deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-43470
Published: 2023-09-23
Description: SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/ae6e361b/1ed56fbfbbfd368835b8a8089f8ee64a; https://github.com/ae6e361b/Online-Voting-System; https://www.sourcecodester.com/php/14690/online-voting-system-phpmysqli-full-source-code.html
CVE: CVE-2023-5125
Published: 2023-09-23
Description: The Contact Form by FormGet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formget' shortcode in versions up to, and including, 5.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/formget-contact-form/trunk/index.php?rev=2145639#L504; https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd73289-f292-4903-951e-6a89049d39a7?source=cve; https://plugins.trac.wordpress.org/browser/formget-contact-form/trunk/index.php?rev=2145639#L504
CVE: CVE-2023-5134
Published: 2023-09-23
Description: The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive user meta.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/easy-registration-forms/tags/2.1.1/includes/class-user.php#L835; https://www.wordfence.com/threat-intel/vulnerabilities/id/562fe11f-36a0-4f23-9eed-50ada7ab2961?source=cve; https://plugins.trac.wordpress.org/browser/easy-registration-forms/tags/2.1.1/includes/class-user.php#L835
CVE: CVE-2022-3962
Published: 2023-09-23
Description: A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: https://access.redhat.com/errata/RHSA-2023:0542; https://access.redhat.com/security/cve/CVE-2022-3962; https://bugzilla.redhat.com/show_bug.cgi?id=2148661
CVE: CVE-2023-1260
Published: 2023-09-24
Description: An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
CVSS Score: 8.0 (HIGH)
CWE: CWE-288
References: https://access.redhat.com/errata/RHSA-2023:3976; https://access.redhat.com/errata/RHSA-2023:4093; https://access.redhat.com/errata/RHSA-2023:4312
CVE: CVE-2023-1625
Published: 2023-09-24
Description: An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.
CVSS Score: 7.4 (HIGH)
CWE: CWE-202
References: https://access.redhat.com/security/cve/CVE-2023-1625; https://bugzilla.redhat.com/show_bug.cgi?id=2181621; https://github.com/openstack/heat/commit/a49526c278e52823080c7f3fcb72785b93fd4dcb
CVE: CVE-2023-1633
Published: 2023-09-24
Description: A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-200, CWE-522
References: https://access.redhat.com/security/cve/CVE-2023-1633; https://bugzilla.redhat.com/show_bug.cgi?id=2181761; https://access.redhat.com/security/cve/CVE-2023-1633
CVE: CVE-2023-1636
Published: 2023-09-24
Description: A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-653
References: https://access.redhat.com/security/cve/CVE-2023-1636; https://bugzilla.redhat.com/show_bug.cgi?id=2181765; https://access.redhat.com/security/cve/CVE-2023-1636
CVE: CVE-2023-5142
Published: 2023-09-24
Description: A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-22, CWE-22
References: https://github.com/CJCniubi666/H3C-ER/blob/main/README.md; https://github.com/yinsel/CVE-H3C-Report; https://vuldb.com/?ctiid.240238
CVE: CVE-2023-5143
Published: 2023-09-24
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 up to 20151231. This issue affects some unknown processing of the file /log/webmailattach.php. The manipulation of the argument table_name leads to an unknown weakness. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240239. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/ggg48966/cve/blob/main/D-LINK%20-DAR-7000_rce_%20webmailattach.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354; https://vuldb.com/?ctiid.240239
CVE: CVE-2023-5144
Published: 2023-09-24
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /sysmanage/updateos.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240240. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_upload_%20changelogo.md; https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_upload_%20updateos.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354
CVE: CVE-2023-5145
Published: 2023-09-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000 up to 20151231 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmanage/licence.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240241 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_upload_%20licence.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354; https://vuldb.com/?ctiid.240241
CVE: CVE-2023-5146
Published: 2023-09-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240242 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_upload_%20updatelib.md; https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_upload_%20updatelib.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354
CVE: CVE-2023-41874
Published: 2023-09-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin <= 3.20.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/order-delivery-date-for-woocommerce/wordpress-order-delivery-date-for-woocommerce-plugin-3-20-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/order-delivery-date-for-woocommerce/wordpress-order-delivery-date-for-woocommerce-plugin-3-20-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41948
Published: 2023-09-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christoph Rado Cookie Notice & Consent plugin <= 1.6.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cookie-notice-consent/wordpress-cookie-notice-consent-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cookie-notice-consent/wordpress-cookie-notice-consent-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41949
Published: 2023-09-25
Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Avirtum iFolders plugin <= 1.5.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ifolders/wordpress-ifolders-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ifolders/wordpress-ifolders-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5147
Published: 2023-09-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been classified as critical. This affects an unknown part of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240243. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_upload_%20updateos.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354; https://vuldb.com/?ctiid.240243
CVE: CVE-2023-5148
Published: 2023-09-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240244. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_upload_%20uploadfile.md; https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_upload_%20uploadfile.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354
CVE: CVE-2023-5149
Published: 2023-09-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been rated as critical. This issue affects some unknown processing of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240245 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_upload_%20userattestation.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354; https://vuldb.com/?ctiid.240245
CVE: CVE-2023-41872
Published: 2023-09-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xtemos WoodMart plugin <= 7.2.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woodmart/wordpress-woodmart-theme-7-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woodmart/wordpress-woodmart-theme-7-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5150
Published: 2023-09-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /useratte/web.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-240246 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_upload_%20web.md; https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_upload_%20web.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354
CVE: CVE-2023-5151
Published: 2023-09-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknown functionality of the file /autheditpwd.php. The manipulation of the argument hid_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240247. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_sql_%20autheditpwd.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354; https://vuldb.com/?ctiid.240247
CVE: CVE-2023-5152
Published: 2023-09-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation of the argument sql leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240248. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_sql_%20importexport.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354; https://vuldb.com/?ctiid.240248
CVE: CVE-2023-5153
Published: 2023-09-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231. This affects an unknown part of the file /Tool/querysql.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240249 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_sql_%20querysql.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354; https://vuldb.com/?ctiid.240249
CVE: CVE-2023-5154
Published: 2023-09-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-8000 up to 20151231 and classified as critical. This vulnerability affects unknown code of the file /sysmanage/changelogo.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-240250 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_upload_%20changelogo.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354; https://vuldb.com/?ctiid.240250
CVE: CVE-2015-6964
Published: 2023-09-25
Description: MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. (Attackers cannot realistically steal these fees for themselves.) This occurs because there is no message authentication code (MAC).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-697, CWE-697
References: https://web.archive.org/web/[PII_REDACTED]5434/https://multibit.org/blog/2015/07/25/bit-flipping-attack.html; https://web.archive.org/web/[PII_REDACTED]5434/https://multibit.org/blog/2015/07/25/bit-flipping-attack.html
CVE: CVE-2023-39407
Published: 2023-09-25
Description: The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-[PII_REDACTED]
CVE: CVE-2023-39408
Published: 2023-09-25
Description: DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/9/
CVE: CVE-2023-39409
Published: 2023-09-25
Description: DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/9/
CVE: CVE-2023-41294
Published: 2023-09-25
Description: The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-400
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-[PII_REDACTED]
CVE: CVE-2023-41295
Published: 2023-09-25
Description: Vulnerability of improper permission management in the displayengine module. Successful exploitation of this vulnerability may cause the screen to turn dim.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-41296
Published: 2023-09-25
Description: Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect integrity and confidentiality.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://consumer.huawei.com/en/support/bulletin/2023/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/9/
CVE: CVE-2023-41297
Published: 2023-09-25
Description: Vulnerability of defects introduced in the design process in the HiviewTunner module. Successful exploitation of this vulnerability may cause service hijacking.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2023/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/9/
CVE: CVE-2023-41298
Published: 2023-09-25
Description: Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/9/