deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-36686
Published: 2023-08-05
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CartFlows Pro plugin <= 1.11.11 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cartflows-pro/wordpress-cartflows-pro-plugin-1-11-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cartflows-pro/wordpress-cartflows-pro-plugin-1-11-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-36689
Published: 2023-08-05
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory WPFactory Helper plugin <= 1.5.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpcodefactory-helper/wordpress-wpfactory-helper-plugin-1-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpcodefactory-helper/wordpress-wpfactory-helper-plugin-1-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-37873
Published: 2023-08-05
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-37874
Published: 2023-08-05
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dimitar Ivanov HTTP Headers plugin <= 1.18.11 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/http-headers/wordpress-http-headers-plugin-1-18-11-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/http-headers/wordpress-http-headers-plugin-1-18-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-4172
Published: 2023-08-05
Description: A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some unknown processing of the file \Service\FileHandler.ashx. The manipulation of the argument FileDirectory leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236207.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-36, CWE-22
References: https://github.com/nagenanhai/cve/blob/main/duqu2.md; https://vuldb.com/?ctiid.236207; https://vuldb.com/?id.236207
CVE: CVE-2023-32600
Published: 2023-08-06
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rank Math SEO plugin <= 1.0.119 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/seo-by-rank-math/wordpress-rank-math-seo-plugin-1-0-119-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seo-by-rank-math/wordpress-rank-math-seo-plugin-1-0-119-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-4173
Published: 2023-08-06
Description: A vulnerability, which was classified as problematic, was found in mooSocial mooStore 3.1.6. Affected is an unknown function of the file /search/index. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236208.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/174016/mooSocial-3.1.8-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.236208; https://vuldb.com/?id.236208
CVE: CVE-2023-4174
Published: 2023-08-06
Description: A vulnerability has been found in mooSocial mooStore 3.1.6 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The identifier VDB-236209 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/174017/Social-Commerce-3.1.6-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.236209; https://vuldb.com/?id.236209
CVE: CVE-2023-4190
Published: 2023-08-06
Description: Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://github.com/admidio/admidio/commit/391fb2af5bee641837a58e7dd66ff76eac92bb74; https://huntr.dev/bounties/71bc75d2-320c-4332-ad11-9de535a06d92; https://github.com/admidio/admidio/commit/391fb2af5bee641837a58e7dd66ff76eac92bb74
CVE: CVE-2023-4175
Published: 2023-08-06
Description: A vulnerability was found in mooSocial mooTravel 3.1.8 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. VDB-236210 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.236210; https://vuldb.com/?id.236210; https://vuldb.com/?ctiid.236210
CVE: CVE-2023-4176
Published: 2023-08-06
Description: A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file appointmentapproval.php. The manipulation of the argument time leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236211.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/ayjmytks/Hos-System/blob/main/Hospital%20Management%20System%20appointmentapproval.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.236211; https://vuldb.com/?id.236211
CVE: CVE-2023-4177
Published: 2023-08-06
Description: A vulnerability was found in EmpowerID up to 7.205.0.0. It has been rated as problematic. This issue affects some unknown processing of the component Multi-Factor Authentication Code Handler. The manipulation leads to information disclosure. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 7.205.0.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-236213 was assigned to this vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-200, CWE-345
References: https://seclists.org/fulldisclosure/2023/Aug/3; https://vuldb.com/?ctiid.236213; https://vuldb.com/?id.236213
CVE: CVE-2023-37581
Published: 2023-08-06
Description: Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature. 


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lists.apache.org/thread/n9mjhhlm7z7b7to646tkvf3otkf21flp; https://www.openwall.com/lists/oss-security/2023/08/16/1; https://lists.apache.org/thread/n9mjhhlm7z7b7to646tkvf3otkf21flp
CVE: CVE-2023-4179
Published: 2023-08-06
Description: A vulnerability classified as critical has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected is an unknown function of the file /vm/doctor/doctors.php?action=view. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-236214 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Yesec/Free-Hospital-Management-System-for-Small-Practices/blob/main/SQL%20Injection%20in%20doctors.php/vuln.md; https://vuldb.com/?ctiid.236214; https://vuldb.com/?id.236214
CVE: CVE-2023-4180
Published: 2023-08-06
Description: A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is an unknown functionality of the file /vm/login.php. The manipulation of the argument useremail/userpassword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236215.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/Yesec/Free-Hospital-Management-System-for-Small-Practices/blob/main/SQL%20Injection%20in%20login.php/vuln.md; https://vuldb.com/?ctiid.236215; https://vuldb.com/?id.236215
CVE: CVE-2023-4181
Published: 2023-08-06
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this issue is some unknown functionality of the file /vm/admin/delete-doctor.php?id=2 of the component Redirect Handler. The manipulation leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-236216.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-841
References: https://github.com/Yesec/Free-Hospital-Management-System-for-Small-Practices/blob/main/vertical%20privilege%20escalation/vuln.md; https://vuldb.com/?ctiid.236216; https://vuldb.com/?id.236216
CVE: CVE-2023-4182
Published: 2023-08-06
Description: A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file edit_sell.php. The manipulation of the argument up_pid leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-236217 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?ctiid.236217; https://vuldb.com/?id.236217; https://vuldb.com/?ctiid.236217
CVE: CVE-2023-4183
Published: 2023-08-06
