deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-40363
Published: 2023-11-18
Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to change installation files due to incorrect file permission settings.  IBM X-Force ID:  263332.
CVSS Score: 8.1 (HIGH)
CWE: CWE-276
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/263332; https://www.ibm.com/support/pages/node/7070742; https://exchange.xforce.ibmcloud.com/vulnerabilities/263332
CVE: CVE-2023-48736
Published: 2023-11-18
Description: In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-of-bounds read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/InternationalColorConsortium/DemoIccMAX/pull/58; https://github.com/InternationalColorConsortium/DemoIccMAX/pull/58
CVE: CVE-2023-47664
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview Plainview Protect Passwords.This issue affects Plainview Protect Passwords: from n/a through 1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/plainview-protect-passwords/wordpress-plainview-protect-passwords-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/plainview-protect-passwords/wordpress-plainview-protect-passwords-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47666
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Code Snippets Pro Code Snippets.This issue affects Code Snippets: from n/a through 3.5.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-3-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-3-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47667
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mammothology WP Full Stripe Free.This issue affects WP Full Stripe Free: from n/a through 7.0.16.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-full-stripe-free/wordpress-wp-full-stripe-free-plugin-1-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-full-stripe-free/wordpress-wp-full-stripe-free-plugin-1-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47670
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jongmyoung Kim Korea SNS.This issue affects Korea SNS: from n/a through 1.6.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/korea-sns/wordpress-korea-sns-plugin-1-6-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/korea-sns/wordpress-korea-sns-plugin-1-6-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47671
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy Vertical scroll recent.This issue affects Vertical scroll recent post: from n/a through 14.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/vertical-scroll-recent-post/wordpress-vertical-scroll-recent-post-plugin-14-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/vertical-scroll-recent-post/wordpress-vertical-scroll-recent-post-plugin-14-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47672
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Swashata WP Category Post List Widget.This issue affects WP Category Post List Widget: from n/a through 2.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-category-posts-list/wordpress-wp-category-post-list-widget-plugin-2-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-category-posts-list/wordpress-wp-category-post-list-widget-plugin-2-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47685
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Lukman Nakib Preloader Matrix.This issue affects Preloader Matrix: from n/a through 2.0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/matrix-pre-loader/wordpress-preloader-matrix-plugin-2-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/matrix-pre-loader/wordpress-preloader-matrix-plugin-2-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47243
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in CodeMShop 코드엠샵 마이사이트 – MSHOP MY SITE.This issue affects 코드엠샵 마이사이트 – MSHOP MY SITE: from n/a through 1.1.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mshop-mysite/wordpress-mshop-my-site-plugin-1-1-6-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mshop-mysite/wordpress-mshop-my-site-plugin-1-1-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-47519
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in WC Product Table WooCommerce Product Table Lite.This issue affects WooCommerce Product Table Lite: from n/a through 2.6.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wc-product-table-lite/wordpress-woocommerce-product-table-lite-plugin-2-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc-product-table-lite/wordpress-woocommerce-product-table-lite-plugin-2-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47531
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Dark Mode.This issue affects Droit Dark Mode: from n/a through 1.1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/droit-dark-mode/wordpress-droit-dark-mode-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/droit-dark-mode/wordpress-droit-dark-mode-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47551
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in RedNao Donations Made Easy – Smart Donations.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/smart-donations/wordpress-donations-made-easy-smart-donations-plugin-4-0-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smart-donations/wordpress-donations-made-easy-smart-donations-plugin-4-0-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47552
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Image Hover Effects – WordPress Plugin.This issue affects Image Hover Effects – WordPress Plugin: from n/a through 5.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/image-hover-effects/wordpress-image-hover-effects-plugin-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/image-hover-effects/wordpress-image-hover-effects-plugin-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47553
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in User Local Inc UserHeat Plugin.This issue affects UserHeat Plugin: from n/a through 1.1.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/userheat/wordpress-userheat-plugin-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/userheat/wordpress-userheat-plugin-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47556
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in James Mehorter Device Theme Switcher.This issue affects Device Theme Switcher: from n/a through 3.0.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/device-theme-switcher/wordpress-plugin-name-device-theme-switcher-plugin-3-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/device-theme-switcher/wordpress-plugin-name-device-theme-switcher-plugin-3-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47644
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.6.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-6-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-6-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47649
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in PriceListo Best Restaurant Menu by PriceListo.This issue affects Best Restaurant Menu by PriceListo: from n/a through 1.3.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/best-restaurant-menu-by-pricelisto/wordpress-best-restaurant-menu-by-pricelisto-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/best-restaurant-menu-by-pricelisto/wordpress-best-restaurant-menu-by-pricelisto-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47650
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Peter Sterling Add Local Avatar.This issue affects Add Local Avatar: from n/a through 12.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/add-local-avatar/wordpress-add-local-avatar-plugin-12-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/add-local-avatar/wordpress-add-local-avatar-plugin-12-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47651
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Robert Macchi WP Links Page.This issue affects WP Links Page: from n/a through 4.9.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-links-page/wordpress-wp-links-page-plugin-4-9-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-links-page/wordpress-wp-links-page-plugin-4-9-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47655
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi ANAC XML Bandi di Gara.This issue affects ANAC XML Bandi di Gara: from n/a through 7.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/avcp/wordpress-anac-xml-bandi-di-gara-plugin-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/avcp/wordpress-anac-xml-bandi-di-gara-plugin-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25985
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tomas | Docs | FAQ | Premium Support WordPress Tooltips.This issue affects WordPress Tooltips: from n/a through 8.2.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wordpress-tooltips/wordpress-wordpress-tooltips-plugin-8-2-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wordpress-tooltips/wordpress-wordpress-tooltips-plugin-8-2-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28780
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Yoast Yoast Local Premium.This issue affects Yoast Local Premium: from n/a through 14.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wpseo-local/wordpress-yoast-seo-local-plugin-14-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpseo-local/wordpress-yoast-seo-local-plugin-14-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-31075
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Arshid Easy Hide Login.This issue affects Easy Hide Login: from n/a through 1.0.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/easy-hide-login/wordpress-easy-hide-login-plugin-1-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-hide-login/wordpress-easy-hide-login-plugin-1-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-31089
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tradebooster Video XML Sitemap Generator.This issue affects Video XML Sitemap Generator: from n/a through 1.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/video-xml-sitemap-generator/wordpress-video-xml-sitemap-generator-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/video-xml-sitemap-generator/wordpress-video-xml-sitemap-generator-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-32245
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Essential Addons for Elementor Pro.This issue affects Essential Addons for Elementor Pro: from n/a through 5.4.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/essential-addons-elementor/wordpress-essential-addons-for-elementor-pro-plugin-5-4-8-unauthenticated-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/essential-addons-elementor/wordpress-essential-addons-for-elementor-pro-plugin-5-4-8-unauthenticated-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2023-32504
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.This issue affects Wise Chat: from n/a through 3.1.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wise-chat/wordpress-wise-chat-plugin-3-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wise-chat/wordpress-wise-chat-plugin-3-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-32514
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Himanshu Parashar Google Site Verification plugin using Meta Tag.This issue affects Google Site Verification plugin using Meta Tag: from n/a through 1.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/google-site-verification-using-meta-tag/wordpress-google-site-verification-plugin-using-meta-tag-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/google-site-verification-using-meta-tag/wordpress-google-site-verification-plugin-using-meta-tag-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-41129
Published: 2023-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/patreon-connect/wordpress-patreon-wordpress-plugin-1-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/patreon-connect/wordpress-patreon-wordpress-plugin-1-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-5341
Published: 2023-11-19
Description: A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/CVE-2023-5341; https://bugzilla.redhat.com/show_bug.cgi?id=2241774; https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1
CVE: CVE-2023-46700
Published: 2023-11-20
Description: SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://jvn.jp/en/jp/JVN15005948/; https://www.luxsoft.eu/; https://www.luxsoft.eu/?download
CVE: CVE-2023-47175
Published: 2023-11-20
Description: Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN15005948/; https://www.luxsoft.eu/; https://www.luxsoft.eu/?download
CVE: CVE-2023-3379
Published: 2023-11-20
Description: Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker  to change the passwords of other non-admin users and thus to escalate non-root privileges.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://cert.vde.com/en/advisories/VDE-2023-015/; https://cert.vde.com/en/advisories/VDE-2023-015/
CVE: CVE-2022-46337
Published: 2023-11-20
Description: A cleverly devised username might bypass LDAP authentication checks. In 
LDAP-authenticated Derby installations, this could let an attacker fill 
up the disk by creating junk Derby databases. In LDAP-authenticated 
Derby installations, this could also allow the attacker to execute 
malware which was visible to and executable by the account which booted 
the Derby server. In LDAP-protected databases which weren't also 
protected by SQL GRANT/REVOKE authorization, this vulnerability could 
also let an attacker view and corrupt sensitive data and run sensitive 
database functions and procedures.

