deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-47908
Published: 2023-01-03
Description: Stack-based buffer overflow vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://jvn.jp/en/vu/JVNVU92811888/index.html; https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php; https://jvn.jp/en/vu/JVNVU92811888/index.html
CVE: CVE-2022-43931
Published: 2023-01-03
Description: Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 10.0 (CRITICAL)
References: https://www.synology.com/en-global/security/advisory/Synology_SA_22_26; https://www.synology.com/en-global/security/advisory/Synology_SA_22_26
CVE: CVE-2012-10002
Published: 2023-01-03
Description: A vulnerability was found in ahmyi RivetTracker. It has been declared as problematic. Affected by this vulnerability is the function changeColor of the file css.php. The manipulation of the argument set_css leads to cross site scripting. The attack can be launched remotely. The patch is named 45a0f33876d58cb7e4a0f17da149e58fc893b858. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217267.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/ahmyi/rivettracker/commit/45a0f33876d58cb7e4a0f17da149e58fc893b858; https://github.com/ahmyi/rivettracker/pull/1; https://vuldb.com/?ctiid.217267
CVE: CVE-2015-10012
Published: 2023-01-03
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Resources/views/Security/login.html.twig. The manipulation leads to information exposure through error message. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is abe4993390ba9bd7821ab[PII_REDACTED]645f94c8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217268. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-209
References: https://github.com/sumocoders/FrameworkUserBundle/commit/abe4993390ba9bd7821ab[PII_REDACTED]645f94c8; https://github.com/sumocoders/FrameworkUserBundle/releases/tag/v1.4.0; https://vuldb.com/?ctiid.217268
CVE: CVE-2013-10007
Published: 2023-01-03
Description: A vulnerability classified as problematic has been found in ethitter WP-Print-Friendly up to 0.5.2. This affects an unknown part of the file wp-print-friendly.php. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. Upgrading to version 0.5.3 is able to address this issue. The identifier of the patch is[PII_REDACTED]70c20b4abe20160ebbe8428187f2b4. It is recommended to upgrade the affected component. The identifier VDB-217269 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/ethitter/WP-Print-Friendly/commit/[PII_REDACTED]70c20b4abe20160ebbe8428187f2b4; https://github.com/ethitter/WP-Print-Friendly/pull/4; https://vuldb.com/?ctiid.217269
CVE: CVE-2012-10003
Published: 2023-01-03
Description: A vulnerability, which was classified as problematic, has been found in ahmyi RivetTracker. This issue affects some unknown processing. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The patch is named f053c5cc2bc44269b0496b5f275e349928a92ef9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217271.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/ahmyi/rivettracker/commit/f053c5cc2bc44269b0496b5f275e349928a92ef9; https://github.com/ahmyi/rivettracker/pull/1; https://vuldb.com/?ctiid.217271
CVE: CVE-2022-4871
Published: 2023-01-03
Description: A vulnerability classified as problematic was found in ummmmm nflpick-em.com up to 2.2.x. This vulnerability affects the function _Load_Users of the file html/includes/runtime/admin/JSON/LoadUsers.php. The manipulation of the argument sort leads to sql injection. The attack can be initiated remotely. The patch is identified as dd77a35942f527ea0beef5e0ec62b92e8b93211e. It is recommended to apply a patch to fix this issue. VDB-217270 is the identifier assigned to this vulnerability. NOTE: JSON entrypoint is only accessible via an admin account
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/ummmmm/nflpick-em.com/commit/dd77a35942f527ea0beef5e0ec62b92e8b93211e; https://vuldb.com/?ctiid.217270; https://vuldb.com/?id.217270
CVE: CVE-2022-4663
Published: 2023-01-03
Description: The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site's administrator into uploading a CSV file with the malicious payload.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/members-import/trunk/members-import.php#L113; https://www.wordfence.com/threat-intel/vulnerabilities/id/3abbc407-f660-4b1f-9d48-436320e5fdd7?source=cve; https://plugins.trac.wordpress.org/browser/members-import/trunk/members-import.php#L113
CVE: CVE-2023-0038
Published: 2023-01-03
Description: The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/survey-maker/tags/3.1.4/public/partials/class-survey-maker-submissions-summary-shortcode.php?rev=2839688#L311; https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a58fab-d4a3-4333-8495-e094ed85bb61?source=cve; https://plugins.trac.wordpress.org/browser/survey-maker/tags/3.1.4/public/partials/class-survey-maker-submissions-summary-shortcode.php?rev=2839688#L311
CVE: CVE-2022-38766
Published: 2023-01-03
Description: The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-294, CWE-294
References: https://github.com/AUTOCRYPT-IVS-VnV/CVE-2022-38766; https://github.com/AUTOCRYPT-IVS-VnV/CVE-2022-38766
CVE: CVE-2023-0039
Published: 2023-01-03
Description: Rejected reason: Duplicate. Please use CVE-2022-4060 instead.
