deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3146
Published: 2023-06-07
Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin\categories\manage_category.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231015.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#8sql-injection-vulnerability-in-admincategoriesmanage_categoryphp; https://vuldb.com/?ctiid.231015; https://vuldb.com/?id.231015
CVE: CVE-2023-3147
Published: 2023-06-07
Description: A vulnerability has been found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin\categories\view_category.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231016.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#7sql-injection-vulnerability-in-admincategoriesview_categoryphp; https://vuldb.com/?ctiid.231016; https://vuldb.com/?id.231016
CVE: CVE-2023-0121
Published: 2023-06-07
Description: A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.json; https://gitlab.com/gitlab-org/gitlab/-/issues/387549; https://hackerone.com/reports/1774688
CVE: CVE-2023-0508
Published: 2023-06-07
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API.
CVSS Score: 3.1 (LOW)
CWE: CWE-113
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0508.json; https://gitlab.com/gitlab-org/gitlab/-/issues/389328; https://hackerone.com/reports/1842314
CVE: CVE-2023-1825
Published: 2023-06-07
Description: An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user at project export.
CVSS Score: 3.1 (LOW)
CWE: CWE-201
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1825.json; https://gitlab.com/gitlab-org/gitlab/-/issues/384035; https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1825.json
CVE: CVE-2023-2001
Published: 2023-06-07
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json; https://gitlab.com/gitlab-org/gitlab/-/issues/406764; https://hackerone.com/reports/1908423
CVE: CVE-2023-2013
Published: 2023-06-07
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.
CVSS Score: 2.6 (LOW)
CWE: CWE-1021
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2013.json; https://gitlab.com/gitlab-org/gitlab/-/issues/406844; https://hackerone.com/reports/1940441
CVE: CVE-2023-2015
Published: 2023-06-07
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform arbitrary actions on behalf of victims.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2015.json; https://gitlab.com/gitlab-org/gitlab/-/issues/407137; https://hackerone.com/reports/1941091
CVE: CVE-2023-2198
Published: 2023-06-07
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2198.json; https://gitlab.com/gitlab-org/gitlab/-/issues/408273; https://hackerone.com/reports/1947187
CVE: CVE-2023-2199
Published: 2023-06-07
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2199.json; https://gitlab.com/gitlab-org/gitlab/-/issues/408272; https://hackerone.com/reports/1943819
CVE: CVE-2023-2485
Published: 2023-06-07
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-266
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2485.json; https://gitlab.com/gitlab-org/gitlab/-/issues/407830; https://hackerone.com/reports/1934811
CVE: CVE-2023-2589
Published: 2023-06-07
Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker can clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-346
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2589.json; https://gitlab.com/gitlab-org/gitlab/-/issues/407891; https://hackerone.com/reports/1941803
CVE: CVE-2023-3148
Published: 2023-06-07
Description: A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This issue affects some unknown processing of the file admin\posts\manage_post.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231017 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#6sql-injection-vulnerability-in-adminpostsmanage_postphp; https://vuldb.com/?ctiid.231017; https://vuldb.com/?id.231017
CVE: CVE-2023-3149
Published: 2023-06-07
Description: A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown function of the file admin\user\manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-231018 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#4sql-injection-vulnerability-in-adminusermanage_userphp; https://vuldb.com/?ctiid.231018; https://vuldb.com/?id.231018
CVE: CVE-2023-29345
Published: 2023-06-07
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29345; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29345; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-34108
Published: 2023-06-07
Description: mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue arises from the behavior of the `passwd-verify.lua` script, which is responsible for verifying user passwords during login attempts. Upon a successful login, the script returns a response in the format of "password=<valid-password>", indicating the successful authentication. By crafting a password with additional key-value pairs appended to it, an attacker can manipulate the returned string and influence the internal behavior of Dovecot. For example, using the password "123 mail_crypt_save_version=0" would cause the `passwd-verify.lua` script to return the string "password=123 mail_crypt_save_version=0". Consequently, Dovecot will interpret this string and set the internal variables accordingly, leading to unintended consequences. This vulnerability can be exploited by an authenticated attacker who has the ability to set their own password. Successful exploitation of this vulnerability could result in unauthorized access to user accounts, bypassing security controls, or other malicious activities. This issue has been patched in version `2023-05a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/VladimirBorisov/CVE_proposal/blob/main/MailcowUserPassword.md; https://github.com/mailcow/mailcow-dockerized/commit/f80940efdccd393bf5fccec[PII_REDACTED]a38c445; https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-mhh4-qchc-pv22
CVE: CVE-2023-34109
Published: 2023-06-07
Description: zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platform which are using the second argument of the zxcvbn function. It can result in an unbounded resource consumption as the user inputs array is extended with every function call. Browsers are impacted, too but a single user need to do a lot of input changes so that it affects the browser, while the node process gets the inputs of every user of a platform and can be killed that way. This problem has been patched in version 3.0.2. Users are advised to upgrade. Users unable to upgrade should stop using the second argument of the zxcvbn function and use the zxcvbnOptions.setOptions function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/zxcvbn-ts/zxcvbn/commit/3f9bed21b5d01f6f[PII_REDACTED]ca857355fba22f; https://github.com/zxcvbn-ts/zxcvbn/security/advisories/GHSA-38hx-x5hq-5fg4; https://github.com/zxcvbn-ts/zxcvbn/commit/3f9bed21b5d01f6f[PII_REDACTED]ca857355fba22f
CVE: CVE-2023-34234
Published: 2023-06-07
Description:  OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/OpenZeppelin/openzeppelin-contracts/commit/d9474327a492f9f310f31bc53f38dbea56ed9a57; https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5h3x-9wvq-w4m2; https://github.com/OpenZeppelin/openzeppelin-contracts/commit/d9474327a492f9f310f31bc53f38dbea56ed9a57
