deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2117
Published: 2023-05-30
Description: The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.
CVSS Score: 2.7 (LOW)
References: https://wpscan.com/vulnerability/44024299-ba40-4da7-81e1-bd44d10846f3; https://wpscan.com/vulnerability/44024299-ba40-4da7-81e1-bd44d10846f3
CVE: CVE-2023-2223
Published: 2023-05-30
Description: The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173726/WordPress-Login-Rebuilder-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/7b356b82-5d03-4f70-b4ce-f1405304bb52; http://packetstormsecurity.com/files/173726/WordPress-Login-Rebuilder-Cross-Site-Scripting.html
CVE: CVE-2023-2256
Published: 2023-05-30
Description: The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1187e041-3be2-4613-8d56-c2394fcc75fb; https://wpscan.com/vulnerability/1187e041-3be2-4613-8d56-c2394fcc75fb
CVE: CVE-2023-2287
Published: 2023-05-30
Description: The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/1b36a184-2138-4a65-8940-07e7764669bb; https://wpscan.com/vulnerability/1b36a184-2138-4a65-8940-07e7764669bb
CVE: CVE-2023-2288
Published: 2023-05-30
Description: The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://wpscan.com/vulnerability/93acb4ee-1053-48e1-8b69-c09dc3b2f302; https://wpscan.com/vulnerability/93acb4ee-1053-48e1-8b69-c09dc3b2f302
CVE: CVE-2023-2296
Published: 2023-05-30
Description: The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8126ff73-c0e5-4c1b-ba10-2e51f690521e; https://wpscan.com/vulnerability/8126ff73-c0e5-4c1b-ba10-2e51f690521e
CVE: CVE-2023-2470
Published: 2023-05-30
Description: The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/de0adf26-8a0b-4b90-96d5-4bec6e770e04; https://wpscan.com/vulnerability/de0adf26-8a0b-4b90-96d5-4bec6e770e04
CVE: CVE-2023-2518
Published: 2023-05-30
Description: The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/ca120255-2c50-4906-97f3-ea660486db4c; https://wpscan.com/vulnerability/ca120255-2c50-4906-97f3-ea660486db4c
CVE: CVE-2023-30601
Published: 2023-05-30
Description: Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra
This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1.

WORKAROUND
The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users.

MITIGATION
Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://lists.apache.org/thread/f74p9jdhmmp7vtrqd8lgm8bq3dhxl8vn; https://lists.apache.org/thread/f74p9jdhmmp7vtrqd8lgm8bq3dhxl8vn
CVE: CVE-2022-45853
Published: 2023-05-30
Description: The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version 

V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an authenticated, local attacker with administrator privileges to execute some system commands as 'root' on a vulnerable device via SSH.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-276
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-privilege-escalation-vulnerability-in-gs1900-series-switches; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-privilege-escalation-vulnerability-in-gs1900-series-switches
CVE: CVE-2023-2972
Published: 2023-05-30
Description: Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/antfu/utils/commit/7f8b16c6181c988bdb96613fbb2533b345f68682; https://huntr.dev/bounties/009f1cd9-401c-49a7-bd08-be35cff6faef; https://github.com/antfu/utils/commit/7f8b16c6181c988bdb96613fbb2533b345f68682
CVE: CVE-2023-2973
Published: 2023-05-30
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Students Online Internship Timesheet Syste 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_company. The manipulation of the argument name with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230204.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/ShallowDream888/VulnerabilityReport/blob/main/XSS.md; https://vuldb.com/?ctiid.230204; https://vuldb.com/?id.230204
CVE: CVE-2023-33234
Published: 2023-05-30
Description: Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.

In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner.  Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.


CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq; https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq
CVE: CVE-2023-30196
Published: 2023-05-30
Description: Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-346
References: https://friends-of-presta.github.io/security-advisories/modules/2023/05/22/salesbooster.html; https://github.com/PrestaShop/PrestaShop/blob/6c05518b807d014ee8edb811041e3de232520c28/classes/Tools.php#L1247; https://friends-of-presta.github.io/security-advisories/modules/2023/05/22/salesbooster.html
CVE: CVE-2023-2650
Published: 2023-05-30
Description: Issue summary: Processing some specially crafted ASN.1 object identifiers or
data containing them may be very slow.