CVE: CVE-2021-32821
Published: 2023-01-03
Description: MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expression Denial of Service (ReDoS). An attack requires that an attacker can inject a string into a CSS selector at runtime, which is quite common with e.g. jQuery CSS selectors. No patches are available for this issue.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-400, CWE-1333
References: https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools/; https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools/
CVE: CVE-2022-35845
Published: 2023-01-03
Description: Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-274; https://fortiguard.com/psirt/FG-IR-22-274
CVE: CVE-2022-39947
Published: 2023-01-03
Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.0.4, FortiADC version 5.4.0 through 5.4.5 may allow an attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-061; https://fortiguard.com/psirt/FG-IR-22-061
CVE: CVE-2022-41336
Published: 2023-01-03
Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal versions 6.0.0 through 6.0.11 and all versions of 5.3, 5.2, 5.1, 5.0 management interface may allow a remote authenticated attacker to perform a stored cross site scripting (XSS) attack via sending request with specially crafted columnindex parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-313; https://fortiguard.com/psirt/FG-IR-22-313
CVE: CVE-2022-42471
Published: 2023-01-03
Description: An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-113, CWE-74
References: https://fortiguard.com/psirt/FG-IR-22-250; https://fortiguard.com/psirt/FG-IR-22-250
CVE: CVE-2021-32824
Published: 2023-01-03
Description: Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main service port can be used to access a Telnet Handler which offers some basic methods to collect information about the providers and methods exposed by the service and it can even allow to shutdown the service. This endpoint is unprotected. Additionally, a provider method can be invoked using the `invoke` handler. This handler uses a safe version of FastJson to process the call arguments. However, the resulting list is later processed with `PojoUtils.realize` which can be used to instantiate arbitrary classes and invoke its setters. Even though FastJson is properly protected with a default blocklist, `PojoUtils.realize` is not, and an attacker can leverage that to achieve remote code execution. Versions 2.6.10 and 2.7.10 contain fixes for this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo/; https://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo/
CVE: CVE-2022-45143
Published: 2023-01-03
Description: The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
CVSS Score: 7.5 (HIGH)
CWE: CWE-116, CWE-116
References: https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj; https://security.gentoo.org/glsa/202305-37; https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
CVE: CVE-2023-22456
Published: 2023-01-03
Description: ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. Users should update to at least version 1.2.2 (if they are using a 1.2.x version of ViewVC) or 1.1.29 (if they are using a 1.1.x version).

