deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-20772
Published: 2023-07-04
Description: In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441796; Issue ID: ALPS07441796.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/July-2023; https://corp.mediatek.com/product-security-bulletin/July-2023
CVE: CVE-2023-20773
Published: 2023-07-04
Description: In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07611449; Issue ID: ALPS07441735.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/July-2023; https://corp.mediatek.com/product-security-bulletin/July-2023
CVE: CVE-2023-20774
Published: 2023-07-04
Description: In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07292228; Issue ID: ALPS07292228.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/July-2023; https://corp.mediatek.com/product-security-bulletin/July-2023
CVE: CVE-2023-20775
Published: 2023-07-04
Description: In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07978760; Issue ID: ALPS07363410.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/July-2023; https://corp.mediatek.com/product-security-bulletin/July-2023
CVE: CVE-2023-21624
Published: 2023-07-04
Description: Information disclosure in DSP Services while loading dynamic module.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-21629
Published: 2023-07-04
Description: Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-21631
Published: 2023-07-04
Description: Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-21633
Published: 2023-07-04
Description: Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-21635
Published: 2023-07-04
Description: Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-21637
Published: 2023-07-04
Description: Memory corruption in Linux while calling system configuration APIs.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-21638
Published: 2023-07-04
Description: Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-704, CWE-704
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-21639
Published: 2023-07-04
Description: Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-21640
Published: 2023-07-04
Description: Memory corruption in Linux when the file upload API is called with parameters having large buffer.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-21641
Published: 2023-07-04
Description: An app with non-privileged access can change global system brightness and cause undesired system behavior.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-21672
Published: 2023-07-04
Description: Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-22386
Published: 2023-07-04
Description: Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-22387
Published: 2023-07-04
Description: Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-823
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-22667
Published: 2023-07-04
Description: Memory Corruption in Audio while allocating the ion buffer during the music playback.
CVSS Score: 8.4 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-24851
Published: 2023-07-04
Description: Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-24854
Published: 2023-07-04
Description: Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-28541
Published: 2023-07-04
Description: Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2023-28542
Published: 2023-07-04
Description: Memory Corruption in WLAN HOST while fetching TX status information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin
CVE: CVE-2022-4623
Published: 2023-07-04
Description: The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/1b3201da-f254-406f-9b4a-cd5025b6b03d; https://wpscan.com/vulnerability/1b3201da-f254-406f-9b4a-cd5025b6b03d
CVE: CVE-2023-1273
Published: 2023-07-04
Description: The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/0805ed7e-395d-48de-b484-6c3ec1cd4b8e; https://wpscan.com/vulnerability/0805ed7e-395d-48de-b484-6c3ec1cd4b8e
CVE: CVE-2023-2010
Published: 2023-07-04
Description: The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll.
CVSS Score: 3.1 (LOW)
CWE: CWE-362
References: https://wpscan.com/vulnerability/d0da4c0d-622f-4310-a867-6bfdb474073a; https://wpscan.com/vulnerability/d0da4c0d-622f-4310-a867-6bfdb474073a
CVE: CVE-2023-2320
Published: 2023-07-04
Description: The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/f17ccbaa-2fcd-4f17-a4da-73f2bc8a4fe9; https://wpscan.com/vulnerability/f17ccbaa-2fcd-4f17-a4da-73f2bc8a4fe9
CVE: CVE-2023-2321
Published: 2023-07-04
Description: The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/79a56359-f7e8-4c8c-b0aa-6300f5d57880; https://wpscan.com/vulnerability/79a56359-f7e8-4c8c-b0aa-6300f5d57880
CVE: CVE-2023-2324
Published: 2023-07-04
Description: The Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro WordPress plugin through 1.0.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/50d81eec-f324-4445-b10f-96e94153917e; https://wpscan.com/vulnerability/50d81eec-f324-4445-b10f-96e94153917e
CVE: CVE-2023-2333
Published: 2023-07-04
Description: The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/13c4e065-fde6-41a4-a22b-bca1b10e0d30; https://wpscan.com/vulnerability/13c4e065-fde6-41a4-a22b-bca1b10e0d30
CVE: CVE-2023-3133
Published: 2023-07-04
Description: The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
CVSS Score: 7.5 (HIGH)
References: https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253; https://wordpress.org/plugins/tutor/; https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5
CVE: CVE-2023-3139
Published: 2023-07-04
Description: The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://magos-securitas.com/txt/CVE-2023-3139.txt; https://wpscan.com/vulnerability/f8a29aee-19cd-4e62-b829-afc9107f69bd; https://magos-securitas.com/txt/CVE-2023-3139.txt
CVE: CVE-2023-3460
Published: 2023-07-04
Description: The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin/; https://wpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7; https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin/
CVE: CVE-2023-2974
Published: 2023-07-04
Description: A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-757
