deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-37829
Published: 2023-09-01
Description: A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notification.message parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://case.contwise.com/php/portal_case.php; https://github.com/Popeye-ITSec/CVEs/blob/main/CVE-2023-37829; https://case.contwise.com/php/portal_case.php
CVE: CVE-2023-37830
Published: 2023-09-01
Description: A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://case.contwise.com/php/portal_case.php; https://github.com/Popeye-ITSec/CVEs/blob/main/CVE-2023-37830; https://case.contwise.com/php/portal_case.php
CVE: CVE-2023-39703
Published: 2023-09-01
Description: A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted Markdown file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://c0olw.github.io/2023/07/31/Typora-XSS-Vulnerability/; https://c0olw.github.io/2023/07/31/Typora-XSS-Vulnerability/
CVE: CVE-2023-39710
Published: 2023-09-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add Customer section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Arajawat007/dc6e4dd231accf777dae30d890a4e7df#file-cve-2023-39710; https://www.sourcecodester.com/; https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.html
CVE: CVE-2023-23763
Published: 2023-09-01
Description: An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstream repository after its visibility was changed to private. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.10.0 and was fixed in versions 3.9.4, 3.8.9, 3.7.16 and 3.6.18. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.18-security-fixes; https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.16-security-fixes; https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.9-security-fixes
CVE: CVE-2020-22612
Published: 2023-09-01
Description: Installer RCE on settings file write in MyBB before 1.8.22.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://mybb.com/versions/1.8.22/; https://mybb.com/versions/1.8.22/
CVE: CVE-2023-28366
Published: 2023-09-01
Description: The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://github.com/eclipse/mosquitto/commit/6113eac95a9df634fbc858be542c4a0456bfe7b9; https://github.com/eclipse/mosquitto/compare/v2.0.15...v2.0.16; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJ2FMBGVVQEQWTTQB7YLKTAHMX2UM66X/
CVE: CVE-2023-36076
Published: 2023-09-01
Description: SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/lkw199711/smanga/issues/100; https://github.com/lkw199711/smanga/issues/100
CVE: CVE-2023-36088
Published: 2023-09-01
Description: Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: http://nebulagraph.com; https://github.com/vesoft-inc/nebula-studio; https://github.com/vesoft-inc/nebula-studio/issues/571
CVE: CVE-2023-36100
Published: 2023-09-01
Description: An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://github.com/Thecosy/IceCMS/issues/15; https://github.com/Thecosy/IceCMS/issues/15
CVE: CVE-2023-36187
Published: 2023-09-01
Description: Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code via crafted URL to httpd.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://kb.netgear.com/000065571/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2020-0578; https://kb.netgear.com/000065571/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2020-0578
CVE: CVE-2023-36326
Published: 2023-09-01
Description: Integer Overflow vulnerability in RELIC before commit 34580d840469361ba9b5f001361cad659687b9ab, allows attackers to execute arbitrary code, cause a denial of service, and escalate privileges when calling realloc function in bn_grow function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/relic-toolkit/relic/commit/34580d840469361ba9b5f001361cad659687b9ab; https://groups.google.com/g/relic-discuss/c/A_J2-ArVIAo/m/qgFiXsUJBQAJ?utm_medium=email&utm_source=footer; https://github.com/relic-toolkit/relic/commit/34580d840469361ba9b5f001361cad659687b9ab
CVE: CVE-2023-36327
Published: 2023-09-01
Description: Integer Overflow vulnerability in RELIC before commit 421f2e91cf2ba42473d4d54daf24e295679e290e, allows attackers to execute arbitrary code and cause a denial of service in pos argument in bn_get_prime function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/relic-toolkit/relic/commit/421f2e91cf2ba42473d4d54daf24e295679e290e; https://groups.google.com/g/relic-discuss/c/A_J2-ArVIAo/m/qgFiXsUJBQAJ?utm_medium=email&utm_source=footer; https://github.com/relic-toolkit/relic/commit/421f2e91cf2ba42473d4d54daf24e295679e290e
CVE: CVE-2023-36328
Published: 2023-09-01
Description: Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/libtom/libtommath/pull/546; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3H2PFUTBKQUDSOJXQQS7LUSZQWT3JTW2/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46GORAXZ34MHQNUGJBKS7PJ5NSMIAJGC/
CVE: CVE-2023-39582
Published: 2023-09-01
Description: SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-126-2023-07-18-High-impact-Low-risk-SQL-injection-by-admin-users; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-126-2023-07-18-High-impact-Low-risk-SQL-injection-by-admin-users
CVE: CVE-2023-39631
Published: 2023-09-01
Description: An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/langchain-ai/langchain/issues/8363; https://github.com/pydata/numexpr/issues/442; https://github.com/langchain-ai/langchain/issues/8363
CVE: CVE-2023-40771
Published: 2023-09-01
Description: SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/dataease/dataease/issues/5861; https://github.com/dataease/dataease/issues/5861
CVE: CVE-2023-40968
Published: 2023-09-01
Description: Buffer Overflow vulnerability in hzeller timg v.1.5.1 and before allows a remote attacker to cause a denial of service via the 0x[PII_REDACTED]5c address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/hzeller/timg/issues/115; https://github.com/hzeller/timg/releases/tag/v1.5.2; https://github.com/hzeller/timg/issues/115
CVE: CVE-2023-40980
Published: 2023-09-01
Description: File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile in the action/UploadAction.java file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/wkeyuan/DWSurvey/issues/107; https://github.com/wkeyuan/DWSurvey/issues/107
