deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38998
Published: 2023-08-09
Description: An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/opnsense/core/commit/6bc025af1705dcdd8ef22ff5d4fcb986fa4e45f8; https://logicaltrust.net/blog/2023/08/opnsense.html; https://github.com/opnsense/core/commit/6bc025af1705dcdd8ef22ff5d4fcb986fa4e45f8
CVE: CVE-2023-38999
Published: 2023-08-09
Description: A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/opnsense/core/commit/5d68f43d1f[PII_REDACTED]81fc87d885eed120cf3c; https://logicaltrust.net/blog/2023/08/opnsense.html; https://github.com/opnsense/core/commit/5d68f43d1f[PII_REDACTED]81fc87d885eed120cf3c
CVE: CVE-2023-39000
Published: 2023-08-09
Description: A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/opnsense/core/commit/d1f350ce70e477adc86d445f5cda9b24f9ff0168; https://logicaltrust.net/blog/2023/08/opnsense.html; https://github.com/opnsense/core/commit/d1f350ce70e477adc86d445f5cda9b24f9ff0168
CVE: CVE-2023-39001
Published: 2023-08-09
Description: A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/opnsense/core/commit/e800097d0c287bb665f0751a98a67c75ef7b45e5; https://logicaltrust.net/blog/2023/08/opnsense.html; https://github.com/opnsense/core/commit/e800097d0c287bb665f0751a98a67c75ef7b45e5
CVE: CVE-2023-39002
Published: 2023-08-09
Description: A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/opnsense/core/commit/a4f6a8f8d604271f81984cfcbba0471af58e34dc; https://logicaltrust.net/blog/2023/08/opnsense.html; https://github.com/opnsense/core/commit/a4f6a8f8d604271f81984cfcbba0471af58e34dc
CVE: CVE-2023-39003
Published: 2023-08-09
Description: OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: http://opnsense.com; https://logicaltrust.net/blog/2023/08/opnsense.html; http://opnsense.com
CVE: CVE-2023-39004
Published: 2023-08-09
Description: Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://opnsense.com; https://logicaltrust.net/blog/2023/08/opnsense.html; http://opnsense.com
CVE: CVE-2023-39005
Published: 2023-08-09
Description: Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://github.com/opnsense/core/issues/6647; https://logicaltrust.net/blog/2023/08/opnsense.html; https://github.com/opnsense/core/issues/6647
CVE: CVE-2023-39006
Published: 2023-08-09
Description: The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/opnsense/core/commit/1c05a19d9d52c7bfa4ac52114935d9fe76d5d181; https://logicaltrust.net/blog/2023/08/opnsense.html; https://github.com/opnsense/core/commit/1c05a19d9d52c7bfa4ac52114935d9fe76d5d181
CVE: CVE-2023-39007
Published: 2023-08-09
Description: /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/opnsense/core/commit/5edff49db1cd8b5078611e2f542d91c02af2b25c; https://github.com/opnsense/core/compare/23.1.11...23.7; https://logicaltrust.net/blog/2023/08/opnsense.html
CVE: CVE-2023-39008
Published: 2023-08-09
Description: A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/opnsense/core/commit/e800097d0c287bb665f0751a98a67c75ef7b45e5; https://logicaltrust.net/blog/2023/08/opnsense.html; https://github.com/opnsense/core/commit/e800097d0c287bb665f0751a98a67c75ef7b45e5
CVE: CVE-2023-23347
Published: 2023-08-09
Description: HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm.  An attacker can potentially compromise the confidentiality and integrity of sensitive information.

