deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1221
Published: 2023-03-07
Description: Insufficient policy enforcement in Extensions API in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1385343; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1222
Published: 2023-03-07
Description: Heap buffer overflow in Web Audio API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1403515; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1223
Published: 2023-03-07
Description: Insufficient policy enforcement in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1398579; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1224
Published: 2023-03-07
Description: Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1403539; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1225
Published: 2023-03-07
Description: Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 111.0.5563.64 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1408799; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1226
Published: 2023-03-07
Description: Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1013080; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1227
Published: 2023-03-07
Description: Use after free in Core in Google Chrome on Lacros prior to 111.0.5563.64 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1348791; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1228
Published: 2023-03-07
Description: Insufficient policy enforcement in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1365100; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1229
Published: 2023-03-07
Description: Inappropriate implementation in Permission prompts in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1160485; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1230
Published: 2023-03-07
Description: Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1404230; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1231
Published: 2023-03-07
Description: Inappropriate implementation in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to potentially spoof the contents of the omnibox via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1274887; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1232
Published: 2023-03-07
Description: Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to obtain potentially sensitive information from API via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1346924; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1233
Published: 2023-03-07
Description: Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from API via a crafted Chrome Extension. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1045681; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1234
Published: 2023-03-07
Description: Inappropriate implementation in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1404621; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1235
Published: 2023-03-07
Description: Type confusion in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted UI interaction. (Chromium security severity: Low)
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1404704; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1236
Published: 2023-03-07
Description: Inappropriate implementation in Internals in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to spoof the origin of an iframe via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html; https://crbug.com/1374518; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
CVE: CVE-2023-1263
Published: 2023-03-07
Description: The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6  via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.6/niteo-cmp.php#L2759; https://www.wordfence.com/threat-intel/vulnerabilities/id/e01b4259-ed8d-44a4-9771-470de45b14a8?source=cve; https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.6/niteo-cmp.php#L2759
CVE: CVE-2023-1264
Published: 2023-03-07
Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/vim/vim/commit/7ac5023a5f1a37baafbe1043645f97ba3443d9f6; https://huntr.dev/bounties/b2989095-88f3-413a-9a39-c1c58a6e6815; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIAKPMKJ4OZ6NYRZJO7YWMNQL2BICLYV/
CVE: CVE-2023-26823
Published: 2023-03-07
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-0783. Reason: This record is a duplicate of CVE-2023-0783. Notes: All CVE users should reference CVE-2023-0783 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2021-23220
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
CVE: CVE-2021-23224
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
CVE: CVE-2021-23232
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
CVE: CVE-2021-26246
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
CVE: CVE-2022-21224
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-25889
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-25920
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-25957
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-25968
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-25997
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26027
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26031
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26039
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26053
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26055
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26058
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26087
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26123
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26339
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26347
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26416
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2022-26418
Published: 2023-03-07
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2022.
CVE: CVE-2023-24780
Published: 2023-03-08
Description: Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/funadmin/funadmin/issues/6; https://github.com/funadmin/funadmin/issues/6
CVE: CVE-2023-27476
Published: 2023-03-08
Description: OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://github.com/geopython/OWSLib/pull/863/commits/b92687702be9576c0681bb11cad21eb631b9122f; https://github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc; https://lists.debian.org/debian-lts-announce/2023/06/msg00032.html
CVE: CVE-2023-0089
Published: 2023-03-08
Description: 
The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'.

This affects all versions 8.20.0 and below. 






CVSS Score: 8.8 (HIGH)
CWE: CWE-95, CWE-94
References: https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0001; https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0001
CVE: CVE-2023-0090
Published: 2023-03-08
Description: The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'.  Exploitation requires network access to the webservices API, but such access is a non-standard configuration.  This affects all versions 8.20.0 and below.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0001; https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0001
CVE: CVE-2023-24657
Published: 2023-03-08
Description: phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/phpipam/phpipam/issues/3738; https://github.com/phpipam/phpipam/issues/3738
CVE: CVE-2023-1269
Published: 2023-03-08
Description: Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/alextselegidis/easyappointments/commit/2731d2f17c5140c562426b857e9f5d63da5c4593; https://huntr.dev/bounties/91c31eb6-024d-4ad3-88fe-f15b03fd20f5; https://github.com/alextselegidis/easyappointments/commit/2731d2f17c5140c562426b857e9f5d63da5c4593
CVE: CVE-2023-23638
Published: 2023-03-08
Description: A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. 