CVE: CVE-2023-4720
Published: 2023-09-01
Description: Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1077
References: https://github.com/gpac/gpac/commit/e396648e48c57e2d53988d3fd4465b068b96c89a; https://huntr.dev/bounties/1dc2954c-8497-49fa-b2af-113e1e9381ad; https://github.com/gpac/gpac/commit/e396648e48c57e2d53988d3fd4465b068b96c89a
CVE: CVE-2023-4721
Published: 2023-09-01
Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/gpac/gpac/commit/3ec93d73d048ed7b46fe6e9f307cc7a0cc13db63; https://huntr.dev/bounties/f457dc62-3cff-47bd-8fd2-1cb2b4a832fc; https://github.com/gpac/gpac/commit/3ec93d73d048ed7b46fe6e9f307cc7a0cc13db63
CVE: CVE-2023-4722
Published: 2023-09-01
Description: Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/gpac/gpac/commit/de7f3a852bef72a52825fd307cf4e8f486401a76; https://huntr.dev/bounties/ddfdb41d-e708-4fec-afe5-68ff1f88f830; https://github.com/gpac/gpac/commit/de7f3a852bef72a52825fd307cf4e8f486401a76
CVE: CVE-2022-3407
Published: 2023-09-01
Description: I some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile network connection with the host PC, if the user originates a call on the device, then the device's modem may reset and cause the phone call to not succeed.  This may block the user from dialing emergency services.  This patch resolves the device's modem reset issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-404
References: https://en-us.support.motorola.com/app/answers/detail/a_id/175354; https://en-us.support.motorola.com/app/answers/detail/a_id/175354
CVE: CVE-2023-41627
Published: 2023-09-01
Description: O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device.
CVSS Score: 7.5 (HIGH)
References: https://jira.o-ran-sc.org/browse/RIC-1001; https://www.trendmicro.com/en_us/research/23/l/the-current-state-of-open-ran-security.html; https://jira.o-ran-sc.org/browse/RIC-1001
CVE: CVE-2023-41628
Published: 2023-09-01
Description: An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messaging procedure between the E2Node and E2Term components.
CVSS Score: 7.5 (HIGH)
References: https://jira.o-ran-sc.org/browse/RIC-1002; https://jira.o-ran-sc.org/browse/RIC-1002
CVE: CVE-2023-39714
Published: 2023-09-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add New Member section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Arajawat007/141e68161014e832e30d39b1979a8a6c#file-cve-2023-39714; https://www.sourcecodester.com/; https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.html
CVE: CVE-2023-4707
Published: 2023-09-01
Description: A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been declared as problematic. This vulnerability affects unknown code of the file /collection/all. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. VDB-238570 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/174444/Clcknshop-1.0.0-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.238570; https://vuldb.com/?id.238570
CVE: CVE-2023-4708
Published: 2023-09-01
Description: A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /collection/all of the component GET Parameter Handler. The manipulation of the argument tag leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-238571. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/174445/Clcknshop-1.0.0-SQL-Injection.html; https://vuldb.com/?ctiid.238571; https://vuldb.com/?id.238571
CVE: CVE-2023-1523
Published: 2023-09-01
Description: Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-74
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1523; https://github.com/snapcore/snapd/pull/12849; https://marc.info/?l=oss-security&m=[PII_REDACTED]9955&w=2
CVE: CVE-2023-41051
Published: 2023-09-01
Description: In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual device drivers, virtio backend drivers and vhost drivers, that need to access the VM physical memory. The vm-memory rust crate provides a set of traits to decouple VM memory consumers from VM memory providers. An issue was discovered in the default implementations of the `VolatileMemory::{get_atomic_ref, aligned_as_ref, aligned_as_mut, get_ref, get_array_ref}` trait functions, which allows out-of-bounds memory access if the `VolatileMemory::get_slice` function returns a `VolatileSlice` whose length is less than the function’s `count` argument. No implementations of `get_slice` provided in `vm_memory` are affected. Users of custom `VolatileMemory` implementations may be impacted if the custom implementation does not adhere to `get_slice`'s documentation. The issue started in version 0.1.0 but was fixed in version 0.12.2 by inserting a check that verifies that the `VolatileSlice` returned by `get_slice` is of the correct length. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 2.5 (LOW)
CWE: CWE-125, CWE-125
References: https://crates.io/crates/vm-memory/0.12.2; https://github.com/rust-vmm/vm-memory/commit/aff1dd4a5259f7deba56692840f7a2d9ca34c9c8; https://github.com/rust-vmm/vm-memory/security/advisories/GHSA-49hh-fprx-m68g
CVE: CVE-2023-41633
Published: 2023-09-01
Description: Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/rycbar77/3da455382f88cfb6d6798572f34378bd; https://rycbar77.github.io/2023/08/29/catdoc-0-95-nullptr-dereference/; https://gist.github.com/rycbar77/3da455382f88cfb6d6798572f34378bd
CVE: CVE-2023-4709
Published: 2023-09-01
Description: A vulnerability classified as problematic has been found in TOTVS RM 12.1. Affected is an unknown function of the file Login.aspx of the component Portal. The manipulation of the argument VIEWSTATE leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. It is possible to mitigate the problem by applying the configuration setting <pages validateRequest="true" [...] viewStateEncryptionMode="Always" />. It is recommended to change the configuration settings. The vendor was initially contacted early about this disclosure but did not respond in any way. In a later statement he explains, that "the behavior described [...] is related to specific configurations that are not part of the default application setup. In standard production environments, the relevant feature (VIEWSTATE) is disabled by default, which effectively mitigates the risk of exploitation."
