deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-42444
Published: 2023-09-19
Description: phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.
CVSS Score: 8.6 (HIGH)
CWE: CWE-248, CWE-392, CWE-1284, CWE-1284
References: https://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6; https://github.com/whisperfish/rust-phonenumber/commit/bea8e732b9cada617ede5cf51663dba183747f71; https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-whhr-7f2w-qqj2
CVE: CVE-2023-42447
Published: 2023-09-19
Description: blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.
CVSS Score: 8.6 (HIGH)
CWE: CWE-248, CWE-392, CWE-1284, CWE-1284
References: https://github.com/whisperfish/blurhash-rs/security/advisories/GHSA-cxvp-82cq-57h2; https://github.com/whisperfish/blurhash-rs/security/advisories/GHSA-cxvp-82cq-57h2
CVE: CVE-2023-32182
Published: 2023-09-19
Description: A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32182; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32182
CVE: CVE-2023-38351
Published: 2023-09-19
Description: MiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers to achieve remote code execution through a man in the middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://0dr3f.github.io/cve/; https://0dr3f.github.io/cve/
CVE: CVE-2023-38352
Published: 2023-09-19
Description: MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in the middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://0dr3f.github.io/cve/; https://0dr3f.github.io/cve/
CVE: CVE-2023-38353
Published: 2023-09-19
Description: MiniTool Power Data Recovery version 11.6 and before contains an insecure in-app payment system that allows attackers to steal highly sensitive information through a man in the middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://0dr3f.github.io/cve/; https://0dr3f.github.io/cve/
CVE: CVE-2023-38354
Published: 2023-09-19
Description: MiniTool Shadow Maker version 4.1 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://0dr3f.github.io/cve/; https://0dr3f.github.io/cve/
CVE: CVE-2023-38355
Published: 2023-09-19
Description: MiniTool Movie Maker 7.0 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://0dr3f.github.io/cve/; https://0dr3f.github.io/cve/
CVE: CVE-2023-38356
Published: 2023-09-19
Description: MiniTool Power Data Recovery 11.6 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://0dr3f.github.io/cve/; https://0dr3f.github.io/cve/
CVE: CVE-2023-42450
Published: 2023-09-19
Description: Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if the server configuration includes `ALLOWED_PRIVATE_ADDRESSES` to allow access to local exploitable services. Version 4.2.0-rc2 has a patch for the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-113, CWE-918
References: https://github.com/mastodon/mastodon/commit/94893cf24fc95b32cc7a756262acbe008c20a9d2; https://github.com/mastodon/mastodon/security/advisories/GHSA-hcqf-fw2r-52g4; https://github.com/mastodon/mastodon/commit/94893cf24fc95b32cc7a756262acbe008c20a9d2
CVE: CVE-2023-42451
Published: 2023-09-19
Description: Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.
CVSS Score: 7.4 (HIGH)
CWE: CWE-706
References: https://github.com/mastodon/mastodon/commit/eeab3560fc0516070b3fb97e089b15ecab1938c8; https://github.com/mastodon/mastodon/security/advisories/GHSA-v3xf-c9qf-j667; https://github.com/mastodon/mastodon/commit/eeab3560fc0516070b3fb97e089b15ecab1938c8
CVE: CVE-2023-42452
Published: 2023-09-19
Description: Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to execute in the browser. The impact is limited thanks to Mastodon's strict Content Security Policy, blocking inline scripts, etc. However a CSP bypass or loophole could be exploited to execute malicious XSS. Furthermore, it requires user interaction, as this can only occur upon clicking the “Translate” button on a malicious post. Versions 4.0.10, 4.2.8, and 4.2.0-rc2 contain a patch for this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mastodon/mastodon/commit/ff32475f5f4a84ebf9619e7eef5bf8b4c075d0e2; https://github.com/mastodon/mastodon/security/advisories/GHSA-2693-xr3m-jhqr; https://github.com/mastodon/mastodon/commit/ff32475f5f4a84ebf9619e7eef5bf8b4c075d0e2
CVE: CVE-2023-22513
Published: 2023-09-19
Description: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bitbucket Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bitbucket Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.5 Bitbucket Data Center and Server 8.10: Upgrade to a release greater than or equal to 8.10.5 Bitbucket Data Center and Server 8.11: Upgrade to a release greater than or equal to 8.11.4 Bitbucket Data Center and Server 8.12: Upgrade to a release greater than or equal to 8.12.2 Bitbucket Data Center and Server 8.13: Upgrade to a release greater than or equal to 8.13.1 Bitbucket Data Center and Server 8.14: Upgrade to a release greater than or equal to 8.14.0 Bitbucket Data Center and Server version >= 8.0 and < 8.9: Upgrade to any of the listed fix versions. See the release notes (https://confluence.atlassian.com/bitbucketserver/release-notes). You can download the latest version of Bitbucket Data Center and Server from the download center (https://www.atlassian.com/software/bitbucket/download-archives). This vulnerability was discovered by a private user and reported via our Bug Bounty program
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://jira.atlassian.com/browse/BSERV-14419; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]
CVE: CVE-2023-42793
Published: 2023-09-19
Description: In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html; https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793; https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/
CVE: CVE-2023-43566
Published: 2023-09-19
Description: In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-2995
Published: 2023-09-19
Description: The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/762ff2ca-5c1f-49ae-b83c-1c22bacbc82f; https://wpscan.com/vulnerability/762ff2ca-5c1f-49ae-b83c-1c22bacbc82f
CVE: CVE-2023-4376
Published: 2023-09-19
Description: The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/13910e52-5302-4252-8bee-49dd1f0e180a; https://wpscan.com/vulnerability/13910e52-5302-4252-8bee-49dd1f0e180a
CVE: CVE-2023-40931
Published: 2023-09-19
