deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22764
Published: 2023-03-01
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22765
Published: 2023-03-01
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22766
Published: 2023-03-01
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22767
Published: 2023-03-01
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22768
Published: 2023-03-01
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22769
Published: 2023-03-01
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22770
Published: 2023-03-01
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22771
Published: 2023-03-01
Description: An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-613
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22772
Published: 2023-03-01
Description: An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22773
Published: 2023-03-01
Description: Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.

CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22774
Published: 2023-03-01
Description: Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.

CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22775
Published: 2023-03-01
Description: A vulnerability exists which allows an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22776
Published: 2023-03-01
Description: An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.

CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22777
Published: 2023-03-01
Description: An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.

CVSS Score: 4.9 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-22778
Published: 2023-03-01
Description: A vulnerability in the ArubaOS web management interface could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE: CVE-2023-25694
Published: 2023-03-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2023-26281
Published: 2023-03-01
Description: IBM HTTP Server 8.5 used by IBM WebSphere Application Server could allow a remote user to cause a denial of service using a specially crafted URL.  IBM X-Force ID:  248296.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248296; https://www.ibm.com/support/pages/node/6958522; https://exchange.xforce.ibmcloud.com/vulnerabilities/248296
CVE: CVE-2023-1112
Published: 2023-03-01
Description: A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://github.com/Nickguitar/Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal; https://vuldb.com/?ctiid.222072; https://vuldb.com/?id.222072
CVE: CVE-2023-1113
Published: 2023-03-01
Description: A vulnerability was found in SourceCodester Simple Payroll System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file admin/?page=admin of the component POST Parameter Handler. The manipulation of the argument fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222073 was assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/lcg-22266/bug_report/blob/main/vendors/oretnom23/Simple%20Payroll%20System/XSS-1.md; https://vuldb.com/?ctiid.222073; https://vuldb.com/?id.222073
CVE: CVE-2021-4327
Published: 2023-03-01
Description: A vulnerability was found in SerenityOS. It has been rated as critical. Affected by this issue is the function initialize_typed_array_from_array_buffer in the library Userland/Libraries/LibJS/Runtime/TypedArray.cpp. The manipulation leads to integer overflow. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as f6c6047e49f1517778f5565681fb64750b14bf60. It is recommended to apply a patch to fix this issue. VDB-222074 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://devcraft.io/2021/02/11/serenityos-writing-a-full-chain-exploit.html; https://github.com/SerenityOS/serenity/commit/f6c6047e49f1517778f5565681fb64750b14bf60; https://vuldb.com/?ctiid.222074
CVE: CVE-2023-1064
Published: 2023-03-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Uzay Baskul Weighbridge Automation Software allows SQL Injection.This issue affects Weighbridge Automation Software: before 1.1.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0115; https://www.usom.gov.tr/bildirim/tr-23-0115
CVE: CVE-2023-1114
Published: 2023-03-01
Description: Missing Authorization vulnerability in Eskom e-Belediye allows Information Elicitation.This issue affects e-Belediye: from 1.0.0.95 before 1.0.0.100.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://www.usom.gov.tr/bildirim/tr-23-0113-2; https://www.usom.gov.tr/bildirim/tr-23-0113-2
CVE: CVE-2023-23973
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Contact Us Page – Contact People plugin <= 3.7.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/contact-us-page-contact-people/wordpress-contact-us-page-contact-people-plugin-3-7-0-cross-site-request-forgery-csrf-leading-to-contact-creation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-us-page-contact-people/wordpress-contact-us-page-contact-people-plugin-3-7-0-cross-site-request-forgery-csrf-leading-to-contact-creation-vulnerability?_s_id=cve
CVE: CVE-2023-23974
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/quick-event-manager/wordpress-quick-event-manager-plugin-9-7-4-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/quick-event-manager/wordpress-quick-event-manager-plugin-9-7-4-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-23984
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu plugin <= 3.0.1 leading to form deletion.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/bubble-menu/wordpress-bubble-menu-circle-floating-menu-plugin-3-0-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/bubble-menu/wordpress-bubble-menu-circle-floating-menu-plugin-3-0-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-38468
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/nextgen-gallery/wordpress-wordpress-gallery-plugin-nextgen-gallery-plugin-3-28-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/nextgen-gallery/wordpress-wordpress-gallery-plugin-nextgen-gallery-plugin-3-28-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-40198
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/woo-wallet/wordpress-terawallet-for-woocommerce-plugin-1-3-24-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/woo-wallet/wordpress-terawallet-for-woocommerce-plugin-1-3-24-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-45068
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-mercadopago/wordpress-mercado-pago-payments-for-woocommerce-plugin-6-3-1-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-mercadopago/wordpress-mercado-pago-payments-for-woocommerce-plugin-6-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-mercadopago/wordpress-mercado-pago-payments-for-woocommerce-plugin-6-3-1-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve
CVE: CVE-2022-45804
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy change, included plugin deactivate & activate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-46797
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leads to plugin settings change.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/enhanced-e-commerce-for-woocommerce-store/wordpress-actionable-google-analytics-and-google-shopping-plugin-for-woocommerce-plugin-5-2-3-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/enhanced-e-commerce-for-woocommerce-store/wordpress-actionable-google-analytics-and-google-shopping-plugin-for-woocommerce-plugin-5-2-3-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-1115
Published: 2023-03-01
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/c6368b7cc69a3ebf2c83de7586f492ca1f404dd3; https://huntr.dev/bounties/cfa80332-e4cf-4d64-b3e5-e10298628d17; https://github.com/pimcore/pimcore/commit/c6368b7cc69a3ebf2c83de7586f492ca1f404dd3
CVE: CVE-2023-1116
Published: 2023-03-01
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/f6d322efa207a737eedd8726b7c92e957a83341e; https://huntr.dev/bounties/3245ff99-9adf-4db9-af94-f995747e09d1; https://github.com/pimcore/pimcore/commit/f6d322efa207a737eedd8726b7c92e957a83341e
CVE: CVE-2023-1117
Published: 2023-03-01
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/b9ba69f66d6a9986fb36f239661b98cd33a89853; https://huntr.dev/bounties/e8c0044d-a31b-4347-b2d5-59fbf492da39; https://github.com/pimcore/pimcore/commit/b9ba69f66d6a9986fb36f239661b98cd33a89853
CVE: CVE-2022-46798
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.5.1 leading to plugin settings change.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/woolentor-addons/wordpress-woolentor-plugin-2-5-1-csrf-leading-to-plugin-settings-change-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woolentor-addons/wordpress-woolentor-plugin-2-5-1-csrf-leading-to-plugin-settings-change-vulnerability?_s_id=cve
CVE: CVE-2022-46805
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 leading to activation/deactivation of plugin rulesets.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/conditional-payments-for-woocommerce/wordpress-conditional-payments-for-woocommerce-plugin-2-3-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/conditional-payments-for-woocommerce/wordpress-conditional-payments-for-woocommerce-plugin-2-3-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-46806
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/woo-cart-all-in-one/wordpress-cart-all-in-one-for-woocommerce-plugin-1-1-10-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/woo-cart-all-in-one/wordpress-cart-all-in-one-for-woocommerce-plugin-1-1-10-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47148
Published: 2023-03-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-pdf-invoices-packing-slips/wordpress-pdf-invoices-packing-slips-for-woocommerce-plugin-3-2-5-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-pdf-invoices-packing-slips/wordpress-pdf-invoices-packing-slips-for-woocommerce-plugin-3-2-5-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-23315
Published: 2023-03-01
Description: The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://friends-of-presta.github.io/security-advisories/modules/2023/03/01/stripejs.html; https://friends-of-presta.github.io/security-advisories/modules/2023/03/01/stripejs.html
CVE: CVE-2023-24567
Published: 2023-03-01
Description: 
Dell NetWorker versions 19.5 and earlier contain 'RabbitMQ' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and may launch target-specific attacks.


CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-668
References: https://www.dell.com/support/kbdoc/en-us/000210471/dsa-2023-058-dell-networker-security-update-for-version-disclosure-vulnerability; https://www.dell.com/support/kbdoc/en-us/000210471/dsa-2023-058-dell-networker-security-update-for-version-disclosure-vulnerability
CVE: CVE-2023-24751
Published: 2023-03-01
Description: libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the mc_chroma function at motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/strukturag/libde265/issues/379; https://lists.debian.org/debian-lts-announce/2023/03/msg00004.html; https://github.com/strukturag/libde265/issues/379
CVE: CVE-2023-24752
Published: 2023-03-01
Description: libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_hevc_epel_pixels_8_sse function at sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/strukturag/libde265/issues/378; https://lists.debian.org/debian-lts-announce/2023/03/msg00004.html; https://github.com/strukturag/libde265/issues/378
CVE: CVE-2023-24754
Published: 2023-03-01
Description: libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/strukturag/libde265/issues/382; https://lists.debian.org/debian-lts-announce/2023/03/msg00004.html; https://github.com/strukturag/libde265/issues/382
CVE: CVE-2023-24755
Published: 2023-03-01
Description: libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_weighted_pred_8_fallback function at fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/strukturag/libde265/issues/384; https://lists.debian.org/debian-lts-announce/2023/03/msg00004.html; https://github.com/strukturag/libde265/issues/384
CVE: CVE-2023-24756
Published: 2023-03-01
Description: libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_unweighted_pred_8_sse function at sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/strukturag/libde265/issues/380; https://lists.debian.org/debian-lts-announce/2023/03/msg00004.html; https://github.com/strukturag/libde265/issues/380
CVE: CVE-2023-24757
Published: 2023-03-01
Description: libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_unweighted_pred_16_fallback function at fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/strukturag/libde265/issues/385; https://lists.debian.org/debian-lts-announce/2023/03/msg00004.html; https://github.com/strukturag/libde265/issues/385