This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions. 
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-502
References: https://lists.apache.org/thread/8h6zscfzj482z512d2v5ft63hdhzm0cb; https://lists.apache.org/thread/8h6zscfzj482z512d2v5ft63hdhzm0cb
CVE: CVE-2023-1267
Published: 2023-03-08
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ulkem Company PtteM Kart.This issue affects PtteM Kart: before 2.1.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0133; https://www.usom.gov.tr/bildirim/tr-23-0133
CVE: CVE-2023-26950
Published: 2023-03-08
Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Categories module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/keheying/onekeyadmin/issues/9; https://github.com/keheying/onekeyadmin/issues/9
CVE: CVE-2023-1270
Published: 2023-03-08
Description: Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/btcpayserver/btcpayserver/commit/7b5ce8f70c060b01990d3f7109e97e0144d878a4; https://huntr.dev/bounties/ad1f917f-2b25-40ef-9215-c805354c683b; https://github.com/btcpayserver/btcpayserver/commit/7b5ce8f70c060b01990d3f7109e97e0144d878a4
CVE: CVE-2023-25395
Published: 2023-03-08
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/Am1ngl/ttt/tree/main/22; https://github.com/Am1ngl/ttt/tree/main/22
CVE: CVE-2023-26952
Published: 2023-03-08
Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/keheying/onekeyadmin/issues/7; https://github.com/keheying/onekeyadmin/issues/7
CVE: CVE-2023-26261
Published: 2023-03-08
Description: In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://documentation.ubikasec.com/x/CQDAAw; https://gist.github.com/Jakick/7d1635b886654ddd0e476b3c79a7ba9f; https://documentation.ubikasec.com/x/CQDAAw
CVE: CVE-2023-24773
Published: 2023-03-08
Description: Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/funadmin/funadmin/issues/4; https://github.com/funadmin/funadmin/issues/4
CVE: CVE-2023-26922
Published: 2023-03-08
Description: SQL injection vulnerability found in Varisicte matrix-gui v.2 allows a remote attacker to execute arbitrary code via the shell_exect parameter to the \www\pages\matrix-gui-2.0 endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/varigit/matrix-gui-v2/issues/1; https://github.com/varigit/matrix-gui-v2/issues/1
CVE: CVE-2023-27088
Published: 2023-03-08
Description: feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within the permission of the admin super administrator and can use this vulnerability to change the blacklist IP address in the system at will.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/chen87548081/feiqu-opensource/issues/2; https://github.com/chen87548081/feiqu-opensource/issues/2
CVE: CVE-2022-46752
Published: 2023-03-08
Description: 
Dell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial of service.


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-285
References: https://www.dell.com/support/kbdoc/en-us/000207928/dsa-2023-011-dell-client-platform-security-update-for-a-bios-vulnerability; https://www.dell.com/support/kbdoc/en-us/000207928/dsa-2023-011-dell-client-platform-security-update-for-a-bios-vulnerability
CVE: CVE-2023-1275
Published: 2023-03-08
Description: A vulnerability classified as problematic was found in SourceCodester Phone Shop Sales Managements System 1.0. This vulnerability affects unknown code of the file /osms/assets/plugins/jquery-validation-1.11.1/demo/captcha/index.php of the component CAPTCHA Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222598 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/blairting/bug_report/blob/main/vendors/Roo/Phone%20Shop%20Sales%20Managements%20System/XSS-1.md; https://vuldb.com/?ctiid.222598; https://vuldb.com/?id.222598
CVE: CVE-2023-27482
Published: 2023-03-08
Description: homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected. The issue has been mitigated and closed in Supervisor version 2023.03.1, which has been rolled out to all affected installations via the auto-update feature of the Supervisor. This rollout has been completed at the time of publication of this advisory. Home Assistant Core 2023.3.0 included mitigation for this vulnerability. Upgrading to at least that version is thus advised. In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287
References: https://github.com/elttam/publications/blob/master/writeups/home-assistant/supervisor-authentication-bypass-advisory.md; https://github.com/home-assistant/core/security/advisories/GHSA-2j8f-h4mr-qr25; https://www.elttam.com/blog/pwnassistant/
CVE: CVE-2022-46394
Published: 2023-03-08
Description: An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Valhall r39p0 through r41p0 before r42p0, and Avalon r41p0 before r42p0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/support/arm-security-updates; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities