deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28235
Published: 2023-04-11
Description: Windows Lock Screen Security Feature Bypass Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28235; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28235
CVE: CVE-2023-28236
Published: 2023-04-11
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28236; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28236
CVE: CVE-2023-28237
Published: 2023-04-11
Description: Windows Kernel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28237; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28237
CVE: CVE-2023-28238
Published: 2023-04-11
Description: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28238; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28238
CVE: CVE-2023-28240
Published: 2023-04-11
Description: Windows Network Load Balancing Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28240; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28240
CVE: CVE-2023-28241
Published: 2023-04-11
Description: Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28241; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28241
CVE: CVE-2023-28243
Published: 2023-04-11
Description: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28243; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28243
CVE: CVE-2023-28244
Published: 2023-04-11
Description: Windows Kerberos Elevation of Privilege Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-327
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28244; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28244
CVE: CVE-2023-28246
Published: 2023-04-11
Description: Windows Registry Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28246; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28246
CVE: CVE-2023-28247
Published: 2023-04-11
Description: Windows Network File System Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28247; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28247
CVE: CVE-2023-28248
Published: 2023-04-11
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28248; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28248
CVE: CVE-2023-28249
Published: 2023-04-11
Description: Windows Boot Manager Security Feature Bypass Vulnerability
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-863
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28249; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28249
CVE: CVE-2023-28250
Published: 2023-04-11
Description: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28250; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28250
CVE: CVE-2023-28252
Published: 2023-04-11
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252; http://packetstormsecurity.com/files/174668/Windows-Common-Log-File-System-Driver-clfs.sys-Privilege-Escalation.html; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252
CVE: CVE-2023-28253
Published: 2023-04-11
Description: Windows Kernel Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28253; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28253
CVE: CVE-2023-28254
Published: 2023-04-11
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28254; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28254
CVE: CVE-2023-28255
Published: 2023-04-11
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28255; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28255
CVE: CVE-2023-28256
Published: 2023-04-11
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28256; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28256
CVE: CVE-2023-28260
Published: 2023-04-11
Description: .NET DLL Hijacking Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28260; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28260
CVE: CVE-2023-28262
Published: 2023-04-11
Description: Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28262; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28262
CVE: CVE-2023-28263
Published: 2023-04-11
Description: Visual Studio Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-170
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28263; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28263
CVE: CVE-2023-28266
Published: 2023-04-11
Description: Windows Common Log File System Driver Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28266; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28266
CVE: CVE-2023-28267
Published: 2023-04-11
Description: Remote Desktop Protocol Client Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28267; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28267
CVE: CVE-2023-28268
Published: 2023-04-11
Description: Netlogon RPC Elevation of Privilege Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28268; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28268
CVE: CVE-2023-28269
Published: 2023-04-11
Description: Windows Boot Manager Security Feature Bypass Vulnerability
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28269; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28269
CVE: CVE-2023-28270
Published: 2023-04-11
Description: Windows Lock Screen Security Feature Bypass Vulnerability
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28270; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28270
CVE: CVE-2023-28271
Published: 2023-04-11
Description: Windows Kernel Memory Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28271; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28271
CVE: CVE-2023-28272
Published: 2023-04-11
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28272; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28272
CVE: CVE-2023-28273
Published: 2023-04-11
Description: Windows Clip Service Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-591, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28273; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28273
CVE: CVE-2023-28274
Published: 2023-04-11
Description: Windows Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28274; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28274
CVE: CVE-2023-28275
Published: 2023-04-11
Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28275; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28275
CVE: CVE-2023-28276
Published: 2023-04-11
Description: Windows Group Policy Security Feature Bypass Vulnerability
CVSS Score: 4.4 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28276; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28276
CVE: CVE-2023-28277
Published: 2023-04-11
Description: Windows DNS Server Information Disclosure Vulnerability
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28277; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28277
CVE: CVE-2023-28278
Published: 2023-04-11
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-591, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28278; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28278
CVE: CVE-2023-28284
Published: 2023-04-11
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28284; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28284
CVE: CVE-2023-28285
Published: 2023-04-11
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28285; http://packetstormsecurity.com/files/173127/Microsoft-Office-Remote-Code-Execution.html; http://packetstormsecurity.com/files/173140/Microsoft-365-MSO-2305-Build-16.0.16501.20074-Remote-Code-Execution.html
CVE: CVE-2023-28288
Published: 2023-04-11
Description: Microsoft SharePoint Server Spoofing Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28288; http://packetstormsecurity.com/files/173126/Microsoft-SharePoint-Enterprise-Server-2016-Spoofing.html; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28288
CVE: CVE-2023-28291
Published: 2023-04-11
Description: Raw Image Extension Remote Code Execution Vulnerability
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28291; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28291