Description: A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://nagios.com; https://outpost24.com/blog/nagios-xi-vulnerabilities/; https://www.nagios.com/products/security/
CVE: CVE-2023-40932
Published: 2023-09-19
Description: A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://nagios.com; https://outpost24.com/blog/nagios-xi-vulnerabilities/; https://www.nagios.com/products/security/
CVE: CVE-2023-40933
Published: 2023-09-19
Description: A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://nagios.com; https://outpost24.com/blog/nagios-xi-vulnerabilities/; https://www.nagios.com/products/security/
CVE: CVE-2023-40934
Published: 2023-09-19
Description: A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://nagios.com; https://outpost24.com/blog/nagios-xi-vulnerabilities/; https://www.nagios.com/products/security/
CVE: CVE-2020-24089
Published: 2023-09-20
Description: An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a denial of service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/rjt-gupta/CVE-2020-24089; https://github.com/rjt-gupta/CVE-2020-24089
CVE: CVE-2023-36319
Published: 2023-09-20
Description: File Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute arbitrary code via the action parameter of the compress-inc.php file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/Lowalu/CVE-2023-36319; https://openupload.sourceforge.net/; https://github.com/Lowalu/CVE-2023-36319
CVE: CVE-2023-39575
Published: 2023-09-20
Description: A reflected cross-site scripting (XSS) vulnerability in the url_str URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://evait.medium.com/discovery-of-a-reflective-xss-vulnerability-in-arp-guard-software-1734b5113e1c; https://evait.medium.com/discovery-of-a-reflective-xss-vulnerability-in-arp-guard-software-1734b5113e1c
CVE: CVE-2023-25525
Published: 2023-09-20
Description: NVIDIA Cumulus Linux contains a vulnerability in forwarding where a VxLAN-encapsulated IPv6 packet received on an SVI interface with DMAC/DIPv6 set to the link-local address of the SVI interface may be incorrectly forwarded. A successful exploit may lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5480; https://nvidia.custhelp.com/app/answers/detail/a_id/5480
CVE: CVE-2023-25526
Published: 2023-09-20
Description: NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exception by injecting a crafted packet. A successful exploit may lead to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5480; https://nvidia.custhelp.com/app/answers/detail/a_id/5480
CVE: CVE-2023-25527
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in the host KVM daemon, where an authenticated local attacker may cause corruption of kernel memory. A successful exploit of this vulnerability may lead to arbitrary kernel code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-25528
Published: 2023-09-20
Description: NVIDIA DGX H100 baseboard management controller (BMC) contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-25529
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another user’s session token by observing timing discrepancies between server responses. A successful exploit of this vulnerability may lead to information disclosure, escalation of privileges, and data tampering.
CVSS Score: 8.0 (HIGH)
CWE: CWE-208, CWE-203
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5510; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-25530
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-25531
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerability may lead to code execution, denial of service, information disclosure, and escalation of privileges.
CVSS Score: 7.6 (HIGH)
CWE: CWE-522, CWE-522
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-25532
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerability may lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-25533
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in the web UI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to information disclosure, code execution, and escalation of privileges.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-25534
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-31008
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of services, escalation of privileges, and information disclosure.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-31009
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20, CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-38886
Published: 2023-09-20
Description: An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://dolibarr.com; https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38886_Dolibarr_RCE-1.pdf; http://dolibarr.com
CVE: CVE-2023-38887
Published: 2023-09-20
Description: File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: http://dolibarr.com; https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38887_Dolibarr_AFU.pdf; http://dolibarr.com
CVE: CVE-2023-38888
Published: 2023-09-20
Description: Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: http://dolibarr.com; https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38888_Dolibarr_XSS.pdf; http://dolibarr.com
CVE: CVE-2023-31010
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges, information disclosure, and denial of service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-31011
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-31012
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-31013
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473
CVE: CVE-2023-31014
Published: 2023-09-20
Description: NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device can process the implicit intent meant for the streamer component. A successful exploit of this vulnerability may lead to limited information disclosure, denial of service, and code execution.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-927, CWE-668
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5476; https://nvidia.custhelp.com/app/answers/detail/a_id/5476
CVE: CVE-2023-31015
Published: 2023-09-20
Description: NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. A successful exploit of this vulnerability may lead to escalation of privileges, information disclosure, code execution, and denial of service.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5473; https://nvidia.custhelp.com/app/answers/detail/a_id/5473