deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-6860
Published: 2023-12-19
Description: The `VideoBridge` allowed any content process to use textures produced by remote decoders.  This could be abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1854669; https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html; https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
CVE: CVE-2023-6861
Published: 2023-12-19
Description: The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1864118; https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html; https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
CVE: CVE-2023-6862
Published: 2023-12-19
Description: A use-after-free was identified in the `nsDNSService::Init`.  This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1868042; https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html; https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
CVE: CVE-2023-6863
Published: 2023-12-19
Description: The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1868901; https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-6864
Published: 2023-12-19
Description: Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1736385%2C1810805%2C1846328%2C1856090%2C1858033%2C1858509%2C1862089%2C1862777%2C1864015; https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html; https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
CVE: CVE-2023-6865
Published: 2023-12-19
Description: `EncryptingOutputStream` was susceptible to exposing uninitialized data.  This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1864123; https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-6866
Published: 2023-12-19
Description: TypedArrays can be fallible and lacked proper exception handling. This could lead to abuse in other APIs which expect TypedArrays to always succeed. This vulnerability affects Firefox < 121.
CVSS Score: 8.8 (HIGH)
CWE: CWE-755
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1849037; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-56/
CVE: CVE-2023-6867
Published: 2023-12-19
Description: The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1863863; https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-6868
Published: 2023-12-19
Description: In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties.
*This bug only affects Firefox on Android.* This vulnerability affects Firefox < 121.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1865488; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-56/
CVE: CVE-2023-6869
Published: 2023-12-19
Description: A `&lt;dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to display under the guise of trusted content. This vulnerability affects Firefox < 121.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1799036; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-56/
CVE: CVE-2023-6870
Published: 2023-12-19
Description: Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. 
*This issue only affects Android versions of Firefox and Firefox Focus.* This vulnerability affects Firefox < 121.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1823316; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-56/
CVE: CVE-2023-6871
Published: 2023-12-19
Description: Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability affects Firefox < 121.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1828334; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-56/
CVE: CVE-2023-6872
Published: 2023-12-19
Description: Browser tab titles were being leaked by GNOME to system logs. This could potentially expose the browsing habits of users running in a private tab. This vulnerability affects Firefox < 121.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1849186; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-56/
CVE: CVE-2023-6873
Published: 2023-12-19
Description: Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 121.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1855327%2C1862089%2C1862723; https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html; https://security.gentoo.org/glsa/202401-10
CVE: CVE-2023-6931
Published: 2023-12-19
Description: A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.

A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().

We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=382c27f4ed28f803b1f1473ac2d8db0afc795a1b; https://kernel.dance/382c27f4ed28f803b1f1473ac2d8db0afc795a1b; https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE: CVE-2023-6932
Published: 2023-12-19
Description: A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation.

A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.

We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=e2b706c691905fe78468c361aaabc719d0a496f1; https://kernel.dance/e2b706c691905fe78468c361aaabc719d0a496f1
CVE: CVE-2023-1514
Published: 2023-12-19
Description: A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000152&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000152&languageCode=en&Preview=true
CVE: CVE-2023-43870
Published: 2023-12-19
Description: When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password they could then create their own certificates to emulate another site. Then by establishing a proxy service to emulate the site they could monitor traffic passed between the end user and the site allowing access to the data content.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.paxton-access.com/systems/net2/; https://www.paxton-access.com/systems/net2/
CVE: CVE-2023-6280
Published: 2023-12-19
Description: An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network.
CVSS Score: 7.2 (HIGH)
CWE: CWE-611
References: https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps; https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps
CVE: CVE-2023-6711
Published: 2023-12-19
Description: Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000184&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000184&languageCode=en&Preview=true
CVE: CVE-2023-6913
Published: 2023-12-19
Description: A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new device and directly running WebView without prompting or displaying it to the user. This vulnerability could trigger phishing attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-384
References: https://www.incibe.es/en/incibe-cert/notices/aviso/session-hijacking-imou-life-app; https://www.incibe.es/en/incibe-cert/notices/aviso/session-hijacking-imou-life-app
CVE: CVE-2021-22962
Published: 2023-12-19
Description: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
CVSS Score: 9.1 (CRITICAL)
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-25715
Published: 2023-12-19
Description: Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress: from n/a through 2.5.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/gamipress/wordpress-gamipress-plugin-2-5-6-missing-authorization-leading-to-points-manipulation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gamipress/wordpress-gamipress-plugin-2-5-6-missing-authorization-leading-to-points-manipulation-vulnerability?_s_id=cve
CVE: CVE-2023-37390
Published: 2023-12-19
Description: Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.
CVSS Score: 8.3 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/themesflat-addons-for-elementor/wordpress-themesflat-addons-for-elementor-plugin-2-0-0-unauthenticated-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/themesflat-addons-for-elementor/wordpress-themesflat-addons-for-elementor-plugin-2-0-0-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-41727
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-44983
Published: 2023-12-19
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/aruba-hispeed-cache/wordpress-aruba-hispeed-cache-plugin-2-0-6-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/aruba-hispeed-cache/wordpress-aruba-hispeed-cache-plugin-2-0-6-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2023-44991
Published: 2023-12-19
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Media File Renamer: Rename Files (Manual, Auto & AI).This issue affects Media File Renamer: Rename Files (Manual, Auto & AI): from n/a through 5.6.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/media-file-renamer/wordpress-media-file-renamer-plugin-5-6-9-sensitive-data-exposure-via-debug-log-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/media-file-renamer/wordpress-media-file-renamer-plugin-5-6-9-sensitive-data-exposure-via-debug-log-vulnerability?_s_id=cve
CVE: CVE-2023-46216
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46217
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46220
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46221
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46222
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46223
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46224
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46225
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46257
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46258
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46259
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46260
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46261
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46262
Published: 2023-12-19
Description: An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46263
Published: 2023-12-19
Description: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46264
Published: 2023-12-19
Description: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46265
Published: 2023-12-19
Description: An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46266
Published: 2023-12-19
Description: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
CVSS Score: 9.1 (CRITICAL)
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46803
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-46804
Published: 2023-12-19
Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
CVE: CVE-2023-50272
Published: 2023-12-19
Description: A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be remotely exploited to allow authentication bypass.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04584en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04584en_us