Mitigation:

Users should upgrade to Java 21 and Derby 10.17.1.0.

Alternatively, users who wish to remain on older Java versions should 
build their own Derby distribution from one of the release families to 
which the fix was backported: 10.16, 10.15, and 10.14. Those are the 
releases which correspond, respectively, with Java LTS versions 17, 11, 
and 8.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://lists.apache.org/thread/q23kvvtoohgzwybxpwozmvvk17rp0td3; https://lists.apache.org/thread/q23kvvtoohgzwybxpwozmvvk17rp0td3
CVE: CVE-2023-46302
Published: 2023-11-20
Description: Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml  https://nvd.nist.gov/vuln/detail/CVE-2022-1471 .

Apache Submarine uses JAXRS to define REST endpoints.  In order to
handle YAML requests (using application/yaml content-type), it defines
a YamlEntityProvider entity provider that will process all incoming
YAML requests.  In order to unmarshal the request, the readFrom method
is invoked, passing the entityStream containing the user-supplied data in `submarine-server/server-core/src/main/java/org/apache/submarine/server/utils/YamlUtils.java`.
 
We have now fixed this issue in the new version by replacing to `jackson-dataformat-yaml`.
This issue affects Apache Submarine: from 0.7.0 before 0.8.0. Users are recommended to upgrade to version 0.8.0, which fixes this issue.
If using the version smaller than 0.8.0  and not want to upgrade, you can try cherry-pick PR  https://github.com/apache/submarine/pull/1054  and rebuild the submart-server image to fix this.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/apache/submarine/pull/1054; https://issues.apache.org/jira/browse/SUBMARINE-1371; https://lists.apache.org/thread/zf0wppzh239j4h131hm1dbswfnztxrr5
CVE: CVE-2023-3116
Published: 2023-11-20
Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through  incorrect default permissions.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276, CWE-276
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
CVE: CVE-2023-42774
Published: 2023-11-20
Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through  incorrect default permissions.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
CVE: CVE-2023-43612
Published: 2023-11-20
Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions.
CVSS Score: 8.4 (HIGH)
CWE: CWE-281, CWE-281
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
CVE: CVE-2023-46100
Published: 2023-11-20
Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
CVE: CVE-2023-46705
Published: 2023-11-20
Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
CVE: CVE-2023-47217
Published: 2023-11-20
Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md