deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-31139
Published: 2023-05-09
Description: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access restrictions (for example, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.37.9.1, 2.38.3.1, or 2.39.1.2. Implementers can work around this issue by adding extra access control validations on a reverse proxy.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-613
References: https://github.com/dhis2/dhis2-core/security/advisories/GHSA-44g3-9mp4-prv3; https://github.com/dhis2/dhis2-releases/blob/master/releases/2.37/ReleaseNote-2.37.9.1.md; https://github.com/dhis2/dhis2-releases/blob/master/releases/2.38/ReleaseNote-2.38.3.1.md
CVE: CVE-2023-31143
Published: 2023-05-09
Description: mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-306
References: https://github.com/mage-ai/mage-ai/commit/f63cd00f6a3be372397d37a4c9a49bfaf50d7650; https://github.com/mage-ai/mage-ai/security/advisories/GHSA-c6mm-2g84-v4m7; https://github.com/mage-ai/mage-ai/commit/f63cd00f6a3be372397d37a4c9a49bfaf50d7650
CVE: CVE-2023-32060
Published: 2023-05-09
Description: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker program events or program stages, the `/trackedEntityInstances` and `/events` API endpoints may include all events regardless of the sharing settings applied to the category option combinations. When this specific configuration is present, users may have access to events which they should not be able to see based on the sharing settings of the category options.  The events will not appear in the user interface for web-based Tracker Capture or Capture applications, but if the Android Capture App is used they will be displayed to the user. Versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0 contain a fix for this issue. No workaround is known.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-863, CWE-863
References: https://github.com/dhis2/dhis2-core/security/advisories/GHSA-7pwm-6rh2-2388; https://github.com/dhis2/dhis2-core/security/advisories/GHSA-7pwm-6rh2-2388
CVE: CVE-2020-18280
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Phodal CMD v.1.0 allows a local attacker to execute arbitrary code via the EMBED SRC function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/phodal/md/issues/20; https://github.com/phodal/md/issues/20
CVE: CVE-2020-23362
Published: 2023-05-09
Description: Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover_id parameter.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269, CWE-863
References: https://github.com/huyiwill/shopcms_lang/issues/1; https://github.com/huyiwill/shopcms_lang/issues/1
CVE: CVE-2020-23363
Published: 2023-05-09
Description: Cross Site Request Forgery (CSRF) vulnerability found in Verytops Verydows all versions that allows an attacker to execute arbitrary code via a crafted script.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Verytops/verydows/issues/17; https://github.com/Verytops/verydows/issues/17
CVE: CVE-2021-31240
Published: 2023-05-09
Description: An issue found in libming v.0.4.8 allows a local attacker to execute arbitrary code via the parseSWF_IMPORTASSETS function in the parser.c file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-401, CWE-401
References: https://github.com/libming/libming/issues/218; https://github.com/libming/libming/issues/218; https://github.com/libming/libming/issues/218
CVE: CVE-2021-31711
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Trippo ResponsiveFilemanager v.9.14.0 and before allows a remote attacker to execute arbitrary code via the sort_by parameter in the dialog.php file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/trippo/ResponsiveFilemanager/issues/661; https://github.com/trippo/ResponsiveFilemanager/issues/661
CVE: CVE-2023-25834
Published: 2023-05-09
Description: Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content that they are no longer privileged to access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-269
References: https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2023-update-1-patch-is-now-available/; https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095
CVE: CVE-2023-30083
Published: 2023-05-09
Description: Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the newVar_N in util/decompile.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/libming/libming/issues/266; https://github.com/libming/libming/issues/266
CVE: CVE-2023-30084
Published: 2023-05-09
Description: An issue found in libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the stackVal function in util/decompile.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/libming/libming/issues/268; https://github.com/libming/libming/issues/268
CVE: CVE-2023-30085
Published: 2023-05-09
Description: Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the cws2fws function in util/decompile.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/libming/libming/issues/267; https://github.com/libming/libming/issues/267
CVE: CVE-2023-30086
Published: 2023-05-09
Description: Buffer Overflow vulnerability found in Libtiff V.4.0.7 allows a local attacker to cause a denial of service via the tiffcp function in tiffcp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://libtiff-release-v4-0-7.com; http://tiffcp.com; https://gitlab.com/libtiff/libtiff/-/issues/538
CVE: CVE-2023-30087
Published: 2023-05-09
Description: Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/cesanta/mjs/issues/244; https://github.com/cesanta/mjs/issues/244
CVE: CVE-2023-30088
Published: 2023-05-09
Description: An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/cesanta/mjs/issues/243; https://github.com/cesanta/mjs/issues/243
CVE: CVE-2023-31144
Published: 2023-05-09
Description: Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442; https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6; https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442
CVE: CVE-2023-31476
Published: 2023-05-09
Description: An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working directory is /www).
CVSS Score: 7.5 (HIGH)
CWE: CWE-77, CWE-77
References: https://github.com/gl-inet/CVE-issues/blob/main/3.215/GL-MV1000_Arbitrary_File_Creation.md; https://www.gl-inet.com; https://github.com/gl-inet/CVE-issues/blob/main/3.215/GL-MV1000_Arbitrary_File_Creation.md
CVE: CVE-2023-31489
Published: 2023-05-09
Description: An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/FRRouting/frr/issues/13098; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/
CVE: CVE-2023-31490
Published: 2023-05-09
Description: An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.
