deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1208
Published: 2024-02-05
Description: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/karlemilnikka/CVE-2024-1208-and-CVE-2024-1210; https://www.learndash.com/release-notes/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ae735117-e68b-448e-ad41-258d1be3aebc?source=cve
CVE: CVE-2024-1209
Published: 2024-02-05
Description: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attackers to obtain those uploads.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/karlemilnikka/CVE-2024-1209; https://www.learndash.com/release-notes/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7191955e-0db1-4ad1-878b-74f90ca59c91?source=cve
CVE: CVE-2024-1210
Published: 2024-02-05
Description: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it possible for unauthenticated attackers to obtain access to quizzes.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/karlemilnikka/CVE-2024-1208-and-CVE-2024-1210; https://www.learndash.com/release-notes/; https://www.wordfence.com/threat-intel/vulnerabilities/id/61ca5ab6-5fe9-4313-9b0d-8736663d0e89?source=cve
CVE: CVE-2024-24595
Published: 2024-02-05
Description: Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

CVSS Score: 6.0 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/; https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE: CVE-2024-0964
Published: 2024-02-05
Description: A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70; https://huntr.com/bounties/25e25501-5918-429c-8541-88832dfd3741; https://github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70
CVE: CVE-2024-23049
Published: 2024-02-05
Description: An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/88250/symphony/issues/82; https://github.com/88250/symphony/issues/82
CVE: CVE-2023-47354
Published: 2024-02-06
Description: An issue in the PowerOffWidgetReceiver function of Super Reboot (Root) Recovery v1.0.3 allows attackers to arbitrarily reset or power off the device via a crafted intent
CVSS Score: 7.8 (HIGH)
References: https://github.com/actuator/com.bdrm.superreboot/blob/main/CWE-925.md; https://play.google.com/store/apps/details?id=com.bdrm.superreboot; https://github.com/actuator/com.bdrm.superreboot/blob/main/CWE-925.md
CVE: CVE-2024-24398
Published: 2024-02-06
Description: Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://stimulsoft.com; https://cloud-trustit.spp.at/s/Pi78FFazHamJQ5R; https://cves.at/posts/cve-2024-24398/writeup/
CVE: CVE-2023-46359
Published: 2024-02-06
Description: An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://hardy.com; https://www.offensity.com/en/blog/os-command-injection-in-cph2-charging-station-200-cve-2023-46359-and-cve-2023-46360/; http://hardy.com
CVE: CVE-2023-46360
Published: 2024-02-06
Description: Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is vulnerable to Execution with Unnecessary Privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250
References: http://hardy.com; https://www.offensity.com/en/blog/os-command-injection-in-cph2-charging-station-200-cve-2023-46359-and-cve-2023-46360/; http://hardy.com
CVE: CVE-2023-47022
Published: 2024-02-06
Description: Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lead to CSV injection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-1236, CWE-639, CWE-1236
References: https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47022; https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47022
CVE: CVE-2023-47353
Published: 2024-02-06
Description: An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitrary files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494, CWE-494
References: https://github.com/actuator/imou/blob/main/com.dahua.imou.go-V1.0.11.md; https://play.google.com/store/apps/details?id=com.dahua.imou.go; https://github.com/actuator/imou/blob/main/com.dahua.imou.go-V1.0.11.md
CVE: CVE-2023-47889
Published: 2024-02-06
Description: The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. These exposed actions can allow any app on the device to send unauthorized broadcasts, leading to unintended consequences. The vulnerability is particularly concerning because these actions include powering off, system reboot & entering recovery mode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-927
References: https://github.com/actuator/com.bdrm.superreboot/blob/main/CWE-925.md; https://github.com/actuator/com.bdrm.superreboot/blob/main/CWE-925.md
CVE: CVE-2023-6229
Published: 2024-02-06
Description: Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://canon.jp/support/support-info/240205vulnerability-response; https://psirt.canon/advisory-information/cp2024-001/; https://www.canon-europe.com/support/product-security-latest-news/
CVE: CVE-2023-6230
Published: 2024-02-06
Description: Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://canon.jp/support/support-info/240205vulnerability-response; https://psirt.canon/advisory-information/cp2024-001/; https://www.canon-europe.com/support/product-security-latest-news/
CVE: CVE-2023-6231
Published: 2024-02-06
Description: Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://canon.jp/support/support-info/240205vulnerability-response; https://psirt.canon/advisory-information/cp2024-001/; https://www.canon-europe.com/support/product-security-latest-news/
CVE: CVE-2023-6232
Published: 2024-02-06
Description: Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://canon.jp/support/support-info/240205vulnerability-response; https://psirt.canon/advisory-information/cp2024-001/; https://www.canon-europe.com/support/product-security-latest-news/
CVE: CVE-2023-6233
Published: 2024-02-06
Description: Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://canon.jp/support/support-info/240205vulnerability-response; https://psirt.canon/advisory-information/cp2024-001/; https://www.canon-europe.com/support/product-security-latest-news/
CVE: CVE-2023-6234
Published: 2024-02-06
Description: Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://canon.jp/support/support-info/240205vulnerability-response; https://psirt.canon/advisory-information/cp2024-001/; https://www.canon-europe.com/support/product-security-latest-news/
CVE: CVE-2024-0244
Published: 2024-02-06
Description: Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS MF750C Series/Color imageCLASS X MF1333C firmware v03.07 and earlier sold in US. i-SENSYS MF754Cdw/C1333iF firmware v03.07 and earlier sold in Europe.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://canon.jp/support/support-info/240205vulnerability-response; https://psirt.canon/advisory-information/cp2024-001/; https://www.canon-europe.com/support/product-security-latest-news/
CVE: CVE-2024-22773
Published: 2024-02-06
Description: Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass.
