deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3121
Published: 2023-06-06
Description: A vulnerability has been found in Dahua Smart Parking Management up to 20230528 and classified as problematic. This vulnerability affects unknown code of the file /ipms/imageConvert/image. The manipulation of the argument fileUrl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230800. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-918, CWE-918
References: https://github.com/RCEraser/cve/blob/main/DaHua..md; https://vuldb.com/?ctiid.230800; https://vuldb.com/?id.230800
CVE: CVE-2023-33381
Published: 2023-06-06
Description: A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0b7_2). The vulnerability allows an authenticated user to execute arbitrary OS commands by sending specially crafted input to the router via the ping function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: http://gpt-2741gnac.com; http://mitrastar.com; https://github.com/duality084/CVE-2023-33381-MitraStar-GPT-2741GNAC/blob/main/README.md
CVE: CVE-2023-33460
Published: 2023-06-06
Description: There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/lloyd/yajl/issues/250; https://lists.debian.org/debian-lts-announce/2023/07/msg00000.html; https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html
CVE: CVE-2023-33659
Published: 2023-06-06
Description: A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nmq_subinfo_decode() in the file mqtt_parser.c. An attacker could exploit this vulnerability to cause a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/emqx/nanomq; https://github.com/emqx/nanomq/issues/1154; https://github.com/nanomq/NanoNNG/pull/509/commits/6815c4036a2344865da393803ecdb7af27d8bde1
CVE: CVE-2023-20712
Published: 2023-06-06
Description: In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07796914; Issue ID: ALPS07796914.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20715
Published: 2023-06-06
Description: In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07796900; Issue ID: ALPS07796900.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20716
Published: 2023-06-06
Description: In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07796883; Issue ID: ALPS07796883.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20723
Published: 2023-06-06
Description: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07843845; Issue ID: ALPS07843845.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20724
Published: 2023-06-06
Description: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07843845; Issue ID: ALPS07843841.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20725
Published: 2023-06-06
Description: In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07734004 / ALPS07874358 (For MT6880, MT6890, MT6980, MT6990 only); Issue ID: ALPS07734004 / ALPS07874358 (For MT6880, MT6890, MT6980, MT6990 only).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20728
Published: 2023-06-06
Description: In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07573603; Issue ID: ALPS07573603.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20729
Published: 2023-06-06
Description: In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07573552; Issue ID: ALPS07573575.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20730
Published: 2023-06-06
Description: In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07573552; Issue ID: ALPS07573552.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20731
Published: 2023-06-06
Description: In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07573495; Issue ID: ALPS07573495.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20732
Published: 2023-06-06
Description: In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07573480; Issue ID: ALPS07573480.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20733
Published: 2023-06-06
Description: In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645149.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20734
Published: 2023-06-06
Description: In vcu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645184.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20735
Published: 2023-06-06
Description: In vcu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645178.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20736
Published: 2023-06-06
Description: In vcu, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645189.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-787, CWE-362, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20737
Published: 2023-06-06
Description: In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645167.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20738
Published: 2023-06-06
Description: In vcu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645173.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20739
Published: 2023-06-06
Description: In vcu, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07559819; Issue ID: ALPS07559819.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20740
Published: 2023-06-06
Description: In vcu, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07559819; Issue ID: ALPS07559840.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20741
Published: 2023-06-06
Description: In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628591; Issue ID: ALPS07628606.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20742
Published: 2023-06-06
Description: In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628591; Issue ID: ALPS07628540.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20743
Published: 2023-06-06
Description: In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Issue ID: ALPS07519142.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20744
Published: 2023-06-06
Description: In vcu, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Issue ID: ALPS07519200.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20745
Published: 2023-06-06
Description: In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Issue ID: ALPS07560694.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20746
Published: 2023-06-06
Description: In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Issue ID: ALPS07519217.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20747
Published: 2023-06-06
Description: In vcu, there is a possible memory corruption due to type confusion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519103; Issue ID: ALPS07519121.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20749
Published: 2023-06-06
Description: In swpm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07780926; Issue ID: ALPS07780926.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20750
Published: 2023-06-06
Description: In swpm, there is a possible out of bounds write due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07780926; Issue ID: ALPS07780928.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-362, CWE-787, CWE-362
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20751
Published: 2023-06-06
Description: In keymange, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07825502; Issue ID: ALPS07825502.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-20752
Published: 2023-06-06
Description: In keymange, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07826586; Issue ID: ALPS07826586.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2023; https://corp.mediatek.com/product-security-bulletin/June-2023
CVE: CVE-2023-33530
Published: 2023-06-06
Description: There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. If an attacker gains web management privileges, they can inject commands gaining shell privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://tenda.com; https://github.com/D2y6p/CVE/blob/main/tenda/CVE-2023-33530/RCE2/tenda_G103_RCE_2.pdf; http://tenda.com
CVE: CVE-2023-31569
Published: 2023-06-06
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://totolink.com; https://github.com/JeeseenSec/Report/tree/main/TOTOLINK%2CThanks; https://github.com/JeeseenSec/Report/tree/main/TOTOLINK/CVE-2023-31569
CVE: CVE-2023-33457
Published: 2023-06-06
Description: In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/sogou/workflow/issues/1272; https://github.com/sogou/workflow/issues/1272
CVE: CVE-2023-33532
Published: 2023-06-06
Description: There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters, thereby gaining shell privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://netgear.com; https://github.com/D2y6p/CVE/blob/main/Netgear/CVE-2023-33532/Netgear_R6250_RCE.pdf; http://netgear.com
CVE: CVE-2023-33533
Published: 2023-06-06
Description: Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with Firmware Version 1.0.2.26 are vulnerable to Command Injection. If an attacker gains web management privileges, they can inject commands into the post request parameters, gaining shell privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://github.com/D2y6p/CVE/blob/main/Netgear/CVE-2023-33533/Netgear_RCE.pdf; https://www.netgear.com/about/security/; https://github.com/D2y6p/CVE/blob/main/Netgear/CVE-2023-33533/Netgear_RCE.pdf
CVE: CVE-2023-3123
Published: 2023-06-06
Description: Rejected reason: Duplicate Assignment.
CVE: CVE-2023-30948
Published: 2023-06-06
Description: A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbitrary comments to discover it's content.

