deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4825
Published: 2023-02-06
Description: The WP-ShowHide WordPress plugin before 1.05 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/a2758983-d3a7-4718-b5b8-30169df6780a; https://wpscan.com/vulnerability/a2758983-d3a7-4718-b5b8-30169df6780a
CVE: CVE-2022-4826
Published: 2023-02-06
Description: The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/59fa32d2-aa66-4980-9ee5-0a7513f3a2b0; https://wpscan.com/vulnerability/59fa32d2-aa66-4980-9ee5-0a7513f3a2b0
CVE: CVE-2022-4833
Published: 2023-02-06
Description: The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/35ba38cf-4f23-4344-8de3-cf3004ebf84c; https://wpscan.com/vulnerability/35ba38cf-4f23-4344-8de3-cf3004ebf84c
CVE: CVE-2022-4836
Published: 2023-02-06
Description: The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/e9a228dc-d32e-4918-898d-4d7af4662a14; https://wpscan.com/vulnerability/e9a228dc-d32e-4918-898d-4d7af4662a14
CVE: CVE-2022-4838
Published: 2023-02-06
Description: The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9937e369-60e8-451c-8790-1a83a59115fc; https://wpscan.com/vulnerability/9937e369-60e8-451c-8790-1a83a59115fc
CVE: CVE-2023-0062
Published: 2023-02-06
Description: The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/450f94a3-56b1-41c7-ac29-fbda1dc04794; https://wpscan.com/vulnerability/450f94a3-56b1-41c7-ac29-fbda1dc04794
CVE: CVE-2023-0070
Published: 2023-02-06
Description: The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/0d8fbd1a-9fac-42ac-94e0-f8921deb1696; https://wpscan.com/vulnerability/0d8fbd1a-9fac-42ac-94e0-f8921deb1696
CVE: CVE-2023-0072
Published: 2023-02-06
Description: The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/bb2b876f-7216-4f31-9d1f-a45405c545ce; https://wpscan.com/vulnerability/bb2b876f-7216-4f31-9d1f-a45405c545ce
CVE: CVE-2023-0081
Published: 2023-02-06
Description: The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/76d2963c-ebff-498f-9484-3c3008750c14; https://wpscan.com/vulnerability/76d2963c-ebff-498f-9484-3c3008750c14
CVE: CVE-2023-0082
Published: 2023-02-06
Description: The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/e1ba5047-0c39-478f-89c7-b0bb638efdff; https://wpscan.com/vulnerability/e1ba5047-0c39-478f-89c7-b0bb638efdff
CVE: CVE-2023-0095
Published: 2023-02-06
Description: The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/009ca72e-e8fa-4fdc-ab2d-4210f8f4710f; https://wpscan.com/vulnerability/009ca72e-e8fa-4fdc-ab2d-4210f8f4710f
CVE: CVE-2023-0096
Published: 2023-02-06
Description: The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/b28150e7-214b-4bcd-85c0-e819c4223484; https://wpscan.com/vulnerability/b28150e7-214b-4bcd-85c0-e819c4223484
CVE: CVE-2023-0143
Published: 2023-02-06
Description: The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/c4cd3d98-9678-49cb-9d1a-551ef8a810b9; https://wpscan.com/vulnerability/c4cd3d98-9678-49cb-9d1a-551ef8a810b9
CVE: CVE-2023-0144
Published: 2023-02-06
Description: The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d7b3917a-d11f-4216-9d2c-30771d83a7b4; https://wpscan.com/vulnerability/d7b3917a-d11f-4216-9d2c-30771d83a7b4
CVE: CVE-2023-0146
Published: 2023-02-06
Description: The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/d1218c69-4f6a-4b2d-a537-5cc16a46ba7b; https://wpscan.com/vulnerability/d1218c69-4f6a-4b2d-a537-5cc16a46ba7b
CVE: CVE-2023-0147
Published: 2023-02-06
Description: The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/af9cbb4a-42fc-43c5-88f3-349b417f1a6a; https://wpscan.com/vulnerability/af9cbb4a-42fc-43c5-88f3-349b417f1a6a
CVE: CVE-2023-0148
Published: 2023-02-06
Description: The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/f15f2f2c-2053-4b93-8064-15b5243a4021; https://wpscan.com/vulnerability/f15f2f2c-2053-4b93-8064-15b5243a4021
CVE: CVE-2023-0149
Published: 2023-02-06
Description: The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/6b6f9e42-7f7f-4daa-99c9-14a24a6d76b0; https://wpscan.com/vulnerability/6b6f9e42-7f7f-4daa-99c9-14a24a6d76b0
CVE: CVE-2023-0150
Published: 2023-02-06
Description: The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/517154dc-d6bd-462d-b955-061a7b7f8da5; https://wpscan.com/vulnerability/517154dc-d6bd-462d-b955-061a7b7f8da5
CVE: CVE-2023-0153
Published: 2023-02-06
Description: The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/f3459868-28aa-4a5d-94d8-bbc17e3ce653; https://wpscan.com/vulnerability/f3459868-28aa-4a5d-94d8-bbc17e3ce653
CVE: CVE-2023-0154
Published: 2023-02-06
Description: The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/5e66e173-776d-4423-b4a2-eb7316b2502f; https://wpscan.com/vulnerability/5e66e173-776d-4423-b4a2-eb7316b2502f
CVE: CVE-2023-0170
Published: 2023-02-06
Description: The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/19ee5e33-acc8-40c5-8f54-c9cb0fa491f0; https://wpscan.com/vulnerability/19ee5e33-acc8-40c5-8f54-c9cb0fa491f0
CVE: CVE-2023-0171
Published: 2023-02-06
Description: The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/32324655-ff91-4a53-a2c5-ebe6678d4a9d; https://wpscan.com/vulnerability/32324655-ff91-4a53-a2c5-ebe6678d4a9d
CVE: CVE-2023-0173
Published: 2023-02-06
