deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1415
Published: 2023-09-11
Description: A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://access.redhat.com/errata/RHSA-2022:6813; https://access.redhat.com/security/cve/CVE-2022-1415; https://bugzilla.redhat.com/show_bug.cgi?id=2065505
CVE: CVE-2023-35658
Published: 2023-09-11
Description: In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d03a3020de69143b1fe8129d75e55f14951dd192; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d03a3020de69143b1fe8129d75e55f14951dd192
CVE: CVE-2023-35664
Published: 2023-09-11
Description: In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/47299fd978258e67a8eebc361cb7a4dd2936205e; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/47299fd978258e67a8eebc361cb7a4dd2936205e
CVE: CVE-2023-35665
Published: 2023-09-11
Description: In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://android.googlesource.com/platform/packages/services/Telephony/+/674039e70e1c5bf29b808899ac80c709acc82290; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/services/Telephony/+/674039e70e1c5bf29b808899ac80c709acc82290
CVE: CVE-2023-35666
Published: 2023-09-11
Description: In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b7ea57f620436c83a9766f928437ddadaa232e3a; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b7ea57f620436c83a9766f928437ddadaa232e3a
CVE: CVE-2023-35667
Published: 2023-09-11
Description: In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://android.googlesource.com/platform/packages/apps/Settings/+/d8355ac47e068ad20c6a7b1602e72f0585ec0085; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/apps/Settings/+/d8355ac47e068ad20c6a7b1602e72f0585ec0085
CVE: CVE-2023-35669
Published: 2023-09-11
Description: In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activities due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://android.googlesource.com/platform/frameworks/base/+/f810d81839af38ee121c446105ca67cb12992fc6; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/frameworks/base/+/f810d81839af38ee121c446105ca67cb12992fc6
CVE: CVE-2023-35670
Published: 2023-09-11
Description: In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private directories due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db3c69afcb0a45c8aa2f333fcde[PII_REDACTED]9fe; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db3c69afcb0a45c8aa2f333fcde[PII_REDACTED]9fe
CVE: CVE-2023-35671
Published: 2023-09-11
Description: In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked screen mode due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://android.googlesource.com/platform/packages/apps/Nfc/+/745632835f3d97513a9c2a96e56e1dc06c4e4176; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/apps/Nfc/+/745632835f3d97513a9c2a96e56e1dc06c4e4176
CVE: CVE-2023-35673
Published: 2023-09-11
Description: In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8770c07c102c7fdc74626dc717acc8f6dd1c92cc; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8770c07c102c7fdc74626dc717acc8f6dd1c92cc
CVE: CVE-2023-35674
Published: 2023-09-11
Description: In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://android.googlesource.com/platform/frameworks/base/+/7428962d3b064ce1122809d87af65099d1129c9e; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/frameworks/base/+/7428962d3b064ce1122809d87af65099d1129c9e
CVE: CVE-2023-35675
Published: 2023-09-11
Description: In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files played by another user on the same device due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/platform/frameworks/base/+/c1cf4b9746c[PII_REDACTED]172522324ccd5b8c914; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/frameworks/base/+/c1cf4b9746c[PII_REDACTED]172522324ccd5b8c914
CVE: CVE-2023-35676
Published: 2023-09-11
Description: In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://android.googlesource.com/platform/frameworks/base/+/109e58b62dc9fedcee93983678ef9d4931e72afa; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/frameworks/base/+/109e58b62dc9fedcee93983678ef9d4931e72afa
CVE: CVE-2023-35677
Published: 2023-09-11
Description: In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service (factory reset or continuous locking) with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://android.googlesource.com/platform/packages/apps/Settings/+/846180c19f68f6fb1b[PII_REDACTED]d3235fef846e; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/apps/Settings/+/846180c19f68f6fb1b[PII_REDACTED]d3235fef846e
CVE: CVE-2023-35679
Published: 2023-09-11
Description: In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://android.googlesource.com/platform/frameworks/av/+/ea6131efa76a0b2a12724ffd157909e2c6fb4036; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/frameworks/av/+/ea6131efa76a0b2a12724ffd157909e2c6fb4036
CVE: CVE-2023-35680
Published: 2023-09-11
Description: In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-470
References: https://android.googlesource.com/platform/packages/services/Telephony/+/674039e70e1c5bf29b808899ac80c709acc82290; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/services/Telephony/+/674039e70e1c5bf29b808899ac80c709acc82290
CVE: CVE-2023-35681
Published: 2023-09-11
Description: In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d8d95291f16a8f18f8ffbd6322c14686897c5730; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d8d95291f16a8f18f8ffbd6322c14686897c5730
CVE: CVE-2023-35682
Published: 2023-09-11
Description: In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/packages/apps/Launcher3/+/09f8b0e52e45a0b39bab457534ba2e5ae91ffad0; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/apps/Launcher3/+/09f8b0e52e45a0b39bab457534ba2e5ae91ffad0
CVE: CVE-2023-35683
Published: 2023-09-11
Description: In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://android.googlesource.com/platform/packages/providers/MediaProvider/+/23d156ed1bed6d2c2b325f0be540d0afca510c49; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/providers/MediaProvider/+/23d156ed1bed6d2c2b325f0be540d0afca510c49
CVE: CVE-2023-35684
Published: 2023-09-11
Description: In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/668bbca[PII_REDACTED]4d88db4c9b69102f3939008; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/668bbca[PII_REDACTED]4d88db4c9b69102f3939008
CVE: CVE-2023-35687
Published: 2023-09-11
Description: In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://android.googlesource.com/platform/frameworks/av/+/ea6131efa76a0b2a12724ffd157909e2c6fb4036; https://source.android.com/security/bulletin/2023-09-01; https://android.googlesource.com/platform/frameworks/av/+/ea6131efa76a0b2a12724ffd157909e2c6fb4036
CVE: CVE-2023-4897
Published: 2023-09-11
Description: Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23
References: https://github.com/mintplex-labs/anything-llm/commit/3c88aec034934bcbad30c5ef1cab62cbbdb98e64; https://huntr.dev/bounties/0631af48-84a3-4019-85db-f0f8b12cb0ab; https://github.com/mintplex-labs/anything-llm/commit/3c88aec034934bcbad30c5ef1cab62cbbdb98e64
CVE: CVE-2023-38878
Published: 2023-09-11
Description: A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the 'error' and 'error_description' parameters of 'oauth2.php'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/devcode-it/openstamanager; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38878; https://openstamanager.com/
CVE: CVE-2023-41879
Published: 2023-09-11
Description: Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://github.com/OpenMage/magento-lts/commit/2a2a2fb504247e8966f8ffc2e17d614be5d43128; https://github.com/OpenMage/magento-lts/commit/31e74ac5d670b10001f88f038046b62367f15877; https://github.com/OpenMage/magento-lts/releases/tag/v19.5.1
CVE: CVE-2023-39069
Published: 2023-09-11
Description: An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEC-ADV-2022-001%3A%20Authentication%20bypass%20due%20to%20incomplete%20checks%20in%20the%20Active%20Directory%20authentication%20module.md; https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEC-ADV-2022-001%3A%20Authentication%20bypass%20due%20to%20incomplete%20checks%20in%20the%20Active%20Directory%20authentication%20module.md
CVE: CVE-2023-40440
Published: 2023-09-12
Description: This issue was addressed with improved state management of S/MIME encrypted emails. This issue is fixed in macOS Monterey 12.6.8. A S/MIME encrypted email may be inadvertently sent unencrypted.
CVSS Score: 7.5 (HIGH)
References: https://blog.aegrel.ee/apple-mail-smime.html; https://support.apple.com/en-us/HT213844; https://blog.aegrel.ee/apple-mail-smime.html
CVE: CVE-2023-40442
Published: 2023-09-12
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8. An app may be able to read sensitive location information.
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://support.apple.com/en-us/HT213842; https://support.apple.com/en-us/HT213844; https://support.apple.com/en-us/HT213845
CVE: CVE-2023-41990
Published: 2023-09-12
Description: The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Ventura 13.2, watchOS 9.3. Processing a font file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT213599; https://support.apple.com/en-us/HT213601; https://support.apple.com/en-us/HT213605
CVE: CVE-2023-4898
Published: 2023-09-12
Description: Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-305
References: https://github.com/mintplex-labs/anything-llm/commit/dc3dfbf31495fe316b21ee184b9317b38101d30e; https://huntr.dev/bounties/a3dda692-7e8a-44a9-bd96-24cfd3f721d2; https://github.com/mintplex-labs/anything-llm/commit/dc3dfbf31495fe316b21ee184b9317b38101d30e
CVE: CVE-2023-4899
Published: 2023-09-12
Description:  SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/mintplex-labs/anything-llm/commit/dc3dfbf31495fe316b21ee184b9317b38101d30e; https://huntr.dev/bounties/70a2fb18-f030-4abb-9ddc-13f94107ac9d; https://github.com/mintplex-labs/anything-llm/commit/dc3dfbf31495fe316b21ee184b9317b38101d30e
CVE: CVE-2023-25519
Published: 2023-09-12
Description: 
NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrect user management error. A successful exploit of this vulnerability may lead to escalation of privileges.  