References: https://access.redhat.com/errata/RHSA-2023:3809; https://access.redhat.com/security/cve/CVE-2023-2974; https://bugzilla.redhat.com/show_bug.cgi?id=2211026
CVE: CVE-2023-3502
Published: 2023-07-04
Description: A vulnerability, which was classified as critical, was found in SourceCodester Shopping Website 1.0. Affected is an unknown function of the file search-result.php. The manipulation of the argument product leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-232950 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/MoeMion233/VulHub/blob/main/Shopping%20Website%20(E-Commerce)%20search-result.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.232950; https://vuldb.com/?id.232950
CVE: CVE-2023-3503
Published: 2023-07-04
Description: A vulnerability has been found in SourceCodester Shopping Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file insert-product.php. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232951.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/Turbo51/CveHubList/blob/main/Shopping%20Website%20(E-Commerce)%20%20insert-product.php%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf; https://vuldb.com/?ctiid.232951; https://vuldb.com/?id.232951
CVE: CVE-2023-3504
Published: 2023-07-04
Description: A vulnerability was found in SmartWeb Infotech Job Board 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /settings/account of the component My Profile Page. The manipulation of the argument filename leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-232952. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://vuldb.com/?ctiid.232952; https://vuldb.com/?id.232952; https://vuldb.com/?ctiid.232952
CVE: CVE-2023-3505
Published: 2023-07-04
Description: A vulnerability was found in Onest CRM 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/project/update/2 of the component Project List Handler. The manipulation of the argument name with the input <script>alert(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-232953 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.232953; https://vuldb.com/?id.232953; https://vuldb.com/?ctiid.232953
CVE: CVE-2023-3506
Published: 2023-07-04
Description: A vulnerability was found in Active It Zone Active eCommerce CMS 6.5.0. It has been declared as problematic. This vulnerability affects unknown code of the file /ecommerce/support_ticket of the component Create Ticket Page. The manipulation of the argument details with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely. VDB-232954 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.232954; https://vuldb.com/?id.232954; https://vuldb.com/?ctiid.232954
CVE: CVE-2023-31999
Published: 2023-07-04
Description: All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it.

v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://auth0.com/docs/secure/attack-protection/state-parameters; https://github.com/fastify/fastify-oauth2/releases/tag/v7.2.0; https://hackerone.com/reports/2020418
CVE: CVE-2022-42175
Published: 2023-07-05
Description: Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: http://soluslabs.com; http://solusvm.com; https://gist.github.com/mr404ntf/9c8728ee8f35d9744feec3828df1085d
CVE: CVE-2023-33201
Published: 2023-07-05
Description: Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://bouncycastle.org; https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc; https://github.com/bcgit/bc-java/wiki/CVE-2023-33201
CVE: CVE-2023-35786
Published: 2023-07-05
Description: Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611
References: https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-35786.html; https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-35786.html
CVE: CVE-2023-34150
Published: 2023-07-05
Description: ** UNSUPPORTED WHEN ASSIGNED ** Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://lists.apache.org/thread/713tk23khbtbg940pb2ql8ggd4cvh6j1; https://lists.apache.org/thread/713tk23khbtbg940pb2ql8ggd4cvh6j1
CVE: CVE-2023-37201
Published: 2023-07-05
Description: An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1826002; https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html; https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html
CVE: CVE-2023-37202
Published: 2023-07-05
Description: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1834711; https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html; https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html
CVE: CVE-2023-37207
Published: 2023-07-05
Description: A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-470
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1816287; https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html; https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html
CVE: CVE-2023-37208
Published: 2023-07-05
Description: When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1837675; https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html; https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html
CVE: CVE-2023-2880
Published: 2023-07-05
Description: Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi v1.3.3 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesystem of the FDS001 device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://cert.vde.com/en/advisories/VDE-2023-011/; https://cert.vde.com/en/advisories/VDE-2023-011/
CVE: CVE-2023-37203
Published: 2023-07-05
Description: Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files.  This could have been leveraged to execute arbitrary code. This vulnerability affects Firefox < 115.
CVSS Score: 7.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=291640; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-22/
CVE: CVE-2023-37204
Published: 2023-07-05
Description: A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational function. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1832195; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-22/
CVE: CVE-2023-37205
Published: 2023-07-05
Description: The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox < 115.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1704420; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-22/