Description: The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/c543b6e2-a7c0-4ba7-a308-e9951dd59fb9; https://wpscan.com/vulnerability/c543b6e2-a7c0-4ba7-a308-e9951dd59fb9
CVE: CVE-2023-0174
Published: 2023-02-06
Description: The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6b53d0e6-def9-4907-bd2b-884b2afa52b3; https://wpscan.com/vulnerability/6b53d0e6-def9-4907-bd2b-884b2afa52b3
CVE: CVE-2023-0176
Published: 2023-02-06
Description: The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/a762c25b-5c47-400e-8964-407cf4c94e9f; https://wpscan.com/vulnerability/a762c25b-5c47-400e-8964-407cf4c94e9f
CVE: CVE-2023-0178
Published: 2023-02-06
Description: The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/cc308e15-7937-4d41-809d-74f8c13bee23; https://wpscan.com/vulnerability/cc308e15-7937-4d41-809d-74f8c13bee23
CVE: CVE-2023-0234
Published: 2023-02-06
Description: The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
CVSS Score: 8.8 (HIGH)
References: https://github.com/namah-age/CVEs/blob/master/1.md; https://wpscan.com/vulnerability/acf3e369-1290-4b3f-83bf-2209b9dd06e1; https://www.siteground.com/viewtos/responsible_disclosure_policy?scid=4&lang=en
CVE: CVE-2023-0236
Published: 2023-02-06
Description: The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/503835db-426d-4b49-85f7-c9a20d6ff5b8; https://wpscan.com/vulnerability/503835db-426d-4b49-85f7-c9a20d6ff5b8
CVE: CVE-2023-0252
Published: 2023-02-06
Description: The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/5754a4fd-1adf-47aa-976f-3b28750058c2; https://wpscan.com/vulnerability/5754a4fd-1adf-47aa-976f-3b28750058c2
CVE: CVE-2023-0282
Published: 2023-02-06
Description: The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/93693d45-5217-4571-bae5-aab8878cfe62; https://wpscan.com/vulnerability/93693d45-5217-4571-bae5-aab8878cfe62
CVE: CVE-2023-0669
Published: 2023-02-06
Description: Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html; https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis; https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft
CVE: CVE-2023-0686
Published: 2023-02-06
Description: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects the function update_cart of the file /oews/classes/Master.php?f=update_cart of the component HTTP POST Request Handler. The manipulation of the argument cart_id leads to sql injection. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The identifier VDB-220245 was assigned to this vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.220245; https://vuldb.com/?id.220245; https://vuldb.com/?ctiid.220245
CVE: CVE-2023-20602
Published: 2023-02-06
Description: In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494107; Issue ID: ALPS07494107.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20604
Published: 2023-02-06
Description: In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494067; Issue ID: ALPS07494067.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20605
Published: 2023-02-06
Description: In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07550104; Issue ID: ALPS07550104.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20606
Published: 2023-02-06
Description: In apusys, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07571104; Issue ID: ALPS07571104.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20607
Published: 2023-02-06
Description: In ccu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07512839; Issue ID: ALPS07512839.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-662, CWE-662
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20608
Published: 2023-02-06
Description: In display drm, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363599; Issue ID: ALPS07363599.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20609
Published: 2023-02-06
Description: In ccu, there is a possible out of bounds read due to a logic error. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07570864; Issue ID: ALPS07570864.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20610
Published: 2023-02-06
Description: In display drm, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363469; Issue ID: ALPS07363469.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-662, CWE-662
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20611
Published: 2023-02-06
Description: In gpu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07588678; Issue ID: ALPS07588678.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-662, CWE-662
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20612
Published: 2023-02-06
Description: In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629571; Issue ID: ALPS07629571.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20613
Published: 2023-02-06
Description: In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628614; Issue ID: ALPS07628614.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20614
Published: 2023-02-06
Description: In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628615; Issue ID: ALPS07628615.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20615
Published: 2023-02-06
Description: In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629572; Issue ID: ALPS07629572.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023