deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-44488
Published: 2023-09-30
Description: VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: http://www.openwall.com/lists/oss-security/2023/09/30/4; https://bugzilla.redhat.com/show_bug.cgi?id=2241806; https://github.com/webmproject/libvpx/commit/263682c9a29395055f3b3afe2d97be1828a6223f
CVE: CVE-2023-43712
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "access_levels_name" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43713
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability,
which allows attackers to inject JS via the "title" parameter, in the "/admin/admin-menu/add-submit"
endpoint, which can lead to unauthorized execution of scripts in a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43714
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "SKIP_CART_PAGE_TITLE[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43715
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "ENTRY_FIRST_NAME_MIN_LENGTH_TITLE[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43716
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "MAX_DISPLAY_NEW_PRODUCTS_TITLE[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43717
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "MSEARCH_HIGHLIGHT_ENABLE_TITLE[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43718
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "MSEARCH_ENABLE_TITLE[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43719
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "SHIPPING_GENDER_TITLE[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43720
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "BILLING_GENDER_TITLE[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43721
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "PACKING_SLIPS_SUMMARY_TITLE[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43722
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "orders_status_groups_name[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43723
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "orders_status_name[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43724
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "derb6zmklgtjuhh2cn5chn2qjbm2stgmfa4.oastify.comscription[1][name]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43725
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "orders_products_status_name_long[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43726
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "orders_products_status_manual_name_long[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43727
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "stock_indication_text[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43728
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "stock_delivery_terms_text[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43729
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "xsell_type_name[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43730
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "countries_name[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43731
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "zone_name" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43732
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "tax_class_title" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43733
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "company_address" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43734
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "name" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43735
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "formats_titles[7]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-5111
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "featured_type_name[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-5112
Published: 2023-09-30
Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "specials_type_name[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/bts/; https://www.oscommerce.com/; https://fluidattacks.com/advisories/bts/
CVE: CVE-2023-43907
Published: 2023-10-01
Description: OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: http://optipng.sourceforge.net/; https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/optipng-global-buffer-overflow1/optipng-global-buffer-overflow1.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBHVG5LDE2K3FZSIK4XFXOUXSE7NZ5JH/
CVE: CVE-2023-5323
Published: 2023-10-01
Description: Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dolibarr/dolibarr/commit/695ca086847b3b6a185afa93e897972c93c43d15; https://huntr.dev/bounties/7a048bb7-bfdd-4299-931e-9bc283e92bc8; https://github.com/dolibarr/dolibarr/commit/695ca086847b3b6a185afa93e897972c93c43d15
CVE: CVE-2023-5322
Published: 2023-10-01
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sysmanage/edit_manageadmin.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240992. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000%E5%AD%98%E5%9C%A8sql%E6%B3%A8%E5%85%A5:sysmanage:edit_manageadmin.php.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354; https://vuldb.com/?ctiid.240992
CVE: CVE-2023-4211
Published: 2023-10-01
Description: A local non-privileged user can make improper GPU memory processing operations  to gain access to already freed memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4211
CVE: CVE-2023-5324
Published: 2023-10-01
Description: A vulnerability has been found in eeroOS up to 6.16.4-11 and classified as critical. This vulnerability affects unknown code of the component Ethernet Interface. The manipulation leads to denial of service. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241024.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/nomis/eero-zero-length-ipv6-options-header-dos; https://vuldb.com/?ctiid.241024; https://vuldb.com/?id.241024
CVE: CVE-2023-5326
Published: 2023-10-01
Description: A vulnerability was found in SATO CL4NX-J Plus 1.13.2-u455_r2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component WebConfig. The manipulation leads to improper authentication. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241027.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/CV3TR4CK/CV3Cyb3R/blob/main/2023/SATO%20CL4NX-J%20Plus/README.md; https://vuldb.com/?ctiid.241027; https://vuldb.com/?id.241027
CVE: CVE-2023-5327
Published: 2023-10-01
Description: A vulnerability was found in SATO CL4NX-J Plus 1.13.2-u455_r2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /rest/dir/. The manipulation of the argument full leads to path traversal. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241028.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://github.com/CV3TR4CK/CV3Cyb3R/blob/main/2023/SATO%20CL4NX-J%20Plus%20dir/README.md; https://vuldb.com/?ctiid.241028; https://vuldb.com/?id.241028
CVE: CVE-2023-5328
Published: 2023-10-02
Description: A vulnerability classified as critical has been found in SATO CL4NX-J Plus 1.13.2-u455_r2. This affects an unknown part of the component Cookie Handler. The manipulation with the input auth=user,level1,settings; web=true leads to improper authentication. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-241029 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/CV3TR4CK/CV3Cyb3R/blob/main/2023/SATO%20CL4NX-J%20Plus%20cookie/README.md; https://vuldb.com/?ctiid.241029; https://vuldb.com/?id.241029
CVE: CVE-2023-5329
Published: 2023-10-02
Description: A vulnerability classified as problematic was found in Field Logic DataCube4 up to 20231001. This vulnerability affects unknown code of the file /api/ of the component Web API. The manipulation leads to improper authentication. The exploit has been disclosed to the public and may be used. VDB-241030 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/CV3TR4CK/CV3Cyb3R/blob/main/2023/Field%20Logic/Field%20Logic%20DataCube4%20Web%20API%20Improper%20Authentication.md; https://vuldb.com/?ctiid.241030; https://vuldb.com/?id.241030
CVE: CVE-2023-20819
Published: 2023-10-02
Description: In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: MOLY01068234; Issue ID: ALPS08010003.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-32819
Published: 2023-10-02
Description: In display, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07993705; Issue ID: ALPS08014138.
CVSS Score: 4.4 (MEDIUM)
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-32820
Published: 2023-10-02
Description: In wlan firmware, there is a possible firmware assertion due to improper input handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07932637; Issue ID: ALPS07932637.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-20
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-32821
Published: 2023-10-02
Description: In video, there is a possible out of bounds write due to a permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08013430; Issue ID: ALPS08013433.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-32822
Published: 2023-10-02
Description: In ftm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07994229; Issue ID: ALPS07994229.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-32823
Published: 2023-10-02
Description: In rpmb , there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07912966; Issue ID: ALPS07912966.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-32824
Published: 2023-10-02
Description: In rpmb , there is a possible double free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07912966; Issue ID: ALPS07912961.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-32826
Published: 2023-10-02
Description: In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07993539; Issue ID: ALPS07993544.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-20, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-32827
Published: 2023-10-02
Description: In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07993539; Issue ID: ALPS07993539.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-20, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023
CVE: CVE-2023-32828
Published: 2023-10-02
Description: In vpu, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07767817; Issue ID: ALPS07767817.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://corp.mediatek.com/product-security-bulletin/October-2023; https://corp.mediatek.com/product-security-bulletin/October-2023