https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213846
CVE: CVE-2023-42869
Published: 2024-01-10
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Ventura 13.4, iOS 16.5 and iPadOS 16.5. Multiple issues in libxml2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213757; https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213757
CVE: CVE-2023-42870
Published: 2024-01-10
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213938
CVE: CVE-2023-42871
Published: 2024-01-10
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213938
CVE: CVE-2023-42872
Published: 2024-01-10
Description: The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213938
CVE: CVE-2023-42876
Published: 2024-01-10
Description: The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to a denial-of-service or potentially disclose memory contents.
CVSS Score: 7.1 (HIGH)
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940; https://support.apple.com/kb/HT213940
CVE: CVE-2023-42929
Published: 2024-01-10
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940; https://support.apple.com/kb/HT213940
CVE: CVE-2023-42933
Published: 2024-01-10
Description: This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940; https://support.apple.com/kb/HT213940
CVE: CVE-2023-42934
Published: 2024-01-10
Description: An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app with root privileges may be able to access private information.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213938
CVE: CVE-2023-42941
Published: 2024-01-10
Description: The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker in a privileged network position may be able to perform a denial-of-service attack using crafted Bluetooth packets.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/HT214035; https://support.apple.com/kb/HT214035; https://support.apple.com/en-us/HT214035
CVE: CVE-2023-49295
Published: 2024-01-10
Description: quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-400
References: https://github.com/quic-go/quic-go/commit/17fc98c2d81dbe685c19702dc694a9d606ac56dc; https://github.com/quic-go/quic-go/commit/21609ddfeff93668c7625a85eb09f1541fdad965; https://github.com/quic-go/quic-go/commit/3a9c18bcd27a01c551ac9bf8bd2b4bded77c189a
CVE: CVE-2023-51123
Published: 2024-01-10
Description: An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the service parameter in the soapcgi_main function of the cgibin binary component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/WhereisRain/dir-815; https://github.com/WhereisRain/dir-815/blob/main/README.md; https://github.com/WhereisRain/dir-815
CVE: CVE-2024-0333
Published: 2024-01-10
Description: Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged network position to install a malicious extension via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 5.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_9.html; https://crbug.com/1513379; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BXC7FJIAZRY3P72XC4Z4UOW2QDA7YX7/
CVE: CVE-2024-21638
Published: 2024-01-10
Description: Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.

CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269, CWE-287
References: https://github.com/Azure/ipam/commit/64ef2d07edf16ffa50f29c7e0e25d32d974b367f; https://github.com/Azure/ipam/pull/218; https://github.com/Azure/ipam/security/advisories/GHSA-m8mp-jq4c-g8j6
CVE: CVE-2022-45794
Published: 2024-01-10
Description: An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC internal memory and memory card.

CVSS Score: 8.6 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/; https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-002_en.pdf; https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/
CVE: CVE-2024-21773
Published: 2024-01-11
Description: Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/vu/JVNVU91401812/; https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware; https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware
CVE: CVE-2024-21821
Published: 2024-01-11
Description: Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/vu/JVNVU91401812/; https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware; https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware
CVE: CVE-2024-21833
Published: 2024-01-11
Description: Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/vu/JVNVU91401812/; https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware; https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware
CVE: CVE-2024-21665
Published: 2024-01-11
Description: ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in version 1.0.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/pimcore/ecommerce-framework-bundle/blob/ff6ff287b6eb468bb940909c[PII_REDACTED]6e5c21/src/Controller/AdminOrderController.php#L98; https://github.com/pimcore/ecommerce-framework-bundle/commit/05dec000ed009828084d05cf686f468afd1f464e; https://github.com/pimcore/ecommerce-framework-bundle/releases/tag/v1.0.10
CVE: CVE-2024-21666
Published: 2024-01-11
Description: The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation. An authenticated and unauthorized user can access the list of potential duplicate users and see their data. Permissions are enforced when reaching the `/admin/customermanagementframework/duplicates/list` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. Unauthorized user(s) can access PII data from customers. This vulnerability has been patched in version 4.0.6.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/pimcore/customer-data-framework/blob/b4af625ef327c58d05ef7cdf145fa749d2d4195e/src/Controller/Admin/DuplicatesController.php#L43; https://github.com/pimcore/customer-data-framework/commit/c33c0048390ef0cf98b801d46a81d0762243baa6; https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-c38c-c8mh-vq68
CVE: CVE-2024-21667
Published: 2024-01-11
Description: pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Permissions are not enforced when reaching the `/admin/customermanagementframework/gdpr-data/search-data-objects` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. An unauthorized user can access PII data from customers. This vulnerability has been patched in version 4.0.6.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/pimcore/customer-data-framework/blob/b4af625ef327c58d05ef7cdf145fa749d2d4195e/src/Controller/Admin/GDPRDataController.php#L38; https://github.com/pimcore/customer-data-framework/commit/6c34515be2ba39dceee7da07a1abf246309ccd77; https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-g273-wppx-82w4
CVE: CVE-2023-45173
Published: 2024-01-11
Description: IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the NFS kernel extension to cause a denial of service.  IBM X-Force ID:  267971.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267971; https://www.ibm.com/support/pages/node/7105282; https://exchange.xforce.ibmcloud.com/vulnerabilities/267971
CVE: CVE-2023-45175
Published: 2024-01-11
Description: IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service.  IBM X-Force ID:  267973.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267973; https://www.ibm.com/support/pages/node/7105282; https://exchange.xforce.ibmcloud.com/vulnerabilities/267973
CVE: CVE-2024-22190
Published: 2024-01-11
Description: GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://github.com/gitpython-developers/GitPython/commit/ef3192cc414f2fd[PII_REDACTED]f6fd95243784c7f; https://github.com/gitpython-developers/GitPython/pull/1792; https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx
CVE: CVE-2022-40361
Published: 2024-01-11
Description: Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://elitecrm.co/; https://hazemhussien99.wordpress.com/2024/01/07/cve-2022-40361-disclosure/; https://elitecrm.co/
CVE: CVE-2023-31001
Published: 2024-01-11
Description: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user.  IBM X-Force ID:  254653.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-257
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254653; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-31003
Published: 2024-01-11
Description: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain root access due to improper access controls.  IBM X-Force ID:  254658.
CVSS Score: 8.4 (HIGH)
CWE: CWE-59, CWE-59
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254658; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-38267
Published: 2024-01-11
Description: IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed.  IBM X-Force ID:  260584.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260584; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-45169
Published: 2024-01-11
Description: IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the pmsvcs kernel extension to cause a denial of service.  IBM X-Force ID:  267967.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267967; https://www.ibm.com/support/pages/node/7105282; https://exchange.xforce.ibmcloud.com/vulnerabilities/267967