deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2742
Published: 2023-06-19
Description: The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/f689442a-a851-4140-a10c-ac579f9da142; https://wpscan.com/vulnerability/f689442a-a851-4140-a10c-ac579f9da142
CVE: CVE-2023-2751
Published: 2023-06-19
Description: The Upload Resume WordPress plugin through 1.2.0 does not validate the captcha parameter when uploading a resume via the resume_upload_form shortcode, allowing unauthenticated visitors to upload arbitrary media files to the site.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/1b0fe0ac-d0d1-473d-af5b-dad6217933d4; https://wpscan.com/vulnerability/1b0fe0ac-d0d1-473d-af5b-dad6217933d4
CVE: CVE-2023-2779
Published: 2023-06-19
Description: The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
References: http://packetstormsecurity.com/files/173053/WordPress-Super-Socializer-7.13.52-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/fe9b7696-3b0e-42e2-9dbc-55167605f5c5; http://packetstormsecurity.com/files/173053/WordPress-Super-Socializer-7.13.52-Cross-Site-Scripting.html
CVE: CVE-2023-2805
Published: 2023-06-19
Description: The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/bdb75c8c-87e2-4358-ad3b-f4236e9a43c0; https://wpscan.com/vulnerability/bdb75c8c-87e2-4358-ad3b-f4236e9a43c0
CVE: CVE-2023-2811
Published: 2023-06-19
Description: The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks to all admin when setting chatbot and all client when using chatbot
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/82a81721-0435-45a6-bd5b-dc90186cf803; https://wpscan.com/vulnerability/82a81721-0435-45a6-bd5b-dc90186cf803
CVE: CVE-2023-2812
Published: 2023-06-19
Description: The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/7de4c313-359e-4450-85f5-d29f3c2f046a; https://wpscan.com/vulnerability/7de4c313-359e-4450-85f5-d29f3c2f046a
CVE: CVE-2023-2899
Published: 2023-06-19
Description: The Google Map Shortcode WordPress plugin through 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/92dcbeb3-17db-4d10-8ae7-c99acdb48c78; https://wpscan.com/vulnerability/92dcbeb3-17db-4d10-8ae7-c99acdb48c78
CVE: CVE-2023-34414
Published: 2023-06-19
Description: The error page for sites with invalid TLS certificates was missing the
activation-delay Firefox uses to protect prompts and permission dialogs
from attacks that exploit human response time delays. If a malicious
page elicited user clicks in precise locations immediately before
navigating to a site with a certificate error and made the renderer
extremely busy at the same time, it could create a gap between when
the error page was loaded and when the display actually refreshed.
With the right timing the elicited clicks could land in that gap and 
activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.
CVSS Score: 3.1 (LOW)
CWE: CWE-295
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1695986; https://security.gentoo.org/glsa/202312-03; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-34415
Published: 2023-06-19
Description: When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same process as the site that issued the redirect. This bypassed the site-isolation protections against Spectre-like attacks on sites that host an "open redirect". Firefox no longer follows HTTP redirects to data: URLs. This vulnerability affects Firefox < 114.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1811999; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-20/
CVE: CVE-2023-34416
Published: 2023-06-19
Description: Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1752703%2C1818394%2C1826875%2C1827340%2C1827655%2C1828065%2C1830190%2C1830206%2C1830795%2C1833339; https://security.gentoo.org/glsa/202312-03; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-34417
Published: 2023-06-19
Description: Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 114.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746447%2C1820903%2C1832832; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-20/
CVE: CVE-2022-47586
Published: 2023-06-19
Description: Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.1.23 versions.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/ultimate-addons-for-contact-form-7/wordpress-ultimate-addons-for-contact-form-7-plugin-3-1-23-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-addons-for-contact-form-7/wordpress-ultimate-addons-for-contact-form-7-plugin-3-1-23-sql-injection?_s_id=cve
CVE: CVE-2023-27992
Published: 2023-06-19
Description: The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27992
CVE: CVE-2023-3316
Published: 2023-06-19
Description: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://gitlab.com/libtiff/libtiff/-/issues/515; https://gitlab.com/libtiff/libtiff/-/merge_requests/468; https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html
CVE: CVE-2022-46850
Published: 2023-06-19
Description: Auth. (author+) Broken Access Control vulnerability leading to Arbitrary File Deletion in Nabil Lemsieh Easy Media Replace plugin <= 0.1.3 versions.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/easy-media-replace/wordpress-easy-media-replace-plugin-0-1-3-arbitrary-file-deletion?_s_id=cve; https://patchstack.com/database/vulnerability/easy-media-replace/wordpress-easy-media-replace-plugin-0-1-3-arbitrary-file-deletion?_s_id=cve
CVE: CVE-2023-2907
Published: 2023-06-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marksoft allows SQL Injection.This issue affects Marksoft: through Mobile:v.7.1.7 ; Login:1.4 ; API:20230605.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0363; https://www.usom.gov.tr/bildirim/tr-23-0363
CVE: CVE-2023-33213
Published: 2023-06-19
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Display Custom Fields – wpView plugin <= 1.3.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpview/wordpress-wpview-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpview/wordpress-wpview-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34373