This defect was fixed in Foundry Comments 2.249.0, and a patch was rolled out to affected Foundry environments. No further intervention is required at this time.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285, CWE-862
References: https://palantir.safebase.us/?tcuUid=101b083b-6389-4261-98f8-23448e133a62; https://palantir.safebase.us/?tcuUid=101b083b-6389-4261-98f8-23448e133a62
CVE: CVE-2023-32545
Published: 2023-06-06
Description: 












The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to an out-of-bounds read in Cscape!CANPortMigration. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. 

 



 








CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04; https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04
CVE: CVE-2023-32281
Published: 2023-06-06
Description: 








The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to an out-of-bounds read in the FontManager. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.

 








CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04; https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04
CVE: CVE-2023-32289
Published: 2023-06-06
Description: 










The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP). This could lead to an out-of-bounds read in IO_CFG. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. 



 








CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04; https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04
CVE: CVE-2023-32539
Published: 2023-06-06
Description: Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e3c04. An attacker could leverage this vulnerability to potentially execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04; https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04
CVE: CVE-2023-32549
Published: 2023-06-06
Description: Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-338, CWE-338
References: https://bugs.launchpad.net/landscape/+bug/1929034; https://bugs.launchpad.net/landscape/+bug/1929034
CVE: CVE-2023-32550
Published: 2023-06-06
Description: Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-497, CWE-668
References: https://bugs.launchpad.net/landscape/+bug/1929037; https://bugs.launchpad.net/landscape/+bug/1929037
CVE: CVE-2023-32551
Published: 2023-06-06
Description: Landscape allowed URLs which caused open redirection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://bugs.launchpad.net/landscape/+bug/1929620; https://bugs.launchpad.net/landscape/+bug/1929620
CVE: CVE-2023-0921
Published: 2023-06-06
Description: A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0921.json; https://gitlab.com/gitlab-org/gitlab/-/issues/392433; https://hackerone.com/reports/1869839