deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-5309
Published: 2023-11-07
Description: Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations. 

CVSS Score: 6.8 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://www.puppet.com/security/cve/cve-2023-5309-broken-session-management-puppet-enterprise; https://www.puppet.com/security/cve/cve-2023-5309-broken-session-management-puppet-enterprise
CVE: CVE-2023-5998
Published: 2023-11-07
Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/gpac/gpac/commit/db[PII_REDACTED]8fc3bdf03121b0e012373bdebb3e; https://huntr.com/bounties/ea02a231-b688-422b-a881-ef415bcf6113; https://github.com/gpac/gpac/commit/db[PII_REDACTED]8fc3bdf03121b0e012373bdebb3e
CVE: CVE-2023-37835
Published: 2023-11-07
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-45396. Reason: This record is a duplicate of CVE-2023-45396. Notes: All CVE users should reference CVE-2023-45396 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2023-46243
Published: 2023-11-07
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to execute any content with the right of an existing document's content author, provided the user have edit right on it. A crafted URL of the form ` /xwiki/bin/edit//?content=%7B%7Bgroovy%7D%7Dprintln%28%22Hello+from+Groovy%21%22%29%7B%7B%2Fgroovy%7D%7D&xpage=view` can be used to execute arbitrary groovy code on the server. This vulnerability has been patched in XWiki versions 14.10.6 and 15.2RC1. Users are advised to update. There are no known workarounds for this issue. 
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/a0e6ca083b36be6f183b9af33ae735c1e02010f4; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g2qq-c5j9-5w5w; https://jira.xwiki.org/browse/XWIKI-20385
CVE: CVE-2023-4154
Published: 2023-11-07
Description: A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://access.redhat.com/security/cve/CVE-2023-4154; https://bugzilla.redhat.com/show_bug.cgi?id=2241883; https://bugzilla.samba.org/show_bug.cgi?id=15424
CVE: CVE-2023-4956
Published: 2023-11-07
Description: A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected that the config-editor page is vulnerable to clickjacking. This flaw allows an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://access.redhat.com/security/cve/CVE-2023-4956; https://bugzilla.redhat.com/show_bug.cgi?id=2238886; https://access.redhat.com/security/cve/CVE-2023-4956
CVE: CVE-2023-5818
Published: 2023-11-07
Description: The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect nonce validation on the amazonifyOptionsPage() function. This makes it possible for unauthenticated attackers to update the plugins settings, including the Amazon Tracking ID, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/amazonify/trunk/amazonify.php#L142; https://www.wordfence.com/threat-intel/vulnerabilities/id/33f3c466-bdeb-402f-bf34-bc703f35e1e2?source=cve; https://plugins.trac.wordpress.org/browser/amazonify/trunk/amazonify.php#L142
CVE: CVE-2023-5819
Published: 2023-11-07
Description: The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. However, please note that this can also be combined with CVE-2023-5818 for CSRF to XSS.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/amazonify/trunk/amazonify.php#L142; https://wordpress.org/plugins/amazonify/; https://www.wordfence.com/threat-intel/vulnerabilities/id/41adfb58-d79f-40a3-8a7e-f3f08f64659f?source=cve
CVE: CVE-2021-43419
Published: 2023-11-07
Description: An Information Disclosure vulnerability exists in Opay Mobile application 1.5.1.26 and maybe be higher in the logcat app.
CVSS Score: 7.5 (HIGH)
CWE: CWE-778
References: https://github.com/Patrick0x41/Security-Advisories/blob/main/CVE-2021-43419/README.md; https://www.youtube.com/watch?v=HJUj3PgH7Ag; https://github.com/Patrick0x41/Security-Advisories/blob/main/CVE-2021-43419/README.md
CVE: CVE-2023-46676
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46677
Published: 2023-11-07
Description: Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname' parameter of the sign-up.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/netrebko; https://projectworlds.in; https://fluidattacks.com/advisories/netrebko
CVE: CVE-2023-46678
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46679
Published: 2023-11-07
Description: Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname_email' parameter of the index.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/netrebko; https://projectworlds.in; https://fluidattacks.com/advisories/netrebko
CVE: CVE-2023-46680
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46785
Published: 2023-11-07
Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partner_preference.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/ros; https://projectworlds.in; https://fluidattacks.com/advisories/ros
CVE: CVE-2023-46786
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46787
Published: 2023-11-07
Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the auth/auth.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/ros; https://projectworlds.in; https://fluidattacks.com/advisories/ros
CVE: CVE-2023-46788
Published: 2023-11-07
Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter in the 'uploadphoto()' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/ros; https://projectworlds.in; https://fluidattacks.com/advisories/ros
CVE: CVE-2023-46789
Published: 2023-11-07
Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'filename' attribute of the 'pic1' multipart parameter of the functions.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/ros; https://projectworlds.in; https://fluidattacks.com/advisories/ros
CVE: CVE-2023-46790
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-5982
Published: 2023-11-07
Description: The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated attackers to modify the Google Drive location that backups are sent to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can make it possible for attackers to receive backups for a site which may contain sensitive information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/2989669/updraftplus/tags/1.23.11/class-updraftplus.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e1be11c5-0a44-4816-b6bf-d330cb51dbf3?source=cve; https://plugins.trac.wordpress.org/changeset/2989669/updraftplus/tags/1.23.11/class-updraftplus.php
CVE: CVE-2023-42361
Published: 2023-11-07
Description: Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an attacker to view arbitrary files and cause other impacts via use of crafted image during PDF export.