CVE: CVE-2023-28292
Published: 2023-04-11
Description: Raw Image Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28292; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28292
CVE: CVE-2023-28293
Published: 2023-04-11
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28293; http://packetstormsecurity.com/files/173135/Microsoft-Windows-11-22h2-Kernel-Privilege-Escalation.html; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28293
CVE: CVE-2023-28296
Published: 2023-04-11
Description: Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28296; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28296
CVE: CVE-2023-28297
Published: 2023-04-11
Description: Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28297; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28297
CVE: CVE-2023-28298
Published: 2023-04-11
Description: Windows Kernel Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28298; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28298
CVE: CVE-2023-28299
Published: 2023-04-11
Description: Visual Studio Spoofing Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28299; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28299
CVE: CVE-2023-28300
Published: 2023-04-11
Description: Azure Service Connector Security Feature Bypass Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28300; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28300
CVE: CVE-2023-28301
Published: 2023-04-11
Description: Microsoft Edge (Chromium-based) Tampering Vulnerability
CVSS Score: 3.7 (LOW)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28301; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28301
CVE: CVE-2023-28302
Published: 2023-04-11
Description: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28302; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28302
CVE: CVE-2023-28304
Published: 2023-04-11
Description: Microsoft ODBC and OLE DB Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28304; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28304
CVE: CVE-2023-28305
Published: 2023-04-11
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28305; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28305
CVE: CVE-2023-28306
Published: 2023-04-11
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28306; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28306
CVE: CVE-2023-28307
Published: 2023-04-11
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28307; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28307
CVE: CVE-2023-28308
Published: 2023-04-11
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28308; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28308
CVE: CVE-2023-28309
Published: 2023-04-11
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28309; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28309
CVE: CVE-2023-28311
Published: 2023-04-11
Description: Microsoft Word Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28311; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28311
CVE: CVE-2023-28312
Published: 2023-04-11
Description: Azure Machine Learning Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28312; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28312
CVE: CVE-2023-28313
Published: 2023-04-11
Description: Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28313; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28313
CVE: CVE-2023-28314
Published: 2023-04-11
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28314; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28314
CVE: CVE-2023-28808
Published: 2023-04-11
Description: Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/
CVE: CVE-2023-29576
Published: 2023-04-11
Description: Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_TrunAtom::SetDataOffset(int) function in Ap4TrunAtom.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/axiomatic-systems/Bento4/issues/844; https://github.com/z1r00/fuzz_vuln/blob/main/Bento4/mp4decrypt/sigv/readme.md; https://github.com/axiomatic-systems/Bento4/issues/844
CVE: CVE-2023-22613
Published: 2023-04-11
Description: An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. It is possible to write to an attacker-controlled address. An attacker could invoke an SMI handler with a malformed pointer in RCX that overlaps SMRAM, resulting in SMM memory corruption.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/; https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2023023
CVE: CVE-2022-48437
Published: 2023-04-12
Description: An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors that occur during leaf certificate verification, and therefore an incorrect error is returned. This behavior occurs when there is an installed verification callback that instructs the verifier to continue upon detecting an invalid certificate.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.1-relnotes.txt; https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/001_x509.patch.sig; https://github.com/openbsd/src/commit/4f94258c65a918ee3d8670e93916d15bf879e6ec
CVE: CVE-2023-30512
Published: 2023-04-12
Description: CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://github.com/cubefs/cubefs/issues/1882; https://github.com/cubefs/cubefs/issues/1882
CVE: CVE-2023-1829
Published: 2023-04-12
Description: A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.
We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8c710f75256bb3cf05ac7b1672c82b92c43f3d28; https://kernel.dance/#8c710f75256bb3cf05ac7b1672c82b92c43f3d28; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE: CVE-2022-24350
Published: 2023-04-12
Description: An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI function 0x17 verifies that the output buffer lies within the command buffer but does not verify that output data does not go beyond the end of the command buffer. In particular, the GetFlashTable function is called directly on the Command Buffer before the DataSize is check, leading to possible circumstances where the data immediately following the command buffer could be destroyed before returning a buffer size error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2023027; https://www.insyde.com/security-pledge
CVE: CVE-2022-47053
Published: 2023-04-12
Description: An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dnnsoftware.com/community/security/security-center; https://www.dnnsoftware.com/community/security/security-center#:~:text=XSS%20in%20Digital%20Asset%20Manager; https://www.dnnsoftware.com/community/security/security-center
CVE: CVE-2023-22616
Published: 2023-04-12
Description: An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-610, CWE-610
References: https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/; https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2023022
CVE: CVE-2023-27826
Published: 2023-04-12
Description: SeowonIntech SWC 5100W WIMAX Bootloader 1.18.19.0, HW 0.0.7.0, and FW 1.11.0.1, 1.9.9.4 are vulnerable to OS Command Injection. which allows attackers to take over the system with root privilege by abusing doSystem() function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://pastebin.com/raw/buhVV7iL; https://usermanual.wiki/SEOWON-INTECH/SWC5100W; https://www.exploit-db.com/exploits/51311
CVE: CVE-2023-29574
Published: 2023-04-12
Description: Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/axiomatic-systems/Bento4/issues/841; https://github.com/z1r00/fuzz_vuln/blob/main/Bento4/mp42avc/readme.md; https://github.com/axiomatic-systems/Bento4/issues/841
CVE: CVE-2023-29580
Published: 2023-04-12
Description: yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-653
References: https://github.com/yasm/yasm/issues/215; https://github.com/z1r00/fuzz_vuln/blob/main/yasm/segv/yasm_expr_create/readmd.md; https://github.com/yasm/yasm/issues/215