deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49140
Published: 2023-12-12
Description: Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://jvn.jp/en/jp/JVN34145838/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]62/; https://jvn.jp/en/jp/JVN34145838/
CVE: CVE-2023-49143
Published: 2023-12-12
Description: Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://jvn.jp/en/jp/JVN34145838/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]62/; https://jvn.jp/en/jp/JVN34145838/
CVE: CVE-2023-49713
Published: 2023-12-12
Description: Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://jvn.jp/en/jp/JVN34145838/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]62/; https://jvn.jp/en/jp/JVN34145838/
CVE: CVE-2023-4932
Published: 2023-12-12
Description: SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4_M7 and 9.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published. 

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert.pl/en/posts/2023/12/CVE-2023-4932/; https://cert.pl/posts/2023/12/CVE-2023-4932/; https://support.sas.com/kb/70/265.html
CVE: CVE-2023-4958
Published: 2023-12-12
Description: In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://access.redhat.com/errata/RHSA-2023:5206; https://access.redhat.com/security/cve/CVE-2023-4958; https://bugzilla.redhat.com/show_bug.cgi?id=1990363
CVE: CVE-2023-6727
Published: 2023-12-12
Description: Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, like the name, can be leaked. 


CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2022-46141
Published: 2023-12-12
Description: A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware configuration of the affected application.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-316, CWE-312
References: https://cert-portal.siemens.com/productcert/pdf/ssa-887801.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-887801.pdf
CVE: CVE-2022-47374
Published: 2023-12-12
Description: A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions). The affected products do not handle HTTP(S) requests to the web server correctly.

This could allow an attacker to exhaust system resources and create a denial of service condition for the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://cert-portal.siemens.com/productcert/pdf/ssa-892915.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-892915.pdf
CVE: CVE-2022-47375
Published: 2023-12-12
Description: A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions). The affected products do not handle long file names correctly.

This could allow an attacker to create a buffer overflow and create a denial of service condition for the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-805, CWE-119
References: https://cert-portal.siemens.com/productcert/pdf/ssa-892915.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-892915.pdf
CVE: CVE-2023-38380
Published: 2023-12-12
Description: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE (All versions < V3.4.29), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) (All versions < V3.0.37), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SINAMICS S210 (6SL5...) (All versions >= V6.1 < V6.1 HF2), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) (All versions < V3.0.37). The webserver implementation of the affected products does not correctly release allocated memory after it has been used.