CVSS Score: 6.4 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106674; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106674
CVE: CVE-2023-33468
Published: 2023-08-09
Description: KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical screen.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: http://kramerav.com; https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2023-33468; http://kramerav.com
CVE: CVE-2023-33469
Published: 2023-08-09
Description: In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 can be exploited to achieve local code execution at the root level.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://kramerav.com; https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2023-33469; http://kramerav.com
CVE: CVE-2023-37068
Published: 2023-08-09
Description: Code-Projects Gym Management System V1.0 allows remote attackers to execute arbitrary SQL commands via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username and password fields, enabling SQL Injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Mr-Secure-Code/My-CVE/blob/main/CVE-2023-37068-Exploit.md; https://github.com/riteshs4hu/My-CVE/blob/main/CVE-2023-37068-Exploit.md; https://github.com/Mr-Secure-Code/My-CVE/blob/main/CVE-2023-37068-Exploit.md
CVE: CVE-2023-38347
Published: 2023-08-09
Description: An issue was discovered in LWsystems Benno MailArchiv 2.10.1. Attackers can cause XSS via JavaScript content to a mailbox.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sebastianschmitt.eu/security/xss-in-benno-mailarchiv-web-app-benno-rest-lib-cve-2023-38347/; https://wiki.benno-mailarchiv.de/doku.php; https://blog.sebastianschmitt.eu/security/xss-in-benno-mailarchiv-web-app-benno-rest-lib-cve-2023-38347/
CVE: CVE-2023-38348
Published: 2023-08-09
Description: A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://blog.sebastianschmitt.eu/security/xsrf-in-benno-mailarchiv-web-app-benno-web-2-10-2-cve-2023-38348/; https://wiki.benno-mailarchiv.de/doku.php; https://blog.sebastianschmitt.eu/security/xsrf-in-benno-mailarchiv-web-app-benno-web-2-10-2-cve-2023-38348/
CVE: CVE-2023-33241
Published: 2023-08-09
Description: Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signatures or more fully exfiltrate the other parties' private key shares.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-74
References: https://eprint.iacr.org/2019/114.pdf; https://eprint.iacr.org/2020/540.pdf; https://github.com/fireblocks-labs/mpc-ecdsa-attacks-23
CVE: CVE-2023-33242
Published: 2023-08-09
Description: Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt (256 in total) because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed signature.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-74
References: https://eprint.iacr.org/2017/552.pdf; https://github.com/fireblocks-labs/mpc-ecdsa-attacks-23; https://github.com/fireblocks-labs/zengo-lindell17-exploit-poc
CVE: CVE-2023-35838
Published: 2023-08-09
Description: The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in the blocking of traffic" rather than to only WireGuard.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-610
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015; https://tunnelcrack.mathyvanhoef.com/details.html; https://wireguard.com
CVE: CVE-2023-36671
Published: 2023-08-09
Description: An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel even if this traffic is not generated by the VPN client. This allows an adversary to trick the victim into sending plaintext traffic to the VPN server's IP address and thereby deanonymize the victim. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "ServerIP attack for only traffic to the real IP address of the VPN server" rather than to only Clario.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-319
References: https://clario.co/vpn-for-mac/; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015; https://tunnelcrack.mathyvanhoef.com/details.html
CVE: CVE-2023-36672
Published: 2023-08-09
Description: An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that traffic to the local network is sent in plaintext outside the VPN tunnel even if the local network is using a non-RFC1918 IP subnet. This allows an adversary to trick the victim into sending arbitrary IP traffic in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in leakage of traffic in plaintext" rather than to only Clario.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-319
References: https://clario.co/vpn-for-mac/; https://mullvad.net/de/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure/; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015
CVE: CVE-2023-36673
Published: 2023-08-09
Description: An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel, even if this traffic is not generated by the VPN client, while simultaneously using plaintext DNS to look up the VPN server's IP address. This allows an adversary to trick the victim into sending traffic to arbitrary IP addresses in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "ServerIP attack, combined with DNS spoofing, that can leak traffic to an arbitrary IP address" rather than to only Avira Phantom VPN.
CVSS Score: 7.3 (HIGH)
CWE: CWE-319
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015; https://tunnelcrack.mathyvanhoef.com/details.html; https://www.avira.com/en/free-vpn
CVE: CVE-2023-30654
Published: 2023-08-10
Description: Improper access control vulnerability in SLocationService prior to SMR Aug-2023 Release 1 allows local attacker to update fake location.
