deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-40572
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40573
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40574
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40575
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40576
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40577
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40578
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40579
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40580
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40581
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40582
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40583
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40584
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40585
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40586
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40587
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40588
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40589
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40590
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40591
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40592
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40593
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40594
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40595
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40596
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40597
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40598
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40599
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40600
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-40601
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-48291
Published: 2023-03-27
Description: The Bluetooth module has an authentication bypass vulnerability in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48346
Published: 2023-03-27
Description: The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48347
Published: 2023-03-27
Description: The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48348
Published: 2023-03-27
Description: The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48349
Published: 2023-03-27
Description: The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidentiality and availability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-290
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48350
Published: 2023-03-27
Description: The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48351
Published: 2023-03-27
Description: The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48352
Published: 2023-03-27
Description: Some smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665, CWE-665
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48353
Published: 2023-03-27
Description: Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system service exceptions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48354
Published: 2023-03-27
Description: The Bluetooth module has a heap out-of-bounds write vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48355
Published: 2023-03-27
Description: The Bluetooth module has a heap out-of-bounds read vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48356
Published: 2023-03-27
Description: The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recognition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48357
Published: 2023-03-27
Description: Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48358
Published: 2023-03-27
Description: The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions.
CVSS Score: 7.4 (HIGH)
CWE: CWE-601
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48359
Published: 2023-03-27
Description: The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-915
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48360
Published: 2023-03-27
Description: The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2022-48361
Published: 2023-03-27
Description: The Always On Display (AOD) has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a failure in reading AOD theme resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2023-0179
Published: 2023-03-27
Description: A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://packetstormsecurity.com/files/171601/Kernel-Live-Patch-Security-Notice-LNS-0093-1.html; https://bugzilla.redhat.com/show_bug.cgi?id=2161713; https://seclists.org/oss-sec/2023/q1/20
CVE: CVE-2023-0210
Published: 2023-03-27
Description: A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=797805d81baa814f76cf7bdab35f86408a79d707; https://github.com/cifsd-team/ksmbd/commit/8824b7af409f51f1316e92e9887c2fd48c0b26d6
CVE: CVE-2023-0326
Published: 2023-03-27
Description: An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization headers was leaked in vulnerability report evidence.
CVSS Score: 5.0 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0326.json; https://gitlab.com/gitlab-org/gitlab/-/issues/388132; https://hackerone.com/reports/1826896
CVE: CVE-2023-1637
Published: 2023-03-27
Description: A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-226, CWE-212
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e2a1256b17b16f9b9adf1b6fea56819e7b68e463; https://sourceware.org/bugzilla/show_bug.cgi?id=27398; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e2a1256b17b16f9b9adf1b6fea56819e7b68e463
CVE: CVE-2023-1648
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-0326. Reason: This candidate is a duplicate of CVE-2023-0326. Notes: All CVE users should reference CVE-2023-0326 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-1665
Published: 2023-03-27
Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/linagora/twake/commit/599f397561a771251dfc7cafb8cecda5ab22b8b3; https://huntr.dev/bounties/db8fcbab-6ef0-44ba-b5c6-3b0f17ca22a2; https://github.com/linagora/twake/commit/599f397561a771251dfc7cafb8cecda5ab22b8b3
CVE: CVE-2023-20860
Published: 2023-03-27
Description: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://spring.io/security/cve-2023-20860; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-26493
Published: 2023-03-27
Description: Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the `web-interface-check.yml` was subject to command injection. The `web-interface-check.yml` was triggered when a pull request was opened or updated and contained the user controllable field `(${{ github.head_ref }} – the name of the fork’s branch)`. This would allow an attacker to take over the GitHub Runner and run custom commands (potentially stealing secrets such as GITHUB_TOKEN) and altering the repository. The workflow has since been removed for the repository. There are no actions required of users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/cocos/cocos-engine/blob/2362df28a4b3016dbda[PII_REDACTED][PII_REDACTED]8/.github/workflows/web-interface-check.yml; https://github.com/cocos/cocos-engine/commit/6d06aefa2684e20da79e7ceaf41f728c1a8d7a41; https://securitylab.github.com/advisories/GHSL-2023-027_Engine_for_Cocos_Creator/
CVE: CVE-2023-26547
Published: 2023-03-27
Description: The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2023-26548
Published: 2023-03-27
Description: The pgmng module has a vulnerability in serialization/deserialization. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2023-26549
Published: 2023-03-27
Description: The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-233
References: https://consumer.huawei.com/en/support/bulletin/2023/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/3/
CVE: CVE-2023-26924
Published: 2023-03-27
Description: LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. NOTE: third parties dispute this because the LLVM security policy excludes "Language front-ends ... for which a malicious input file can cause undesirable behavior."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://gist.github.com/Colloportus0/fc16d10d74aedf89d5d1d020ebb89c0c; https://github.com/llvm/llvm-project/issues/60216; https://llvm.org/docs/Security.html#what-is-considered-a-security-issue
CVE: CVE-2023-28102
Published: 2023-03-27
Description: discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the `discordrb` library and will likely not be total system access. This issue has been addressed in code, but a new release of the `discordrb` gem has not been uploaded to rubygems. This issue is also tracked as `GHSL-2022-094`.
CVSS Score: 8.3 (HIGH)
CWE: CWE-78
References: https://github.com/shardlab/discordrb/commit/91e13043ffa89227c3fcdc3408f06da237d28c95; https://securitylab.github.com/advisories/GHSL-2022-094_discordrb/; https://github.com/shardlab/discordrb/commit/91e13043ffa89227c3fcdc3408f06da237d28c95
CVE: CVE-2023-28430
Published: 2023-03-27
Description: OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues (types: [closed]) (i.e., when an Issue is closed). The workflow starts with full write-permissions GitHub repository token since the default workflow permissions on Organization/Repository level are set to read-write. This workflow runs the following step with data controlled by the comment `(${{ github.event.issue.title }} – the full title of the Issue)`, allowing an attacker to take over the GitHub Runner and run custom commands, potentially stealing any secret (if used), or altering the repository. This issue was found with CodeQL using javascript’s Expression injection in Actions query. This issue has been addressed in the repositories github action. No actions are required by users. This issue is also tracked as `GHSL-2023-051`.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://github.com/OneSignal/react-native-onesignal/commit/4a66f4237fb51dcc[PII_REDACTED]d488cd49b0f433; https://github.com/OneSignal/react-native-onesignal/commit/4e43bda4ce1eb395f36bb8a[PII_REDACTED]c051085; https://securitylab.github.com/advisories/GHSL-2023-051_React_Native_OneSignal_SDK/
CVE: CVE-2023-23330
Published: 2023-03-28
Description: amano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552, CWE-552
References: https://medium.com/%40saleh.py/amano-xparc-local-file-inclusion-cve-2023-23330-672ae8fbfd1e; https://www.amano.eu/en/parking/xparc/; https://medium.com/%40saleh.py/amano-xparc-local-file-inclusion-cve-2023-23330-672ae8fbfd1e