CVSS Score: 7.5 (HIGH)
References: https://github.com/FRRouting/frr/issues/13099; https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/
CVE: CVE-2023-31799
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://chamilo.com; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-99-2023-04-11-Low-impact-Low-risk-XSS-in-system-announcements; http://chamilo.com
CVE: CVE-2023-31800
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://chamilo.com; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-102-2023-04-11-Low-impact-Moderate-risk-XSS-in-forum-titles; http://chamilo.com
CVE: CVE-2023-31801
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://chamilo.com; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-97-2023-04-11-Low-impact-High-risk-XSS-in-skills-wheel; http://chamilo.com
CVE: CVE-2023-31802
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://chamilo.com; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-104-2023-04-11-Moderate-impact-High-risk-XSS-in-personal-profile; http://chamilo.com
CVE: CVE-2023-31803
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://chamilo.com; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-100-2023-04-11-Low-impact-Low-risk-XSS-in-resources-sequencing; http://chamilo.com
CVE: CVE-2023-31804
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://chamilo.com; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-96-2023-04-06-Low-impact-Moderate-risk-XSS-in-course-categories; http://chamilo.com
CVE: CVE-2023-31805
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://chamilo.com; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-98-2023-04-11-Low-impact-Low-risk-XSS-in-homepage-edition; http://chamilo.com
CVE: CVE-2023-31806
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://chamilo.com; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-103-2023-04-11-Low-impact-Moderate-risk-XSS-in-My-progress-tab; http://chamilo.com
CVE: CVE-2023-31807
Published: 2023-05-09
Description: Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://chamilo.com; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-101-2023-04-11-Low-impact-Low-risk-XSS-in-personal-notes-and-teacher-notes; http://chamilo.com
CVE: CVE-2023-32066
Published: 2023-05-09
Description: Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file,  as happens in version 1.22.12.5783.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anuko/timetracker/commit/093cfe158099704ffd4a1624be217f9935e914eb; https://github.com/anuko/timetracker/security/advisories/GHSA-jw2g-8wvp-9frw; https://github.com/anuko/timetracker/commit/093cfe158099704ffd4a1624be217f9935e914eb
CVE: CVE-2023-32069
Published: 2023-05-09
Description: XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XWiki 15.0-rc-1 and 14.10.4. There are no known workarounds.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-863
References: https://github.com/xwiki/xwiki-platform/commit/de72760d4a3e1e9be64a10660a0c19e9534e2ec4; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-36fm-j33w-c25f; https://jira.xwiki.org/browse/XWIKI-20566
CVE: CVE-2023-32071
Published: 2023-05-09
Description: XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-116, CWE-79
References: https://app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYK; https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfm
CVE: CVE-2023-25829
Published: 2023-05-09
Description: There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2023-update-1-patch-is-now-available/; https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095
CVE: CVE-2023-25830
Published: 2023-05-09
Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2023-update-1-patch-is-now-available/; https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095
CVE: CVE-2023-20046
Published: 2023-05-09
Description: A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device.
 This vulnerability is due to insufficient validation of user-supplied credentials. An attacker could exploit this vulnerability by sending a valid low-privileged SSH key to an affected device from a host that has an IP address that is configured as the source for a high-privileged user account. A successful exploit could allow the attacker to log in to the affected device through SSH as a high-privileged user.
   There are workarounds that address this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-289, CWE-522
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-ssh-privesc-BmWeJC3h; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-ssh-privesc-BmWeJC3h
CVE: CVE-2023-20098
Published: 2023-05-09
Description: A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files.
 This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could exploit this vulnerability by running a system command containing directory traversal character sequences to target an arbitrary file. A successful exploit could allow the attacker to delete arbitrary files from the system, including files owned by root.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-24, CWE-22
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmanage-wfnqmYhN; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmanage-wfnqmYhN
CVE: CVE-2023-24898
Published: 2023-05-09
Description: Windows SMB Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24898; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24898
CVE: CVE-2023-24899
Published: 2023-05-09
Description: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-591, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24899; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24899
CVE: CVE-2023-24900
Published: 2023-05-09
Description: Windows NTLM Security Support Provider Information Disclosure Vulnerability
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24900; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24900
CVE: CVE-2023-24901
Published: 2023-05-09
Description: Windows NFS Portmapper Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24901; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24901
CVE: CVE-2023-24902
Published: 2023-05-09
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24902; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24902
CVE: CVE-2023-24903
Published: 2023-05-09
Description: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-415, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24903; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24903
CVE: CVE-2023-24904
Published: 2023-05-09
Description: Windows Installer Elevation of Privilege Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24904; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24904
CVE: CVE-2023-24905
Published: 2023-05-09
Description: Remote Desktop Client Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24905; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24905
CVE: CVE-2023-24932
Published: 2023-05-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-863
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932
CVE: CVE-2023-24939
Published: 2023-05-09
Description: Server for NFS Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24939; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24939
CVE: CVE-2023-24940
Published: 2023-05-09
Description: Windows Pragmatic General Multicast (PGM) Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24940; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24940
CVE: CVE-2023-24941
Published: 2023-05-09
Description: Windows Network File System Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24941; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24941
CVE: CVE-2023-24942
Published: 2023-05-09
Description: Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24942; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24942
CVE: CVE-2023-24943
Published: 2023-05-09
Description: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24943; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24943
CVE: CVE-2023-24944
Published: 2023-05-09
Description: Windows Bluetooth Driver Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24944; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24944
CVE: CVE-2023-24945
Published: 2023-05-09
Description: Windows iSCSI Target Service Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24945; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24945