Description: A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file edit_update.php of the component Password Handler. The manipulation of the argument user_id leads to improper access controls. The attack can be initiated remotely. VDB-236218 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://vuldb.com/?ctiid.236218; https://vuldb.com/?id.236218; https://vuldb.com/?ctiid.236218
CVE: CVE-2023-4184
Published: 2023-08-06
Description: A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file sell_return.php. The manipulation of the argument pid leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-236219.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?ctiid.236219; https://vuldb.com/?id.236219; https://vuldb.com/?ctiid.236219
CVE: CVE-2023-4185
Published: 2023-08-06
Description: A vulnerability was found in SourceCodester Online Hospital Management System 1.0. It has been classified as critical. Affected is an unknown function of the file patientlogin.php. The manipulation of the argument loginid/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-236220.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yusoyea/VulList/blob/main/Hospital%20Management%20System%20patientlogin.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.236220; https://vuldb.com/?id.236220
CVE: CVE-2023-4186
Published: 2023-08-06
Description: A vulnerability was found in SourceCodester Pharmacy Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file manage_website.php. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-236221 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/E1even-321/Pharmacy-system/blob/main/Pharmacy%20Management%20System%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf; https://vuldb.com/?ctiid.236221; https://vuldb.com/?id.236221
CVE: CVE-2023-4195
Published: 2023-08-06
Description: PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://github.com/cockpit-hq/cockpit/commit/800c05f1984db291769ffa5fdfb1d3e50968e95b; https://huntr.dev/bounties/0bd5da2f-0e29-47ce-90f3-06518656bfd6; https://github.com/cockpit-hq/cockpit/commit/800c05f1984db291769ffa5fdfb1d3e50968e95b
CVE: CVE-2023-4196
Published: 2023-08-06
Description: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/cockpit-hq/cockpit/commit/039a00cc310bff128ca6e6c1c46c6fbad0385c2c; https://huntr.dev/bounties/c275a2d4-721f-49f7-8787-b146af2056a0; https://github.com/cockpit-hq/cockpit/commit/039a00cc310bff128ca6e6c1c46c6fbad0385c2c
CVE: CVE-2023-4191
Published: 2023-08-06
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-236234 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-73
References: https://github.com/Yesec/Resort-Reservation-System/blob/main/local%20file%20inclusion/vuln.md; https://vuldb.com/?ctiid.236234; https://vuldb.com/?id.236234
CVE: CVE-2023-4192
Published: 2023-08-07
Description: A vulnerability, which was classified as critical, was found in SourceCodester Resort Reservation System 1.0. This affects an unknown part of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236235.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yesec/Resort-Reservation-System/blob/main/SQL%20Injection%20in%20manage_user.php/vuln.md; https://vuldb.com/?ctiid.236235; https://vuldb.com/?id.236235
CVE: CVE-2023-4193
Published: 2023-08-07
Description: A vulnerability has been found in SourceCodester Resort Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file view_fee.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-236236.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yesec/Resort-Reservation-System/blob/main/SQL%20Injection%20in%20view_fee.php/vuln.md; https://vuldb.com/?ctiid.236236; https://vuldb.com/?id.236236
CVE: CVE-2022-47350
Published: 2023-08-07
Description: In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145
CVE: CVE-2022-47351
Published: 2023-08-07
Description: In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145
CVE: CVE-2023-33906
Published: 2023-08-07
Description: In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145
CVE: CVE-2023-33907
Published: 2023-08-07
Description: In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145
CVE: CVE-2023-33908
Published: 2023-08-07
Description: In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145
CVE: CVE-2023-33909
Published: 2023-08-07
Description: In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145
CVE: CVE-2023-33910
Published: 2023-08-07
Description: In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145
CVE: CVE-2023-33911
Published: 2023-08-07
Description: In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145
CVE: CVE-2023-33912
Published: 2023-08-07
Description: In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145
CVE: CVE-2023-33913
Published: 2023-08-07
Description: In DRM/oemcrypto, there is a possible out of bounds write due to an incorrect calculation of buffer size.This could lead to remote escalation of privilege with System execution privileges needed
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]39942145
CVE: CVE-2022-48579
Published: 2023-08-07
Description: UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: https://github.com/pmachapman/unrar/commit/2ecab6bb5ac4f3b88f[PII_REDACTED][PII_REDACTED]5f#diff-ca3086f578522062d7e390ed2cd7e10f646378a8b8cbf287a6e4db5966df68ee; https://lists.debian.org/debian-lts-announce/2023/08/msg00023.html; https://github.com/pmachapman/unrar/commit/2ecab6bb5ac4f3b88f[PII_REDACTED][PII_REDACTED]5f#diff-ca3086f578522062d7e390ed2cd7e10f646378a8b8cbf287a6e4db5966df68ee
CVE: CVE-2023-20780
Published: 2023-08-07
Description: In keyinstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017756; Issue ID: ALPS08017756.
CVSS Score: 4.4 (MEDIUM)
References: https://corp.mediatek.com/product-security-bulletin/August-2023; https://corp.mediatek.com/product-security-bulletin/August-2023
CVE: CVE-2023-20781
Published: 2023-08-07
Description: In keyinstall, there is a possible memory corruption due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017756; Issue ID: ALPS07905323.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2023; https://corp.mediatek.com/product-security-bulletin/August-2023
CVE: CVE-2023-20782
Published: 2023-08-07
Description: In keyinstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07550104; Issue ID: ALPS07550103.
CVSS Score: 4.4 (MEDIUM)
References: https://corp.mediatek.com/product-security-bulletin/August-2023; https://corp.mediatek.com/product-security-bulletin/August-2023
CVE: CVE-2023-20783
Published: 2023-08-07
Description: In keyinstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07826905; Issue ID: ALPS07826905.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2023; https://corp.mediatek.com/product-security-bulletin/August-2023
CVE: CVE-2023-20784
Published: 2023-08-07
Description: In keyinstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07826989; Issue ID: ALPS07826989.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2023; https://corp.mediatek.com/product-security-bulletin/August-2023