CVSS Score: 7.8 (HIGH)
CWE: CWE-918
References: https://gccybermonks.com/posts/pdfjira/; https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=datacenter; https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=server
CVE: CVE-2023-46001
Published: 2023-11-07
Description: Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/isom_read.c:2807:51 function in gf_isom_get_user_data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/commit/e79b0cf7e[PII_REDACTED]0bc01340e999f3940dbc4; https://github.com/gpac/gpac/issues/2629; https://github.com/gpac/gpac/commit/e79b0cf7e[PII_REDACTED]0bc01340e999f3940dbc4
CVE: CVE-2023-46792
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46793
Published: 2023-11-07
Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'register()' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/ros; https://projectworlds.in; https://fluidattacks.com/advisories/ros
CVE: CVE-2023-46794
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46795
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46796
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46797
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46798
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46799
Published: 2023-11-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-46800
Published: 2023-11-07
Description: Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the view_profile.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/ros; https://projectworlds.in; https://fluidattacks.com/advisories/ros
CVE: CVE-2023-43984
Published: 2023-11-07
Description: Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer table.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://security.friendsofpresta.org/modules/2023/11/07/advancedexport.html; https://security.friendsofpresta.org/modules/2023/11/07/advancedexport.html
CVE: CVE-2023-45380
Published: 2023-11-07
Description: In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can download personal information from ps_customer/ps_address tables such as name / surname / phone number / full postal address.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://security.friendsofpresta.org/modules/2023/11/07/orderduplicate.html; https://security.friendsofpresta.org/modules/2023/11/07/orderduplicate.html
CVE: CVE-2023-6001
Published: 2023-11-08
Description: Prometheus metrics are available without
authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://www.yugabyte.com/; https://www.yugabyte.com/
CVE: CVE-2023-6002
Published: 2023-11-08
Description: YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-117, CWE-79
References: https://www.yugabyte.com/; https://www.yugabyte.com/
CVE: CVE-2023-4061
Published: 2023-11-08
Description: A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2023:5484; https://access.redhat.com/errata/RHSA-2023:5485; https://access.redhat.com/errata/RHSA-2023:5486
CVE: CVE-2023-46768
Published: 2023-11-08
Description: Multi-thread vulnerability in the idmap module. Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46769
Published: 2023-11-08
Description: Use-After-Free (UAF) vulnerability in the dubai module.  Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46770
Published: 2023-11-08
Description: Out-of-bounds vulnerability in the sensor module. Successful exploitation of this vulnerability may cause mistouch prevention errors on users' mobile phones.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-5801
Published: 2023-11-08
Description: Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect integrity and confidentiality.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-290, CWE-290
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-44115
Published: 2023-11-08
Description: Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-41270
Published: 2023-11-08
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Samsung Smart TV UE40D7000 version T-GAPDEUC-1033.2 and before allows attackers to cause a denial of service via WPS attack tools.
CVSS Score: 3.5 (LOW)
CWE: CWE-307, CWE-307
References: https://www.slideshare.net/fuguet/smold-tv-old-smart; https://www.youtube.com/watch?v=MdIT4mPTX3s; https://www.slideshare.net/fuguet/smold-tv-old-smart
CVE: CVE-2023-41111
Published: 2023-11-08
Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920, Modem 5123, Modem 5300, and Auto T5123). Improper handling of a length parameter inconsistency can cause abnormal termination of a mobile phone. This occurs in the RLC task and RLC module.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-41112
Published: 2023-11-08
Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920, Modem 5123, Modem 5300, and Auto T5123). A buffer copy, without checking the size of the input, can cause abnormal termination of a mobile phone. This occurs in the RLC task and RLC module.
CVSS Score: 7.1 (HIGH)
CWE: CWE-120
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-46483
Published: 2023-11-08
Description: Cross Site Scripting vulnerability in timetec AWDMS v.2.0 allows an attacker to obtain sensitive information via a crafted payload to the remark parameter of the New Zone function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/fengniange/TimeTec_Cloud_AWDMS/; https://github.com/fengniange/TimeTec_Cloud_AWDMS/
CVE: CVE-2023-44098
Published: 2023-11-08
Description: Vulnerability of missing encryption in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-311
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46771
Published: 2023-11-08
Description: Security vulnerability in the face unlock module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-5941
Published: 2023-11-08
Description: In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not correctly update FILE objects' write space members for write-buffered streams when the write(2) system call returns an error.  Depending on the nature of an application that calls libc's stdio functions and the presence of errors returned from the write(2) system call (or an overridden stdio write routine) a heap buffer overflow may occur.  Such overflows may lead to data corruption or the execution of arbitrary code at the privilege level of the calling program.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-131, CWE-787, CWE-131, CWE-787
References: https://security.freebsd.org/advisories/FreeBSD-SA-23:15.stdio.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.freebsd.org/advisories/FreeBSD-SA-23:15.stdio.asc
CVE: CVE-2023-5978
Published: 2023-11-08
Description: In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constraints are strictly subsets of the active constraints.  When only a list of resolvable domain names was specified without setting any other limitations, an application could submit a new list of domains including include entries not previously listed.  This could permit the application to resolve domain names that were previously restricted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://security.freebsd.org/advisories/FreeBSD-SA-23:16.cap_net.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.freebsd.org/advisories/FreeBSD-SA-23:16.cap_net.asc
CVE: CVE-2022-48613
Published: 2023-11-08
Description: Race condition vulnerability in the kernel module. Successful exploitation of this vulnerability may cause variable values to be read with the condition evaluation bypassed.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/
CVE: CVE-2023-46755
Published: 2023-11-08
Description: Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerability may cause the launcher to restart.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://consumer.huawei.com/en/support/bulletin/2023/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/11/