ViewVC 1.0.x is no longer supported, so users of that release lineage should implement a workaround. Users can edit their ViewVC EZT view templates to manually HTML-escape changed paths during rendering. Locate in your template set's `revision.ezt` file references to those changed paths, and wrap them with `[format "html"]` and `[end]`. For most users, that means that references to `[changes.path]` will become `[format "html"][changes.path][end]`. (This workaround should be reverted after upgrading to a patched version of ViewVC, else changed path names will be doubly escaped.)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/viewvc/viewvc/issues/311; https://github.com/viewvc/viewvc/releases/tag/1.1.29; https://github.com/viewvc/viewvc/releases/tag/1.2.2
CVE: CVE-2022-45867
Published: 2023-01-03
Description: MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/mybb/mybb/security/advisories/GHSA-cpfv-6f8w-759r; https://github.com/mybb/mybb/security/advisories/GHSA-cpfv-6f8w-759r
CVE: CVE-2022-23506
Published: 2023-01-03
Description: Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds.  This can lead to exposure of sensitive AWS credentials in packer log files. Versions 1.29.2, 1.28.4, and 1.27.3 of Rosco contain fixes for this issue.

A workaround is available. It's recommended to use short lived credentials via role assumption and IAM profiles. Additionally, credentials can be set in `/home/spinnaker/.aws/credentials` and `/home/spinnaker/.aws/config` as a volume mount for Rosco pods vs. setting credentials in roscos bake config properties. Last even with those it's recommend to use IAM Roles vs. long lived credentials. This drastically mitigates the risk of credentials exposure. If users have used static credentials, it's recommended to purge any bake logs for AWS, evaluate whether AWS_ACCESS_KEY, SECRET_KEY and/or other sensitive data has been introduced in log files and bake job logs. Then, rotate these credentials and evaluate potential improper use of those credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532
References: https://github.com/spinnaker/rosco/commit/e80cfaa1abfb3a0e9026d45d6027291bfb815daf; https://github.com/spinnaker/spinnaker/security/advisories/GHSA-2233-cqj8-j2q5; https://github.com/spinnaker/rosco/commit/e80cfaa1abfb3a0e9026d45d6027291bfb815daf
CVE: CVE-2022-32623
Published: 2023-01-03
Description: In mdp, there is a possible out of bounds write due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07342114; Issue ID: ALPS07342114.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32635
Published: 2023-01-03
Description: In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07573237; Issue ID: ALPS07573237.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32636
Published: 2023-01-03
Description: In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07510064; Issue ID: ALPS07510064.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32637
Published: 2023-01-03
Description: In hevc decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07491374; Issue ID: ALPS07491374.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32638
Published: 2023-01-03
Description: In isp, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494449; Issue ID: ALPS07494449.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32639
Published: 2023-01-03
Description: In watchdog, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494487; Issue ID: ALPS07494487.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32640
Published: 2023-01-03
Description: In meta wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441652; Issue ID: ALPS07441652.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32641
Published: 2023-01-03
Description: In meta wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07453594; Issue ID: ALPS07453594.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32644
Published: 2023-01-03
Description: In vow, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494473; Issue ID: ALPS07494473.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-662, CWE-662
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32645
Published: 2023-01-03
Description: In vow, there is a possible information disclosure due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494477; Issue ID: ALPS07494477.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-362, CWE-662, CWE-362
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32646
Published: 2023-01-03
Description: In gpu drm, there is a possible stack overflow due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363501; Issue ID: ALPS07363501.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32647
Published: 2023-01-03
Description: In ccu, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07554646; Issue ID: ALPS07554646.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32648
Published: 2023-01-03
Description: In disp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06535964; Issue ID: ALPS06535964.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-662, CWE-662
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32649
Published: 2023-01-03
Description: In jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07225840; Issue ID: ALPS07225840.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-131, CWE-131
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32650
Published: 2023-01-03
Description: In mtk-isp, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07225853; Issue ID: ALPS07225853.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-131, CWE-131
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32651
Published: 2023-01-03
Description: In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07225857; Issue ID: ALPS07225857.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-131, CWE-131
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32652
Published: 2023-01-03
Description: In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262617; Issue ID: ALPS07262617.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023
CVE: CVE-2022-32653
Published: 2023-01-03
Description: In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262518; Issue ID: ALPS07262518.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://corp.mediatek.com/product-security-bulletin/January-2023; https://corp.mediatek.com/product-security-bulletin/January-2023