deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-21281
Published: 2023-08-14
Description: In multiple functions of KeyguardViewMediator.java, there is a possible failure to lock after screen timeout due to a logic error in the code. This could lead to local escalation of privilege across users with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/badb243574d7fca9aa89152d9d25eeb4f8615385; https://source.android.com/security/bulletin/2023-08-01; https://android.googlesource.com/platform/frameworks/base/+/badb243574d7fca9aa89152d9d25eeb4f8615385
CVE: CVE-2023-21282
Published: 2023-08-14
Description: In TRANSPOSER_SETTINGS of lpp_tran.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.


CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://android.googlesource.com/platform/external/aac/+/4242f97d149b0bf0cd96f00cd1e9d30d5922cd46; https://source.android.com/security/bulletin/2023-08-01; http://www.openwall.com/lists/oss-security/2025/08/13/9
CVE: CVE-2023-21283
Published: 2023-08-14
Description: In multiple functions of StatusHints.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.


CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/platform/frameworks/base/+/e17fd149c0a2bf6cce56ebfae3fa5364fead22cc; https://android.googlesource.com/platform/packages/services/Telecomm/+/9b41a963f352fdb3da1da8c633d45280badfcb24; https://source.android.com/security/bulletin/2023-08-01
CVE: CVE-2023-21284
Published: 2023-08-14
Description: In multiple functions of DevicePolicyManager.java, there is a possible way to prevent enabling the Find my Device feature due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://android.googlesource.com/platform/frameworks/base/+/ed3f25b7222d4cff471f2b7d22d[PII_REDACTED]57; https://source.android.com/security/bulletin/2023-08-01; https://android.googlesource.com/platform/frameworks/base/+/ed3f25b7222d4cff471f2b7d22d[PII_REDACTED]57
CVE: CVE-2023-21285
Published: 2023-08-14
Description: In setMetadata of MediaSessionRecord.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/platform/frameworks/base/+/0c3b7ec3377e7fb645ec366be3be96bb1a252ca1; https://source.android.com/security/bulletin/2023-08-01; https://android.googlesource.com/platform/frameworks/base/+/0c3b7ec3377e7fb645ec366be3be96bb1a252ca1
CVE: CVE-2023-21286
Published: 2023-08-14
Description: In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/a65429742caf05205ea7f1c2fdd1119ca652b810; https://source.android.com/security/bulletin/2023-08-01; https://android.googlesource.com/platform/frameworks/base/+/a65429742caf05205ea7f1c2fdd1119ca652b810
CVE: CVE-2023-21287
Published: 2023-08-14
Description: In multiple locations, there is a possible code execution due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://android.googlesource.com/platform/external/freetype/+/a79e80a25874dacaa266906a9048f13d4bac41c6; https://source.android.com/security/bulletin/2023-08-01; https://android.googlesource.com/platform/external/freetype/+/a79e80a25874dacaa266906a9048f13d4bac41c6
CVE: CVE-2023-21288
Published: 2023-08-14
Description: In visitUris of Notification.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://android.googlesource.com/platform/frameworks/base/+/726247f4f53e8cc[PII_REDACTED]652fa415a123c0c; https://source.android.com/security/bulletin/2023-08-01; https://android.googlesource.com/platform/frameworks/base/+/726247f4f53e8cc[PII_REDACTED]652fa415a123c0c
CVE: CVE-2023-21289
Published: 2023-08-14
Description: In multiple locations, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/platform/frameworks/base/+/7a5e51c918b7097be3c7e669e1825a4d159c4185; https://source.android.com/security/bulletin/2023-08-01; https://android.googlesource.com/platform/frameworks/base/+/7a5e51c918b7097be3c7e669e1825a4d159c4185
CVE: CVE-2023-21290
Published: 2023-08-14
Description: In update of MmsProvider.java, there is a possible way to bypass file permission checks due to a race condition. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362
References: https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ca4c9a19635119d95900793e7a41b820cd1d94d9; https://source.android.com/security/bulletin/2023-08-01; https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ca4c9a19635119d95900793e7a41b820cd1d94d9
CVE: CVE-2023-21292
Published: 2023-08-14
Description: In openContentUri of ActivityManagerService.java, there is a possible way for a third party app to obtain restricted files due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/platform/frameworks/base/+/d10b27e539f7bc91c2360d429b9d05f05274670d; https://source.android.com/security/bulletin/2023-08-01; https://android.googlesource.com/platform/frameworks/base/+/d10b27e539f7bc91c2360d429b9d05f05274670d
CVE: CVE-2023-35689
Published: 2023-08-14
Description: In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 7.8 (HIGH)
CWE: CWE-1188
References: https://source.android.com/security/bulletin/wear/2023-08-01; https://source.android.com/security/bulletin/wear/2023-08-01
CVE: CVE-2023-40518
Published: 2023-08-14
Description: LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.
CVSS Score: 7.5 (HIGH)
References: https://openlitespeed.org/release-log/version-1-7-x/; https://www.litespeedtech.com/products/litespeed-web-server/release-log; https://openlitespeed.org/release-log/version-1-7-x/
CVE: CVE-2020-36615
Published: 2023-08-14
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously crafted font may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/HT211931; https://support.apple.com/en-us/HT211931
CVE: CVE-2022-22646
Published: 2023-08-14
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213054; https://support.apple.com/en-us/HT213054
CVE: CVE-2022-22655
Published: 2023-08-14
Description: An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Monterey 12.3, iOS 15.4 and iPadOS 15.4. An app may be able to leak sensitive user information.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213182; https://support.apple.com/en-us/HT213183; https://support.apple.com/en-us/HT213182
CVE: CVE-2022-26699
Published: 2023-08-14
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able to cause a denial-of-service to Endpoint Security clients.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-32876
Published: 2023-08-14
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13. A shortcut may be able to view the hidden photos album without authentication.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-42828
Published: 2023-08-14
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 8.8 (HIGH)
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-46706
Published: 2023-08-14
Description: A type confusion issue was addressed with improved state handling. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://support.apple.com/en-us/HT213183; https://support.apple.com/en-us/HT213184; https://support.apple.com/en-us/HT213185
CVE: CVE-2022-46722
Published: 2023-08-14
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488; https://github.com/jhftss/POC/blob/main/CVE-2022-46722/exploit.m
CVE: CVE-2022-46724
Published: 2023-08-14