CVSS Score: 8.1 (HIGH)
CWE: CWE-922, CWE-922
References: https://medium.com/%40wagneralves_87750/poc-cve-2024-22773-febf0d3a5433; https://www.intelbras.com/en/router-wi-fi-5-dual-band-ac-1200-action-rf-1200; https://www.intelbras.com/en/router-wi-fi-5-dual-band-ac-1200-with-giga-port-action-rg-1200
CVE: CVE-2024-24112
Published: 2024-02-06
Description: xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Exrick/xmall/issues/78; https://github.com/Exrick/xmall/issues/78
CVE: CVE-2024-22852
Published: 2024-02-06
Description: D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to enable telnet service via a specially crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Beckaf/vunl/blob/main/D-Link/AC750/1/1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/Beckaf/vunl/blob/main/D-Link/AC750/1/1.md
CVE: CVE-2024-22853
Published: 2024-02-06
Description: D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a telnet session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/Beckaf/vunl/blob/main/D-Link/AC750/2/2.md; https://www.dlink.com/en/security-bulletin/; https://github.com/Beckaf/vunl/blob/main/D-Link/AC750/2/2.md
CVE: CVE-2024-20810
Published: 2024-02-06
Description: Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to get sensitive information.
CVSS Score: 3.3 (LOW)
CWE: CWE-1021
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20811
Published: 2024-02-06
Description: Improper caller verification in GameOptimizer prior to SMR Feb-2024 Release 1 allows local attackers to configure GameOptimizer.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20812
Published: 2024-02-06
Description: Out-of-bounds Write in padmd_vld_htbl of libpadm.so prior to SMR Feb-2024 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20813
Published: 2024-02-06
Description: Out-of-bounds Write in padmd_vld_qtbl of libpadm.so prior to SMR Feb-2024 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20814
Published: 2024-02-06
Description: Out-of-bounds Read in padmd_vld_ac_prog_refine of libpadm.so prior to SMR Feb-2024 Release 1 allows local attackers access unauthorized information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20815
Published: 2024-02-06
Description: Improper authentication vulnerability in onCharacteristicReadRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to victim&#39;s mobile hotspot without user awareness.
CVSS Score: 8.0 (HIGH)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20816
Published: 2024-02-06
Description: Improper authentication vulnerability in onCharacteristicWriteRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to victim&#39;s mobile hotspot without user awareness.
CVSS Score: 8.0 (HIGH)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20817
Published: 2024-02-06
Description: Out-of-bounds Write vulnerabilities in svc1td_vld_slh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20818
Published: 2024-02-06
Description: Out-of-bounds Write vulnerabilities in svc1td_vld_elh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20819
Published: 2024-02-06
Description: Out-of-bounds Write vulnerabilities in svc1td_vld_plh_ap of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20820
Published: 2024-02-06
Description: Improper input validation in bootloader prior to SMR Feb-2024 Release 1 allows local privileged attackers to cause an Out-Of-Bounds read.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=02
CVE: CVE-2024-20822
Published: 2024-02-06
Description: Implicit intent hijacking vulnerability in AccountActivity of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02
CVE: CVE-2024-20823
Published: 2024-02-06
Description: Implicit intent hijacking vulnerability in SamsungAccount of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02
CVE: CVE-2024-20824
Published: 2024-02-06
Description: Implicit intent hijacking vulnerability in VoiceSearch of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02
CVE: CVE-2024-20825
Published: 2024-02-06
Description: Implicit intent hijacking vulnerability in IAP of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02
CVE: CVE-2024-20826
Published: 2024-02-06
Description: Implicit intent hijacking vulnerability in UPHelper library prior to version 4.0.0 allows local attackers to access sensitive information via implicit intent.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02
CVE: CVE-2024-20827
Published: 2024-02-06
Description: Improper access control vulnerability in Samsung Gallery prior to version 14.5.04.4 allows physical attackers to access the picture using physical keyboard on the lockscreen.
CVSS Score: 4.6 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02
CVE: CVE-2024-20828
Published: 2024-02-06
Description: Improper authorization verification vulnerability in Samsung Internet prior to version 24.0 allows physical attackers to access files downloaded in SecretMode without proper authentication.
CVSS Score: 2.4 (LOW)
CWE: CWE-863
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=02
CVE: CVE-2024-24808
Published: 2024-02-06
Description: pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redirecting users at login. This vulnerability has been patched with commit fe94451.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://github.com/pyload/pyload/commit/fe94451dcc2be90b3889e2fd9d07b483c8a6dccd; https://github.com/pyload/pyload/security/advisories/GHSA-g3cm-qg2v-2hj5; https://github.com/pyload/pyload/commit/fe94451dcc2be90b3889e2fd9d07b483c8a6dccd
CVE: CVE-2024-23304
Published: 2024-02-06
Description: Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-426, CWE-426
References: https://cs.cybozu.co.jp/2024/010691.html; https://jvn.jp/en/jp/JVN18743512/; https://cs.cybozu.co.jp/2024/010691.html
CVE: CVE-2023-33046
Published: 2024-02-06
Description: Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-367, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33049
Published: 2024-02-06
Description: Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33057
Published: 2024-02-06
Description: Transient DOS in Multi-Mode Call Processor while processing UE policy container.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33058
Published: 2024-02-06
Description: Information disclosure in Modem while processing SIB5.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin