deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38851
Published: 2023-08-15
Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1018.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/libxls/libxls/issues/124; https://github.com/libxls/libxls/issues/124
CVE: CVE-2023-38852
Published: 2023-08-15
Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the unicode_decode_wcstombs function in xlstool.c:266.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/libxls/libxls/issues/124; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQYGEBDBCOWBRHOW44BSSRADUOZBXHUE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHBUPYF2NX34HNAWZ3WYHKWU3KWVQUSV/
CVE: CVE-2023-38853
Published: 2023-08-15
Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1015.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/libxls/libxls/issues/124; https://github.com/libxls/libxls/issues/124
CVE: CVE-2023-38854
Published: 2023-08-15
Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the transcode_latin1_to_utf8 function in xlstool.c:296.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/libxls/libxls/issues/124; https://github.com/libxls/libxls/issues/124
CVE: CVE-2023-38855
Published: 2023-08-15
Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get_string function in xlstool.c:395.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/libxls/libxls/issues/124; https://github.com/libxls/libxls/issues/124
CVE: CVE-2023-38856
Published: 2023-08-15
Description: Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get_string function in xlstool.c:411.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/libxls/libxls/issues/124; https://github.com/libxls/libxls/issues/124
CVE: CVE-2023-38857
Published: 2023-08-15
Description: Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stcoin function in mp4read.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/knik0/faad2/issues/171; https://security.gentoo.org/glsa/202401-13; https://github.com/knik0/faad2/issues/171
CVE: CVE-2023-38858
Published: 2023-08-15
Description: Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/knik0/faad2/issues/173; https://security.gentoo.org/glsa/202401-13; https://github.com/knik0/faad2/issues/173
CVE: CVE-2023-38860
Published: 2023-08-15
Description: An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/hwchase17/langchain/issues/7641; https://github.com/hwchase17/langchain/issues/7641
CVE: CVE-2023-38889
Published: 2023-08-15
Description: An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Alluxio/alluxio/issues/17766; https://github.com/Alluxio/alluxio/issues/17766
CVE: CVE-2023-38896
Published: 2023-08-15
Description: An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/hwchase17/langchain/issues/5872; https://github.com/hwchase17/langchain/pull/6003; https://twitter.com/llm_sec/status/[PII_REDACTED]87375876
CVE: CVE-2023-38898
Published: 2023-08-15
Description: An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there are no common scenarios in which an adversary can call _asyncio._swap_current_task but does not already have the ability to call arbitrary functions; and (3) there are no common scenarios in which sensitive information, which is not already accessible to an adversary, becomes accessible through this bug.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/python/cpython/issues/105987; https://github.com/python/cpython/issues/105987
CVE: CVE-2023-38915
Published: 2023-08-15
Description: File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbtirary code via the upload type function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/wolf-leo/EasyAdmin8/issues/1; https://github.com/wolf-leo/EasyAdmin8/issues/1
CVE: CVE-2023-38916
Published: 2023-08-15
Description: SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the user input fields.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Mohammad-Ajazuddin/eVotingSytem-PHP/issues/1; https://github.com/Mohammad-Ajazuddin/eVotingSytem-PHP/issues/1
CVE: CVE-2023-39438
Published: 2023-08-15
Description: A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as well as custom fields the CLA requester had configured. In addition, an arbitrary authenticated user can update or delete the CLA-configuration for repositories or organizations using CLA-assistant. The stored access tokens for GitHub are not affected, as these are redacted from the API-responses.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-gw8p-frwv-25gh; https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-gw8p-frwv-25gh
CVE: CVE-2023-39659
Published: 2023-08-15
Description: An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/langchain-ai/langchain/issues/7700; https://github.com/langchain-ai/langchain/pull/5640; https://github.com/langchain-ai/langchain/issues/7700
CVE: CVE-2023-39661
Published: 2023-08-15
Description: An issue in pandas-ai v.0.9.1 and before allows a remote attacker to execute arbitrary code via the _is_jailbreak function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/gventuri/pandas-ai/issues/410; https://github.com/gventuri/pandas-ai/issues/410
CVE: CVE-2023-39662
Published: 2023-08-15
Description: An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/jerryjliu/llama_index/issues/7054; https://github.com/jerryjliu/llama_index/issues/7054
CVE: CVE-2023-2312
Published: 2023-08-15
Description: Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1448548; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-40027
Published: 2023-08-15
Description: Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible (no session required) if a `session` strategy is not defined. This vulnerability does not affect developers using the `@keystone-6/auth` package, or any users that have written their own `ui.isAccessAllowed` (that is to say, `isAccessAllowed` is not `undefined`). This vulnerability does affect users who believed that their `session` strategy will, by default, enforce that `adminMeta` is inaccessible by the public in accordance with that strategy; akin to the behaviour of the AdminUI middleware. This vulnerability has been patched in `@keystone-6/core` version `5.5.1`. Users are advised to upgrade. Users unable to upgrade may opt to write their own `isAccessAllowed` functionality to work-around this vulnerability.