An attacker with network access could use this vulnerability to cause a denial-of-service condition in the webserver of the affected product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://cert-portal.siemens.com/productcert/html/ssa-139628.html; https://cert-portal.siemens.com/productcert/html/ssa-625862.html; https://cert-portal.siemens.com/productcert/html/ssa-693975.html
CVE: CVE-2023-46156
Published: 2023-12-12
Description: Affected devices improperly handle specially crafted packets sent to port 102/tcp.
This could allow an attacker to create a denial of service condition. A restart is needed to restore
normal operations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://cert-portal.siemens.com/productcert/html/ssa-280603.html; https://cert-portal.siemens.com/productcert/html/ssa-592380.html; https://cert-portal.siemens.com/productcert/pdf/ssa-280603.pdf
CVE: CVE-2023-46281
Published: 2023-12-12
Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). When accessing the UMC Web-UI from affected products, UMC uses an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.
CVSS Score: 7.1 (HIGH)
CWE: CWE-942
References: https://cert-portal.siemens.com/productcert/html/ssa-999588.html; https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf; https://cert-portal.siemens.com/productcert/html/ssa-999588.html
CVE: CVE-2023-46282
Published: 2023-12-12
Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected applications that could allow an attacker to inject arbitrary JavaScript code. The code could be potentially executed later by another (possibly privileged) user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/html/ssa-999588.html; https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf; https://cert-portal.siemens.com/productcert/html/ssa-999588.html
CVE: CVE-2023-46283
Published: 2023-12-12
Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an out of bounds write past the end of an allocated buffer when handling specific requests on port 4002/tcp. This could allow an attacker to crash the application. The corresponding service is auto-restarted after the crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/html/ssa-999588.html; https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf; https://cert-portal.siemens.com/productcert/html/ssa-999588.html
CVE: CVE-2023-46284
Published: 2023-12-12
Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an out of bounds write past the end of an allocated buffer when handling specific requests on port 4002/tcp and 4004/tcp. This could allow an attacker to crash the application. The corresponding service is auto-restarted after the crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-999588.html; https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf; https://cert-portal.siemens.com/productcert/html/ssa-999588.html
CVE: CVE-2023-46285
Published: 2023-12-12
Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an improper input validation vulnerability that could allow an attacker to bring the service into a Denial-of-Service state by sending a specifically crafted message to 4004/tcp. The corresponding service is auto-restarted after the crash is detected by a watchdog.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/html/ssa-999588.html; https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf; https://cert-portal.siemens.com/productcert/html/ssa-999588.html
CVE: CVE-2023-48427
Published: 2023-12-12
Description: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the configured UMC server. This could allow an attacker to intercept credentials that are sent to the UMC server as well as to manipulate responses, potentially allowing an attacker to escalate privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf
CVE: CVE-2023-48428
Published: 2023-12-12
Description: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism of affected products does not correctly check uploaded certificates. A malicious admin could upload a crafted certificate resulting in a denial-of-service condition or potentially issue commands on system level.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf
CVE: CVE-2023-48429
Published: 2023-12-12
Description: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices does not check the length of parameters in certain conditions. This allows a malicious admin to crash the server by sending a crafted request to the server. The server will automatically restart.
CVSS Score: 2.7 (LOW)
CWE: CWE-394, CWE-754
References: https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf
CVE: CVE-2023-48430
Published: 2023-12-12
Description: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The REST API of affected devices does not check the length of parameters in certain conditions. This allows a malicious admin to crash the server by sending a crafted request to the API. The server will automatically restart.
CVSS Score: 2.7 (LOW)
CWE: CWE-392
References: https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf
CVE: CVE-2023-48431
Published: 2023-12-12
Description: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correctly validate the response received by an UMC server. An attacker can use this to crash the affected software by providing and configuring a malicious UMC server or by manipulating the traffic from a legitimate UMC server (i.e. leveraging CVE-2023-48427).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf
CVE: CVE-2023-49691
Published: 2023-12-12
Description: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.0), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V8.0), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.0), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.0), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.0), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.0), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.0), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.0), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.0), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.0), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.0), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.0), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.0), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.0), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.0). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the handling of the DDNS configuration. This could allow malicious local administrators to issue commands on system level after a successful IP address update.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/html/ssa-180704.html; https://cert-portal.siemens.com/productcert/html/ssa-602936.html; https://cert-portal.siemens.com/productcert/html/ssa-690517.html
CVE: CVE-2023-49692
Published: 2023-12-12
Description: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V7.2.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V7.2.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V7.2.2), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V7.2.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V7.2.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V7.2.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V7.2.2), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V7.2.2), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V7.2.2). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the parsing of the IPSEC configuration. This could allow malicious local administrators to issue commands on system level after a new connection is established.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/html/ssa-068047.html; https://cert-portal.siemens.com/productcert/html/ssa-602936.html; https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdf
CVE: CVE-2020-12615
Published: 2023-12-12
Description: An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When adding the Add Admin token to a process, and specifying that it runs at medium integrity with the user owning the process, this security token can be stolen and applied to arbitrary processes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1; https://www.beyondtrust.com/trust-center/security-advisories/bt22-07; https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1
CVE: CVE-2020-12612
Published: 2023-12-12
Description: An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When specifying a program to elevate, it can typically be found within the Program Files (x86) folder and therefore uses the %ProgramFiles(x86)% environment variable. However, when this same policy gets pushed to a 32bit machine, this environment variable does not exist. Therefore, since the standard user can create a user level environment variable, they can repoint this variable to any folder the user has full control of. Then, the folder structure can be created in such a way that a rule matches and arbitrary code runs elevated.
CVSS Score: 7.8 (HIGH)
References: https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1; https://www.beyondtrust.com/trust-center/security-advisories/bt22-09; https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1
CVE: CVE-2023-49990
Published: 2023-12-12
Description: Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/espeak-ng/espeak-ng/issues/1824; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/
CVE: CVE-2023-49991
Published: 2023-12-12
Description: Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://github.com/espeak-ng/espeak-ng/issues/1825; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/
CVE: CVE-2023-49992
Published: 2023-12-12
Description: Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://github.com/espeak-ng/espeak-ng/issues/1827; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/
CVE: CVE-2023-49993
Published: 2023-12-12
Description: Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/espeak-ng/espeak-ng/issues/1826; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/