Impact summary: Applications that use OBJ_obj2txt() directly, or use any of
the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message
size limit may experience notable to very long delays when processing those
messages, which may lead to a Denial of Service.

An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -
most of which have no size limit.  OBJ_obj2txt() may be used to translate
an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL
type ASN1_OBJECT) to its canonical numeric text form, which are the
sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by
periods.

When one of the sub-identifiers in the OBJECT IDENTIFIER is very large
(these are sizes that are seen as absurdly large, taking up tens or hundreds
of KiBs), the translation to a decimal number in text may take a very long
time.  The time complexity is O(n^2) with 'n' being the size of the
sub-identifiers in bytes (*).

With OpenSSL 3.0, support to fetch cryptographic algorithms using names /
identifiers in string form was introduced.  This includes using OBJECT
IDENTIFIERs in canonical numeric text form as identifiers for fetching
algorithms.

Such OBJECT IDENTIFIERs may be received through the ASN.1 structure
AlgorithmIdentifier, which is commonly used in multiple protocols to specify
what cryptographic algorithm should be used to sign or verify, encrypt or
decrypt, or digest passed data.

Applications that call OBJ_obj2txt() directly with untrusted data are
affected, with any version of OpenSSL.  If the use is for the mere purpose
of display, the severity is considered low.

In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,
CMS, CMP/CRMF or TS.  It also impacts anything that processes X.509
certificates, including simple things like verifying its signature.

The impact on TLS is relatively low, because all versions of OpenSSL have a
100KiB limit on the peer's certificate chain.  Additionally, this only
impacts clients, or servers that have explicitly enabled client
authentication.

In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,
such as X.509 certificates.  This is assumed to not happen in such a way
that it would cause a Denial of Service, so these versions are considered
not affected by this issue in such a way that it would be cause for concern,
and the severity is therefore considered low.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://www.openwall.com/lists/oss-security/2023/05/30/1; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c
CVE: CVE-2023-2978
Published: 2023-05-30
Description: A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifier assigned to this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be; https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421; https://vuldb.com/?ctiid.230210
CVE: CVE-2023-2979
Published: 2023-05-30
Description: A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230211.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284
References: https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be; https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421; https://vuldb.com/?ctiid.230211
CVE: CVE-2023-2980
Published: 2023-05-30
Description: A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-99, CWE-74
References: https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be; https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421; https://vuldb.com/?ctiid.230212
CVE: CVE-2023-2981
Published: 2023-05-30
Description: A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component Chat. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230213 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-80
References: https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be; https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421; https://vuldb.com/?ctiid.230213
CVE: CVE-2023-2983
Published: 2023-05-30
Description: Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
CVSS Score: 8.8 (HIGH)
CWE: CWE-267
References: https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a; https://huntr.dev/bounties/6b2f33d3-2fd0-4d2d-ad7b-2c1e2417eeb1; https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a
CVE: CVE-2023-2984
Published: 2023-05-30
Description: Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
CVSS Score: 8.8 (HIGH)
CWE: CWE-29
References: https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed; https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191; https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed
CVE: CVE-2023-20884
Published: 2023-05-30
Description: VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.vmware.com/security/advisories/VMSA-2023-0011.html; https://www.vmware.com/security/advisories/VMSA-2023-0011.html
CVE: CVE-2023-24568
Published: 2023-05-30
Description: 
Dell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port which could disallow replacing CA signed certificates.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-297, CWE-295
References: https://www.dell.com/support/kbdoc/en-us/000210963/dsa-2023-059-dell-networker-security-update-for-a-rabbitmq-vulnerability-related-to-improper-validation-of-hostname-in-rabbitmq-startup-script-which-fails-to-replace-ca-signed-certificates; https://www.dell.com/support/kbdoc/en-us/000210963/dsa-2023-059-dell-networker-security-update-for-a-rabbitmq-vulnerability-related-to-improper-validation-of-hostname-in-rabbitmq-startup-script-which-fails-to-replace-ca-signed-certificates
CVE: CVE-2023-24817
Published: 2023-05-30
Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer. Triggering the access at the right time will corrupt other packets or the allocator metadata. Corrupting a pointer will lead to denial of service. This issue is fixed in version 2023.04. As a workaround, disable SRH in the network stack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-191, CWE-191, CWE-787
References: https://github.com/RIOT-OS/RIOT/commit/34dc1757f5621be48e226cfebb2f4c63505b5360; https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xjgw-7638-29g5; https://github.com/RIOT-OS/RIOT/commit/34dc1757f5621be48e226cfebb2f4c63505b5360
CVE: CVE-2023-24825
Published: 2023-05-30
Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252, CWE-476, CWE-252, CWE-476
References: https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L416; https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L429; https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L729
CVE: CVE-2023-28079
Published: 2023-05-30
Description: 
PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains Insecure File and Folder Permissions vulnerability. A regular user (non-admin) can exploit the weak folder and file permissions to escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM.