Description: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.4 and iPadOS 16.4. A person with physical access to an iOS device may be able to view the last image used in Magnifier from the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-203
References: https://support.apple.com/en-us/HT213676; https://support.apple.com/en-us/HT213676
CVE: CVE-2022-46725
Published: 2023-08-14
Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.4 and iPadOS 16.4. Visiting a malicious website may lead to address bar spoofing.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2023/11/15/1; https://support.apple.com/en-us/HT213676; http://www.openwall.com/lists/oss-security/2023/11/15/1
CVE: CVE-2022-48503
Published: 2023-08-14
Description: The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-129
References: https://support.apple.com/en-us/HT213340; https://support.apple.com/en-us/HT213341; https://support.apple.com/en-us/HT213342
CVE: CVE-2023-27939
Published: 2023-08-14
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of process memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-27947
Published: 2023-08-14
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of process memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-27948
Published: 2023-08-14
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of process memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-28179
Published: 2023-08-14
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. Processing a maliciously crafted AppleScript binary may result in unexpected app termination or disclosure of process memory.
CVSS Score: 7.1 (HIGH)
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-28198
Published: 2023-08-14
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2023/09/11/1; https://security.gentoo.org/glsa/202401-04; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-28199
Published: 2023-08-14
Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. An app may be able to disclose kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-32358
Published: 2023-08-14
Description: A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213676; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-4347
Published: 2023-08-15
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/91c57a1ee54631e071b6b0c952d99c8ee892e824; https://huntr.dev/bounties/1f78c6e1-2923-46c5-9376-4cc5a8f1152f; https://github.com/librenms/librenms/commit/91c57a1ee54631e071b6b0c952d99c8ee892e824
CVE: CVE-2023-4308
Published: 2023-08-15
Description: The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2952471/user-submitted-posts; https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb4d37c-c4c2-4523-9b4e-73ffb7be81ea?source=cve; https://plugins.trac.wordpress.org/changeset/2952471/user-submitted-posts
CVE: CVE-2023-2916
Published: 2023-08-15
Description: The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-668
References: https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.11.1/core.class.php#L365; https://plugins.trac.wordpress.org/changeset/2925897/iwp-client#file4; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa157c80-447f-4406-9e49-9cc6208b7b19?source=cve
CVE: CVE-2023-24478
Published: 2023-08-15
Description: Use of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux before version 22.4 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-330, CWE-330
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00850.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00850.html
CVE: CVE-2023-30498
Published: 2023-08-15
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeFlavors Vimeotheque: Vimeo WordPress Plugin <= 2.2.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/codeflavors-vimeo-video-post-lite/wordpress-vimeotheque-plugin-2-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/codeflavors-vimeo-video-post-lite/wordpress-vimeotheque-plugin-2-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30747
Published: 2023-08-15
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPGem WooCommerce Easy Duplicate Product plugin <= 0.3.0.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-easy-duplicate-product/wordpress-woocommerce-easy-duplicate-product-plugin-0-3-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-easy-duplicate-product/wordpress-woocommerce-easy-duplicate-product-plugin-0-3-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30778
Published: 2023-08-15
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry plugin <= 10.0.1 versions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/powerpress/wordpress-powerpress-podcasting-plugin-by-blubrry-plugin-10-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/powerpress/wordpress-powerpress-podcasting-plugin-by-blubrry-plugin-10-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28479
Published: 2023-08-15
Description: An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform installs a full development toolchain within every TigerGraph deployment. An attacker is able to compile new executables on each Tigergraph system and modify system and Tigergraph binaries.
CVSS Score: 8.8 (HIGH)
References: https://neo4j.com/security/cve-2023-28479/; https://neo4j.com/security/cve-2023-28479/
CVE: CVE-2023-4371
Published: 2023-08-15
Description: A vulnerability was found in phpRecDB 1.3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument r/view leads to cross site scripting. The attack may be launched remotely. VDB-237194 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.237194; https://vuldb.com/?id.237194; https://vuldb.com/?ctiid.237194
CVE: CVE-2023-32003
Published: 2023-08-15
Description: `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory.

This vulnerability affects all users using the experimental permission model in Node.js 20.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/2037887; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/
CVE: CVE-2023-32004
Published: 2023-08-15
Description: A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.

This vulnerability affects all users using the experimental permission model in Node.js 20.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/2038134; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/
CVE: CVE-2023-32006
Published: 2023-08-15
Description: The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.

This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.

Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS Score: 8.8 (HIGH)
CWE: CWE-693
References: https://hackerone.com/reports/2043807; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/
CVE: CVE-2023-35082
Published: 2023-08-15
Description: An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US; https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35082
CVE: CVE-2023-38840
Published: 2023-08-15
Description: Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/bitwarden/clients/pull/5813; https://github.com/bitwarden/desktop/issues/476; https://github.com/markuta/bw-dump
CVE: CVE-2023-38850
Published: 2023-08-15
Description: Buffer Overflow vulnerability in Michaelrsweet codedoc v.3.7 allows an attacker to cause a denial of service via the codedoc.c:1742 comppnent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/michaelrsweet/codedoc/issues/15; https://github.com/michaelrsweet/codedoc/issues/15