Published: 2023-06-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/zephyr-project-manager/wordpress-zephyr-project-manager-plugin-3-3-93-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/zephyr-project-manager/wordpress-zephyr-project-manager-plugin-3-3-93-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-3318
Published: 2023-06-19
Description: A vulnerability was found in SourceCodester Resort Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231937 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://kr1shna4garwal.github.io/posts/cve-poc-2023/#cve-2023-3318; https://vuldb.com/?ctiid.231937; https://vuldb.com/?id.231937
CVE: CVE-2023-35772
Published: 2023-06-19
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alain Gonzalez Google Map Shortcode plugin <= 3.1.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/google-map-shortcode/wordpress-google-map-shortcode-plugin-3-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/google-map-shortcode/wordpress-google-map-shortcode-plugin-3-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-35775
Published: 2023-06-19
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Backup Solutions WP Backup Manager plugin <= 1.13.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-backup-manager/wordpress-wp-backup-manager-plugin-1-13-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-backup-manager/wordpress-wp-backup-manager-plugin-1-13-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-35776
Published: 2023-06-19
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sermone-online-sermons-management/wordpress-sermon-e-sermons-online-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sermone-online-sermons-management/wordpress-sermon-e-sermons-online-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-35779
Published: 2023-06-19
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Seed Webs Seed Fonts plugin <= 2.3.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/seed-fonts/wordpress-seed-fonts-plugin-2-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seed-fonts/wordpress-seed-fonts-plugin-2-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-31410
Published: 2023-06-19
Description: A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK EventCam App. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on the communication between the EventCam App and the Client, and potentially manipulate the data being transmitted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.pdf; https://sick.com/psirt
CVE: CVE-2023-31411
Published: 2023-06-19
Description: A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App. 
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.pdf; https://sick.com/psirt
CVE: CVE-2022-48506
Published: 2023-06-19
Description: A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios. This issue was observed for use of the following versions of Democracy Suite: 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15. NOTE: the Democracy Suite 5.17 EAC Certificate of Conformance mentions "Improved pseudo random number algorithm," which may be relevant.
CVSS Score: 2.4 (LOW)
CWE: CWE-338, CWE-338
References: https://dvsorder.org; https://freedom-to-tinker.com/2023/06/14/security-analysis-of-the-dominion-imagecast-x/; https://www.eac.gov/sites/default/files/voting_system/files/D-Suite%205.17%20Certificate%20and%20Scope%20SIGNED.pdf
CVE: CVE-2022-48486
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48487
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48488
Published: 2023-06-19
Description: Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause unauthorized modifications to the desktop.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48489
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48490
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48491
Published: 2023-06-19
Description: Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead to ads and other windows to display at any time.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48492
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48493
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48494
Published: 2023-06-19
Description: Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48495
Published: 2023-06-19
Description: Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cause foreground app information to be obtained.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48496
Published: 2023-06-19
Description: Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48497
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48498
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48499
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48500
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2022-48501
Published: 2023-06-19
Description: Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2023-34155
Published: 2023-06-19
Description: Vulnerability of unauthorized calling on HUAWEI phones and tablets.Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2023-34156
Published: 2023-06-19
Description: Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-384
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2023-34158
Published: 2023-06-19
Description: Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2023-34159
Published: 2023-06-19
Description: Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to privilege escalation, which affects availability and confidentiality.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2023-34160
Published: 2023-06-19
Description: Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2023-34161
Published: 2023-06-19
Description: nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2023-34162
Published: 2023-06-19
Description: Version update determination vulnerability in the user profile module.Successful exploitation of this vulnerability may cause repeated HMS Core updates and cause services to fail.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/
CVE: CVE-2023-34163
Published: 2023-06-19
Description: Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/6/; https://consumer.huawei.com/en/support/bulletin/2023/6/