CVSS Score: 3.7 (LOW)
CWE: CWE-862
References: https://github.com/keystonejs/keystone/commit/650e27e6e9b42abfb94c340c8470faf61f0ff284; https://github.com/keystonejs/keystone/pull/8771; https://github.com/keystonejs/keystone/security/advisories/GHSA-9cvc-v7wm-992c
CVE: CVE-2023-40028
Published: 2023-08-15
Description: Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-59
References: https://github.com/TryGhost/Ghost/commit/690fbf3f7302ff3f77159c0795928bdd20f41205; https://github.com/TryGhost/Ghost/security/advisories/GHSA-9c9v-w225-v5rg; https://github.com/TryGhost/Ghost/commit/690fbf3f7302ff3f77159c0795928bdd20f41205
CVE: CVE-2023-4345
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged user
CVSS Score: 6.5 (MEDIUM)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4349
Published: 2023-08-15
Description: Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1458303; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4350
Published: 2023-08-15
Description: Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1454817; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4351
Published: 2023-08-15
Description: Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1465833; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4352
Published: 2023-08-15
Description: Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: http://packetstormsecurity.com/files/174669/Chrome-Read-Only-Property-Overwrite.html; https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1452076
CVE: CVE-2023-4353
Published: 2023-08-15
Description: Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1458046; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4354
Published: 2023-08-15
Description: Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/174949/Chrome-SKIA-Integer-Overflow.html; https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1464215
CVE: CVE-2023-4355
Published: 2023-08-15
Description: Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/174950/Chrome-Dangling-FixedArray-Pointers-Memory-Corruption.html; https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1468943
CVE: CVE-2023-4356
Published: 2023-08-15
Description: Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1449929; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4357
Published: 2023-08-15
Description: Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1458911; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4358
Published: 2023-08-15
Description: Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1466415; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4359
Published: 2023-08-15
Description: Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 5.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1443722; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4360
Published: 2023-08-15
Description: Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1462723; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4361
Published: 2023-08-15
Description: Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 5.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1465230; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4362
Published: 2023-08-15
Description: Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1316379; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4363
Published: 2023-08-15
Description: Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1367085; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4364
Published: 2023-08-15
Description: Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1406922; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4365
Published: 2023-08-15
Description: Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1431043; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4366
Published: 2023-08-15
Description: Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1450784; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4367
Published: 2023-08-15
Description: Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1467743; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4368
Published: 2023-08-15
Description: Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html; https://crbug.com/1467751; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
CVE: CVE-2023-4369
Published: 2023-08-15
Description: Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to 116.0.5845.120 allowed an attacker who convinced a user to install a malicious extension to bypass file restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-chromeos_25.html; https://crbug.com/1464456; https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-chromeos_25.html
CVE: CVE-2023-38401
Published: 2023-08-15
Description: A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow local users to elevate privileges. Successful exploitation could allow execution of arbitrary code with NT AUTHORITY\SYSTEM privileges on the operating system.
CVSS Score: 7.8 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-011.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-011.txt
CVE: CVE-2023-38402
Published: 2023-08-15
Description: A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could allow these malicious users to create a Denial-of-Service (DoS) condition affecting the Microsoft Windows operating System boot process.
CVSS Score: 7.1 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-011.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-011.txt