CVSS Score: 3.1 (LOW)
CWE: CWE-79, CWE-94
References: https://tdn.totvs.com/pages/releaseview.action?pageId=284462425#COMOAUMENTARASEGURAN%C3%87ADESUAAPLICA%C3%87%C3%83O-Reduziron%C3%ADveldedetalhamentodemensagensexibidasparaousu%C3%A1rio; https://vuldb.com/?ctiid.238572; https://vuldb.com/?id.238572
CVE: CVE-2023-41046
Published: 2023-09-01
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the former, the syntax of the document needs to be set the `xwiki/1.0` (this syntax doesn't need to be installed). In both cases, when adding the property to an object, the Velocity code is executed regardless of the rights of the author of the property (edit right is still required, though). In both cases, the code is executed with the correct context author so no privileged APIs can be accessed. However, Velocity still grants access to otherwise inaccessible data and APIs that could allow further privilege escalation. At least for "VelocityCode", this behavior is most likely very old but only since XWiki 7.2, script right is a separate right, before that version all users were allowed to execute Velocity and thus this was expected and not a security issue. This has been patched in XWiki 14.10.10 and 15.4 RC1. Users are advised to upgrade. There are no known workarounds.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/xwiki/xwiki-platform/commit/edc52579eeaab1b4514785c134044671a1ecd839; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m5m2-h6h9-p2c8; https://jira.xwiki.org/browse/XWIKI-20847
CVE: CVE-2023-41049
Published: 2023-09-01
Description: @dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using  the `javascript:` prefix. This vulnerability has been patched on version `0.1.0`. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the `init` function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/decentraland/single-sign-on-client/commit/bd20ea9533d0cda30809d929db85b1b76cef855a; https://github.com/decentraland/single-sign-on-client/security/advisories/GHSA-vp4f-wxgw-7x8x; https://github.com/decentraland/single-sign-on-client/commit/bd20ea9533d0cda30809d929db85b1b76cef855a
CVE: CVE-2023-4710
Published: 2023-09-01
Description: A vulnerability classified as problematic was found in TOTVS RM 12.1. Affected by this vulnerability is an unknown functionality of the component Portal. The manipulation of the argument d leads to cross site scripting. The attack can be launched remotely. The identifier VDB-238573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://vuldb.com/?ctiid.238573; https://vuldb.com/?id.238573; https://vuldb.com/?ctiid.238573
CVE: CVE-2023-4711
Published: 2023-09-01
Description: A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-238574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-78
References: https://github.com/TinkAnet/cve/blob/main/rce.md; https://vuldb.com/?ctiid.238574; https://vuldb.com/?id.238574
CVE: CVE-2023-4712
Published: 2023-09-01
Description: A vulnerability, which was classified as critical, was found in Xintian Smart Table Integrated Management System 5.6.9. This affects an unknown part of the file /SysManage/AddUpdateRole.aspx. The manipulation of the argument txtRoleName leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238575. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/wpay65249519/cve/blob/main/SQL_injection.md; https://vuldb.com/?ctiid.238575; https://vuldb.com/?id.238575
CVE: CVE-2023-4713
Published: 2023-09-01
Description: A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?r=weibo/comment/addcomment. The manipulation of the argument touid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238576. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/13aiZe1/cve/blob/main/sql.md; https://vuldb.com/?ctiid.238576; https://vuldb.com/?id.238576
CVE: CVE-2023-4714
Published: 2023-09-01
Description: A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The identifier VDB-238577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/174446/PlayTube-3.0.1-Information-Disclosure.html; https://vuldb.com/?ctiid.238577; https://vuldb.com/?id.238577
CVE: CVE-2023-3297
Published: 2023-09-01
Description: In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297; https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/