deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28369
Published: 2023-05-18
Description: Brother iPrint&Scan V6.11.2 and earlier contains an improper access control vulnerability. This vulnerability may be exploited by the other app installed on the victim user's Android device, which may lead to displaying the settings and/or log information of the affected app as a print preview.
CVSS Score: 3.3 (LOW)
References: https://faq.brother.co.jp/app/answers/detail/a_id/13468; https://jvn.jp/en/vu/JVNVU97891206/; https://play.google.com/store/apps/details?id=com.brother.mfc.brprint
CVE: CVE-2023-30487
Published: 2023-05-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThimPress LearnPress Export Import plugin <= 4.0.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/learnpress-import-export/wordpress-learnpress-export-import-plugin-4-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/learnpress-import-export/wordpress-learnpress-export-import-plugin-4-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30868
Published: 2023-05-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jon Christopher CMS Tree Page View plugin <= 1.6.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/172730/WordPress-Tree-Page-View-1.6.7-Cross-Site-Scripting.html; https://patchstack.com/database/vulnerability/cms-tree-page-view/wordpress-cms-tree-page-view-plugin-1-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve; http://packetstormsecurity.com/files/172730/WordPress-Tree-Page-View-1.6.7-Cross-Site-Scripting.html
CVE: CVE-2022-45450
Published: 2023-05-18
Description: Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 28610, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 30984.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285, CWE-552
References: https://security-advisory.acronis.com/advisories/SEC-2410; https://security-advisory.acronis.com/advisories/SEC-2410
CVE: CVE-2022-45452
Published: 2023-05-18
Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30430, Acronis Cyber Protect 15 (Windows) before build 30984.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-276
References: https://security-advisory.acronis.com/advisories/SEC-3967; https://security-advisory.acronis.com/advisories/SEC-3967
CVE: CVE-2022-45453
Published: 2023-05-18
Description: TLS/SSL weak cipher suites enabled. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310, CWE-326
References: https://security-advisory.acronis.com/advisories/SEC-5112; https://security-advisory.acronis.com/advisories/SEC-5112
CVE: CVE-2022-45457
Published: 2023-05-18
Description: Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows) before build 29633, Acronis Cyber Protect 15 (Windows) before build 30984.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://security-advisory.acronis.com/advisories/SEC-3957; https://security-advisory.acronis.com/advisories/SEC-3957
CVE: CVE-2022-45458
Published: 2023-05-18
Description: Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 29633, Acronis Cyber Protect 15 (Windows, macOS, Linux) before build 30984.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://security-advisory.acronis.com/advisories/SEC-3952; https://security-advisory.acronis.com/advisories/SEC-3952
CVE: CVE-2022-45459
Published: 2023-05-18
Description: Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before build 30984.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-276
References: https://security-advisory.acronis.com/advisories/SEC-3196; https://security-advisory.acronis.com/advisories/SEC-3196
CVE: CVE-2022-4418
Published: 2023-05-18
Description: Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40208.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347, CWE-347
References: https://security-advisory.acronis.com/advisories/SEC-4729; https://security-advisory.acronis.com/advisories/SEC-4729
CVE: CVE-2023-31233
Published: 2023-05-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Haoqisir Baidu Tongji generator plugin <= 1.0.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/baidu-tongji-generator/wordpress-baidu-tongji-generator-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/baidu-tongji-generator/wordpress-baidu-tongji-generator-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32515
Published: 2023-05-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Matt Gibbs Custom Field Suite plugin <= 2.6.2.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/custom-field-suite/wordpress-custom-field-suite-plugin-2-6-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-field-suite/wordpress-custom-field-suite-plugin-2-6-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-47157
Published: 2023-05-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Don Benjamin WP Custom Fields Search plugin <= 1.2.34 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-custom-fields-search/wordpress-wp-custom-fields-search-plugin-1-2-34-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-custom-fields-search/wordpress-wp-custom-fields-search-plugin-1-2-34-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-23667
Published: 2023-05-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in BeRocket Brands for WooCommerce plugin <= 3.7.0.6 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/brands-for-woocommerce/wordpress-brands-for-woocommerce-plugin-3-7-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/brands-for-woocommerce/wordpress-brands-for-woocommerce-plugin-3-7-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23999
Published: 2023-05-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MonsterInsights plugin <= 8.14.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/google-analytics-for-wordpress/wordpress-google-analytics-by-monsterinsights-plugin-8-14-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/google-analytics-for-wordpress/wordpress-google-analytics-by-monsterinsights-plugin-8-14-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25698