CVE: CVE-2023-3150
Published: 2023-06-07
Description: A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file posts\manage_post.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231019.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md; https://vuldb.com/?ctiid.231019; https://vuldb.com/?id.231019
CVE: CVE-2023-3151
Published: 2023-06-07
Description: A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file user\manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231020.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md; https://vuldb.com/?ctiid.231020; https://vuldb.com/?id.231020
CVE: CVE-2023-3152
Published: 2023-06-07
Description: A vulnerability classified as critical has been found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin\posts\view_post.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231021 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#5sql-injection-vulnerability-in-adminpostsview_postphp; https://vuldb.com/?ctiid.231021; https://vuldb.com/?id.231021
CVE: CVE-2023-2530
Published: 2023-06-07
Description: A privilege escalation allowing remote code execution was discovered in the orchestration service.
CVSS Score: 9.8 (CRITICAL)
References: https://www.puppet.com/security/cve/cve-2023-2530-remote-code-execution-orchestrator; https://www.puppet.com/security/cve/cve-2023-2530-remote-code-execution-orchestrator
CVE: CVE-2023-33282
Published: 2023-06-07
Description: Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This makes it possible to make backend calls to endpoints in the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276, CWE-276
References: https://marvalglobal.com/software/; https://www.cyberskydd.se/cve/2023/CVE-2023-33282.html; https://marvalglobal.com/software/
CVE: CVE-2023-33283
Published: 2023-06-07
Description: Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this key.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://www.cyberskydd.se/cve/2023/CVE-2023-33283.html; https://www.cyberskydd.se/cve/2023/CVE-2023-33283.html
CVE: CVE-2023-33284
Published: 2023-06-07
Description: Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote attacker authenticated as any user is able to execute code in context of the web server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.cyberskydd.se/cve/2023/CVE-2023-33284.html; https://www.cyberskydd.se/cve/2023/CVE-2023-33284.html
CVE: CVE-2023-33510
Published: 2023-06-07
Description: Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668, CWE-22
References: https://carl1l.github.io/2023/05/08/jeecg-p3-biz-chat-1-0-5-jar-has-arbitrary-file-read-vulnerability/; https://carl1l.github.io/2023/05/08/jeecg-p3-biz-chat-1-0-5-jar-has-arbitrary-file-read-vulnerability/
CVE: CVE-2023-33595
Published: 2023-06-07
Description: CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/python/cpython/issues/103824; https://github.com/python/cpython/pull/103993/commits/c120bc2d354ca3d27d0c7a53bf65574ddaabaf3a; https://github.com/python/cpython/issues/103824
CVE: CVE-2023-33863
Published: 2023-06-07
Description: SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. 0xffffffff is sign-extended to 0xffffffffffffffff (SIZE_MAX) and then there is an attempt to add 1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2023/Jun/2; https://lists.debian.org/debian-lts-announce/2023/07/msg00023.html
CVE: CVE-2023-33864
Published: 2023-06-07
Description: StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It uses uint32_t(m_BufferSize-m_InputSize) even though m_InputSize can exceed m_BufferSize.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2023/Jun/2; https://lists.debian.org/debian-lts-announce/2023/07/msg00023.html
CVE: CVE-2023-33865
Published: 2023-06-07
Description: RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2023/Jun/2; https://lists.debian.org/debian-lts-announce/2023/07/msg00023.html
CVE: CVE-2023-34237
Published: 2023-06-07
Description: SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the Notification Script functionality allows code execution with the privileges of the SABnzbd process. Exploiting the vulnerabilities requires access to the web interface. Remote exploitation is possible if users[exposed their setup to the internet or other untrusted networks without setting a username/password. By default SABnzbd is only accessible from `localhost`, with no authentication required for the web interface. This issue has been patched in commits `e3a722` and `422b4f` which have been included in the 4.0.2 release. Users are advised to upgrade. Users unable to upgrade should ensure that a username and password have been set if their instance is web accessible.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://github.com/sabnzbd/sabnzbd/commit/422b4fce7bfd56e95a315be0400cdfdc585df7cc; https://github.com/sabnzbd/sabnzbd/commit/e3a722664819d1c7c8fab97144cc299b1c18b429; https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-hhgh-xgh3-985r
CVE: CVE-2023-1709
Published: 2023-06-07
Description: 
Datalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.

 


CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-629917.html; https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-11; https://www.cisa.gov/news-events/ics-advisories/icsa-23-164-01
CVE: CVE-2023-1864
Published: 2023-06-07
Description: FANUC ROBOGUIDE-HandlingPRO Versions 9 Rev.ZD and prior is vulnerable to
 a path traversal, which could allow an attacker to remotely read files 
on the system running the affected software. 


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-101-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-101-01
CVE: CVE-2023-24014
Published: 2023-06-07
Description: Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are 
vulnerable to heap-based buffer overflow, which could allow an attacker 
to execute arbitrary code.


CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-01
CVE: CVE-2023-25177
Published: 2023-06-07
Description: 
Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are 
vulnerable to stack-based buffer overflow, which could allow an attacker
 to execute arbitrary code.


CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-01
CVE: CVE-2023-2866
Published: 2023-06-07
Description: 
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server. 


CVSS Score: 7.3 (HIGH)
CWE: CWE-351, CWE-345
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-150-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-150-01
CVE: CVE-2023-31114
Published: 2023-06-07
Description: An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause unintended querying of the SIM status via a crafted application.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-669, CWE-669
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-31115
Published: 2023-06-07
Description: An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause changes to the activation mode of RCS via a crafted application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-669, CWE-669
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/