deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3166
Published: 2023-07-12
Description: The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, Lana Email Logger due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2923581/lana-email-logger#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f372bf-6b13-4ba7-8b8b-9d3b500e4420?source=cve; https://plugins.trac.wordpress.org/changeset/2923581/lana-email-logger#file1
CVE: CVE-2023-3167
Published: 2023-07-12
Description: The Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2924661/mail-queue; https://www.wordfence.com/threat-intel/vulnerabilities/id/d4aaca22-76b9-42ec-a960-65d44d696324?source=cve; https://plugins.trac.wordpress.org/changeset/2924661/mail-queue
CVE: CVE-2023-3168
Published: 2023-07-12
Description: The WP Reroute Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2933637/wp-reroute-email; https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0e962b-b6a0-4179-91d0-5ede508a9895?source=cve; https://plugins.trac.wordpress.org/changeset/2933637/wp-reroute-email
CVE: CVE-2023-3199
Published: 2023-07-12
Description: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This makes it possible for unauthenticated attackers to update status order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L256; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a604df5d-92b3-4df8-a7ef-00f0ee95cf0f?source=cve
CVE: CVE-2023-3202
Published: 2023-07-12
Description: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L232; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b3612e-3c91-469b-98ef-fdb03b0ee9d9?source=cve
CVE: CVE-2023-3369
Published: 2023-07-12
Description: The About Me 3000 widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/about-me-3000/trunk/aboutme3000.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/be6f660f-041a-42f2-ab5b-72aedf75727d?source=cve; https://plugins.trac.wordpress.org/browser/about-me-3000/trunk/aboutme3000.php
CVE: CVE-2023-3525
Published: 2023-07-12
Description: The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to 'APPROVED' without payment.
CVSS Score: 7.5 (HIGH)
References: https://www.wordfence.com/threat-intel/vulnerabilities/id/245e9117-ca63-458e-a094-60a759f5ec19?source=cve; https://www.youtube.com/watch?v=xTyWqh93AM0; https://www.wordfence.com/threat-intel/vulnerabilities/id/245e9117-ca63-458e-a094-60a759f5ec19?source=cve
CVE: CVE-2020-36756
Published: 2023-07-12
Description: The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.8. This is due to missing or incorrect nonce validation on the create_csv_file() function. This makes it possible for unauthenticated attackers to create a CSV file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2020-36757
Published: 2023-07-12
Description: The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due to missing or incorrect nonce validation on the admin_add_order_item() function. This makes it possible for unauthenticated attackers to add an order item via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4419
Published: 2023-07-12
Description: The WP-Backgrounds Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the ino_save_data() function. This makes it possible for unauthenticated attackers to save meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4420
Published: 2023-07-12
Description: The Sell Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.5. This is due to missing or incorrect nonce validation on the sell_media_process() function. This makes it possible for unauthenticated attackers to sell media paypal orders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4421
Published: 2023-07-12
Description: The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the metabox_popup_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4422
Published: 2023-07-12
Description: The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4423
Published: 2023-07-12
Description: The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the rsgd_insert_update() function. This makes it possible for unauthenticated attackers to update post fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4424
Published: 2023-07-12
Description: The Slider Hero plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.0. This is due to missing or incorrect nonce validation on the qc_slider_hero_duplicate() function. This makes it possible for unauthenticated attackers to duplicate slides via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2023-37196
Published: 2023-07-12
Description: 
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command
('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to
access unauthorized content, change, or delete content, or perform unauthorized actions when
tampering with the alert settings of endpoints on DCE.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf
CVE: CVE-2023-37197
Published: 2023-07-12
Description: 


A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command
('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to
access unauthorized content, change, or delete content, or perform unauthorized actions when
tampering with the mass configuration settings of endpoints on DCE. 




CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf
CVE: CVE-2023-37198
Published: 2023-07-12
Description: 




A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that
could cause remote code execution when an admin user on DCE uploads or tampers with install
packages. 

 




CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf
CVE: CVE-2020-36760
Published: 2023-07-12
Description: The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to missing or incorrect nonce validation on the add_core_extensions_bundle_validation() function. This makes it possible for unauthenticated attackers to validate extension bundles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2020-36761
Published: 2023-07-12
Description: The Top 10 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.4. This is due to missing or incorrect nonce validation on the tptn_export_tables() function. This makes it possible for unauthenticated attackers to generate an export of the top 10 table via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4425
Published: 2023-07-12
Description: The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verify_otp_login_time() function. This makes it possible for unauthenticated attackers to verify a one time login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4426
Published: 2023-07-12
Description: The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the metabox_review_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4427
Published: 2023-07-12
Description: The Vuukle Comments, Reactions, Share Bar, Revenue plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.31. This is due to missing or incorrect nonce validation in the /admin/partials/free-comments-for-wordpress-vuukle-admin-display.php file. This makes it possible for unauthenticated attackers to edit the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2023-2762
Published: 2023-07-12
Description: A Use-After-Free vulnerability in SLDPRT file reading procedure exists in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted SLDPRT file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2023-2763
Published: 2023-07-12
Description: Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-416, CWE-787, CWE-416, CWE-787
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2023-32200
Published: 2023-07-12
Description: There is insufficient restrictions of called script functions in Apache Jena
 versions 4.8.0 and earlier. It allows a 
remote user to execute javascript via a SPARQL query.
This issue affects Apache Jena: from 3.7.0 through 4.8.0.


CVSS Score: 8.8 (HIGH)
CWE: CWE-917
References: https://lists.apache.org/thread/7hg0t2kws3fyr75dl7lll8389xzzc46z; https://www.cve.org/CVERecord?id=CVE-2023-22665; https://lists.apache.org/thread/7hg0t2kws3fyr75dl7lll8389xzzc46z
CVE: CVE-2023-37199
Published: 2023-07-12
Description: 
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that
could cause remote code execution when an admin user on DCE tampers with backups which
are then manually restored. 



CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf
CVE: CVE-2023-37200
Published: 2023-07-12
Description: 
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that
could cause loss of confidentiality when replacing a project file on the local filesystem and after
manual restart of the server. 



CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-02.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-02.pdf
CVE: CVE-2022-48450
Published: 2023-07-12
Description: In bluetooth service, there is a possible missing params check.  This could lead to local denial of service with System execution privileges needed.
CVSS Score: 4.4 (MEDIUM)
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073
CVE: CVE-2022-48451
Published: 2023-07-12
Description: In bluetooth service, there is a possible out of bounds write due to race condition.  This could lead to local denial of service with System execution privileges needed.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-362
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073
CVE: CVE-2023-29414
Published: 2023-07-12
Description: 
A CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow) vulnerability
exists that could cause user privilege escalation if a local user sends specific string input to a
local function call.


CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-03.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-03.pdf
CVE: CVE-2023-30913
Published: 2023-07-12
Description: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073
CVE: CVE-2023-30916
Published: 2023-07-12
Description: In DMService, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073
CVE: CVE-2023-30917
Published: 2023-07-12
Description: In DMService, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073
CVE: CVE-2023-30918
Published: 2023-07-12
Description: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073
CVE: CVE-2023-30919
Published: 2023-07-12
Description: In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073
CVE: CVE-2023-30920
Published: 2023-07-12
Description: In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]08259073