Published: 2023-05-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mabel-shoppable-images-lite/wordpress-shoppable-images-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mabel-shoppable-images-lite/wordpress-shoppable-images-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27423
Published: 2023-05-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Auto Prune Posts plugin <= 1.8.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/auto-prune-posts/wordpress-auto-prune-posts-plugin-1-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/auto-prune-posts/wordpress-auto-prune-posts-plugin-1-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27430
Published: 2023-05-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Mass Delete Unused Tags plugin <= 2.0.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mass-delete-unused-tags/wordpress-mass-delete-unused-tags-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mass-delete-unused-tags/wordpress-mass-delete-unused-tags-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-2782
Published: 2023-05-18
Description: Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://security-advisory.acronis.com/advisories/SEC-3475; https://security-advisory.acronis.com/advisories/SEC-3475
CVE: CVE-2023-30780
Published: 2023-05-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TheGuideX User IP and Location plugin <= 2.2 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/user-ip-and-location/wordpress-user-ip-and-location-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/user-ip-and-location/wordpress-user-ip-and-location-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-2789
Published: 2023-05-18
Description: A vulnerability was found in GNU cflow 1.7. It has been rated as problematic. This issue affects the function func_body/parse_variable_declaration of the file parser.c. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier VDB-229373 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-404
References: https://github.com/DaisyPo/fuzzing-vulncollect/blob/main/cflow/stack-overflow/parser.c/README.md; https://github.com/DaisyPo/fuzzing-vulncollect/files/11343936/poc-file.zip; https://vuldb.com/?ctiid.229373
CVE: CVE-2023-2790
Published: 2023-05-18
Description: A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Affected is an unknown function of the file /squashfs-root/etc_ro/custom.conf of the component Telnet Service. The manipulation leads to password in configuration file. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229374 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.3 (LOW)
CWE: CWE-260
References: https://drive.google.com/file/d/1RITXRvKele5aW42YFk0JeQHCq2B63lUj/view?usp=share_link; https://vuldb.com/?ctiid.229374; https://vuldb.com/?id.229374
CVE: CVE-2023-2799
Published: 2023-05-18
Description: A vulnerability, which was classified as problematic, has been found in cnoa OA up to 5.1.1.5. Affected by this issue is some unknown functionality of the file /index.php?app=main&func=passport&action=login. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229376. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-259
References: https://github.com/Peanut886/Vulnerability/blob/main/imgs/2023-Guangzhou%20Xiezhong%20Software%20Technology%20Co.%2C%20LTD/2023-04-10(2).jpg; https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/The-default-password-vulnerability-exists-in-the-intelligent-cooperative-office-system.md; https://vuldb.com/?ctiid.229376
CVE: CVE-2023-2800
Published: 2023-05-18
Description: Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-377
References: https://github.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c43; https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44a; https://github.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c43
CVE: CVE-2023-31871
Published: 2023-05-18
Description: OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root. The software comes prepackaged with a root owned SUID binary dm_secure_writer. The binary has security controls in place preventing creation of a file in a non-owned directory, or as the root user. However, these controls can be carefully bypassed to allow for an arbitrary file write as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://gist.github.com/picar0jsu/a8e623639da34f36202ce5e436668de7; https://gist.github.com/picar0jsu/a8e623639da34f36202ce5e436668de7
CVE: CVE-2023-32322
Published: 2023-05-18
Description: Ombi is an open source application which allows users to request specific media from popular self-hosted streaming servers. Versions prior to 4.38.2 contain an arbitrary file read vulnerability where an Ombi administrative user may access files available to the Ombi server process on the host operating system. Ombi administrators may not always be local system administrators and so this may violate the security expectations of the system. The arbitrary file read vulnerability was present in `ReadLogFile` and `Download` endpoints in `SystemControllers.cs` as the parameter `logFileName` is not sanitized before being combined with the `Logs` directory. When using `Path.Combine(arg1, arg2, arg3)`, an attacker may be able to escape to folders/files outside of `Path.Combine(arg1, arg2)` by using ".." in `arg3`. In addition, by specifying an absolute path for `arg3`, `Path.Combine` will completely ignore the first two arguments and just return just `arg3`. This vulnerability can lead to information disclosure. The Ombi `documentation` suggests running Ombi as a Service with Administrator privileges. An attacker targeting such an application may be able to read the files of any Windows user on the host machine and certain system files. This issue has been addressed in commit `b8a8f029` and in release version 4.38.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GHSL-2023-088.

CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://docs.ombi.app/guides/installation/#windows; https://github.com/Ombi-app/Ombi/blob/v4.36.1/src/Ombi/Controllers/V2/SystemController.cs#L46; https://github.com/Ombi-app/Ombi/blob/v4.36.1/src/Ombi/Controllers/V2/SystemController.cs#L58
CVE: CVE-2022-36326
Published: 2023-05-18
Description: An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires the attacker to already have root privileges in order to exploit this vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191; https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202; https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191
CVE: CVE-2022-36327
Published: 2023-05-18
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires an authentication bypass issue to be triggered before this can be exploited. 
This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191; https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202; https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191
CVE: CVE-2022-36328
Published: 2023-05-18
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device configurations was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This can only be exploited once an attacker gains root privileges on the devices using an authentication bypass issue or another vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.


CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191; https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202; https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191
CVE: CVE-2023-31597
Published: 2023-05-18
Description: An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers are also able to gain unauthorized access to existing tickets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://zammad.com/de/advisories/zaa-2023-03; https://zammad.com/de/advisories/zaa-2023-03
CVE: CVE-2023-0965
Published: 2023-05-18
Description: 
Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


CVSS Score: 3.1 (LOW)
CWE: CWE-14
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE: CVE-2023-1132
Published: 2023-05-18
Description: 
Compiler removal of buffer clearing in 

sli_se_driver_key_agreement

 in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-14
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE: CVE-2023-2481
Published: 2023-05-18
Description: 
Compiler removal of buffer clearing in 



sli_se_opaque_import_key


 in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-14
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE: CVE-2023-30333
Published: 2023-05-18
Description: An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/j0k1rr/some-automated-script/issues/3; https://github.com/j0k1rr/some-automated-script/issues/3
CVE: CVE-2023-32096
Published: 2023-05-18
Description: 
Compiler removal of buffer clearing in 





sli_crypto_transparent_aead_encrypt_tag



 in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


CVSS Score: 3.1 (LOW)
CWE: CWE-14
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE: CVE-2023-32097
Published: 2023-05-18
Description: 
Compiler removal of buffer clearing in 





sli_crypto_transparent_aead_decrypt_tag



 in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


CVSS Score: 3.1 (LOW)
CWE: CWE-14
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE: CVE-2023-32098
Published: 2023-05-18
Description: 
Compiler removal of buffer clearing in 







sli_se_sign_message




 in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-14
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE: CVE-2023-32099
Published: 2023-05-18
Description: 
Compiler removal of buffer clearing in 







sli_se_sign_hash in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-14
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE: CVE-2023-32100
Published: 2023-05-18
Description: 
Compiler removal of buffer clearing in 

sli_se_driver_mac_compute

in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-14
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE: CVE-2023-29720
Published: 2023-05-18
Description: SofaWiki <=3.8.9 is vulnerable to Cross Site Scripting (XSS) via index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/bellenuit/sofawiki/issues/26; https://github.com/xul18/Showcase/issues/1; https://github.com/bellenuit/sofawiki/issues/26