CVSS Score: 7.8 (HIGH)
CWE: CWE-286
References: https://https://nvidia.custhelp.com/app/answers/detail/a_id/5479; https://nvidia.custhelp.com/app/answers/detail/a_id/5479; https://https://nvidia.custhelp.com/app/answers/detail/a_id/5479
CVE: CVE-2023-32005
Published: 2023-09-12
Description: A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.

This flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.

This vulnerability affects all users using the experimental permission model in Node.js 20.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://hackerone.com/reports/2051224; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://hackerone.com/reports/2051224
CVE: CVE-2023-32558
Published: 2023-09-12
Description: The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. 

This vulnerability affects all users using the experimental permission model in Node.js 20.x.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://hackerone.com/reports/2051257; https://hackerone.com/reports/2051257; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-37489
Published: 2023-09-12
Description: Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidentiality and no impact on the application's availability or integrity.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://me.sap.com/notes/3352453; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3352453
CVE: CVE-2023-40308
Published: 2023-09-12
Description: SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://me.sap.com/notes/3327896; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3327896
CVE: CVE-2023-41367
Published: 2023-09-12
Description: Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific function anonymously. On successful exploitation of vulnerability under specific circumstances, attacker can view user’s email address. There is no integrity/availability impact.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://me.sap.com/notes/3348142; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3348142
CVE: CVE-2023-41368
Published: 2023-09-12
Description: The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call.


CVSS Score: 2.7 (LOW)
CWE: CWE-639
References: https://me.sap.com/notes/3355675; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3355675
CVE: CVE-2023-41369
Published: 2023-09-12
Description: The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.


CVSS Score: 3.5 (LOW)
CWE: CWE-611
References: https://me.sap.com/notes/3369680; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3369680
CVE: CVE-2023-42472
Published: 2023-09-12
Description: Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could intercept the request, modify the content type and the extension to read and modify sensitive data causing a high impact on confidentiality and integrity of the application.


CVSS Score: 8.7 (HIGH)
CWE: CWE-434
References: https://me.sap.com/notes/3370490; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3370490