CVSS Score: 6.7 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30679
Published: 2023-08-10
Description: Improper access control in HDCP trustlet prior to SMR Aug-2023 Release 1 allows local attackers to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30680
Published: 2023-08-10
Description: Improper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with privilege.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269, CWE-266
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30681
Published: 2023-08-10
Description: An improper input validation vulnerability within initialize function in HAL VaultKeeper prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds write.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30682
Published: 2023-08-10
Description: Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call silenceRinger API without permission.
CVSS Score: 4.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30683
Published: 2023-08-10
Description: Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call endCall API without permission.
CVSS Score: 4.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30684
Published: 2023-08-10
Description: Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRingingCall API without permission.
CVSS Score: 4.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30685
Published: 2023-08-10
Description: Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakcers to change TTY mode.
CVSS Score: 4.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30686
Published: 2023-08-10
Description: Out-of-bounds Write in ReqDataRaw of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30687
Published: 2023-08-10
Description: Out-of-bounds Write in RmtUimApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30688
Published: 2023-08-10
Description: Out-of-bounds Write in MakeUiccAuthForOem of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30689
Published: 2023-08-10
Description: Out-of-bounds Write in BuildOemEmbmsGetSigStrengthResponse of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30691
Published: 2023-08-10
Description: Parcel mismatch in AuthenticationConfig prior to SMR Aug-2023 Release 1 allows local attacker to privilege escalation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-266
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30693
Published: 2023-08-10
Description: Out-of-bounds Write in DoOemFactorySendFactoryBypassCommand of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30694
Published: 2023-08-10
Description: Out-of-bounds Write in IpcTxPcscTransmitApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30695
Published: 2023-08-10
Description: Out-of-bounds Write vulnerability in SSHDCPAPP TA prior to &quot;SAMSUNG ELECTONICS, CO, LTD. - System Hardware Update - 7/13/2023&quot; in Windows Update for Galaxy book Go, Galaxy book Go 5G, Galaxy book2 Go and Galaxy book2 Pro 360 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08
CVE: CVE-2023-30696
Published: 2023-08-10
Description: An improper input validation in IpcTxGetVerifyAkey in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds write.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30697
Published: 2023-08-10
Description: An improper input validation in IpcTxCfgSetSimlockPayload in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds write.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30698
Published: 2023-08-10
Description: Improper access control vulnerability in TelephonyUI prior to SMR Aug-2023 Release 1 allows local attacker to connect BLE without privilege.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30699
Published: 2023-08-10
Description: Out-of-bounds write vulnerability in parser_hvcC function of libsimba library prior to SMR Aug-2023 Release 1 allows code execution by remote attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30700
Published: 2023-08-10
Description: PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local attackers to access ContentProvider without proper permission.
CVSS Score: 5.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30701
Published: 2023-08-10
Description: PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access.
CVSS Score: 4.7 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=08
CVE: CVE-2023-30702
Published: 2023-08-10
Description: Stack overflow vulnerability in SSHDCPAPP TA prior to &quot;SAMSUNG ELECTONICS, CO, LTD. - System Hardware Update - 7/13/2023&quot; in Windows Update for Galaxy book Go, Galaxy book Go 5G, Galaxy book2 Go and Galaxy book2 Pro 360 allows local attacker to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08
CVE: CVE-2023-30703
Published: 2023-08-10
Description: Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information.
CVSS Score: 3.3 (LOW)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08
CVE: CVE-2023-30704
Published: 2023-08-10
Description: Improper Authorization vulnerability in Samsung Internet prior to version 22.0.0.35 allows physical attacker access downloaded files in Secret Mode without user authentication.
CVSS Score: 3.8 (LOW)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08
CVE: CVE-2023-30705
Published: 2023-08-10
Description: Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access privileged content providers as Galaxy Store permission.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=08
CVE: CVE-2023-4276
Published: 2023-08-10
Description: The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abpr_profileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/absolute-privacy/trunk/profile_page.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/f3855e84-b97e-4729-8a48-55f2a2444e2c?source=cve; https://plugins.trac.wordpress.org/browser/absolute-privacy/trunk/profile_page.php