CVSS Score: 7.0 (HIGH)
CWE: CWE-276
References: https://www.dell.com/support/kbdoc/en-us/000214248/dsa-2023-154-powerpath-windows-security-update-for-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000214248/dsa-2023-154-powerpath-windows-security-update-for-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-28080
Published: 2023-05-30
Description: 
PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities. A regular user (non-admin) can exploit these issues to potentially escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://www.dell.com/support/kbdoc/en-us/000214248/dsa-2023-154-powerpath-windows-security-update-for-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000214248/dsa-2023-154-powerpath-windows-security-update-for-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-32448
Published: 2023-05-30
Description: 
PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext vulnerability. A local user with access to the installation directory can retrieve the license key of the product and use it to install and license PowerPath on different systems.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://www.dell.com/support/kbdoc/en-us/000214248/dsa-2023-154-powerpath-windows-security-update-for-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000214248/dsa-2023-154-powerpath-windows-security-update-for-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-43485
Published: 2023-05-30
Description: 
Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-330, CWE-330
References: https://process.honeywell.com/; https://process.honeywell.com/
CVE: CVE-2022-46361
Published: 2023-05-30
Description: An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along with a backup configuration, which could result in the execution of unwanted commands. This issue affects OneWireless all versions up to 322.1 and fixed in version 322.2.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://process.honeywell.com/; https://process.honeywell.com/
CVE: CVE-2022-4240
Published: 2023-05-30
Description: Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://process.honeywell.com/; https://process.honeywell.com/
CVE: CVE-2023-23754
Published: 2023-05-30
Description: An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-601, CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-open-redirects-and-xss-within-the-mfa-selection.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-open-redirects-and-xss-within-the-mfa-selection.html
CVE: CVE-2023-23755
Published: 2023-05-30
Description: An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-bruteforce-prevention-within-the-mfa-screen.html; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-bruteforce-prevention-within-the-mfa-screen.html
CVE: CVE-2023-24826
Published: 2023-05-30
Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send crafted frames to the device to trigger the usage of an uninitialized object leading to denial of service. This issue is fixed in version 2023.04. As a workaround, disable fragment forwarding or SFR.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-824, CWE-824
References: https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L402; https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L420; https://github.com/RIOT-OS/RIOT/commit/287f030af20e829469cdf[PII_REDACTED]18a5a220d
CVE: CVE-2023-29737
Published: 2023-05-30
Description: An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: http://www.wavekeyboard.com/; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29737/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.wave.keyboard
CVE: CVE-2023-33973
Published: 2023-05-30
Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send a crafted frame which is forwarded by the device. During encoding of the packet a NULL pointer dereference occurs. This crashes the device leading to denial of service. A patch is available at pull request 19678. There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f[PII_REDACTED]9a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1067; https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f[PII_REDACTED]9a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1495; https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f[PII_REDACTED]9a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1511