deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-31842
Published: 2023-05-15
Description: Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/index.php?page=edit_faculty&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/acmglz/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-2.md; https://github.com/acmglz/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-2.md
CVE: CVE-2023-31843
Published: 2023-05-15
Description: Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/view_faculty.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/acmglz/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-1.md; https://github.com/acmglz/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-1.md
CVE: CVE-2023-31844
Published: 2023-05-15
Description: Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_subject.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/acmglz/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-3.md; https://github.com/acmglz/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-3.md
CVE: CVE-2023-31845
Published: 2023-05-15
Description: Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_class.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/acmglz/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-4.md; https://github.com/acmglz/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-4.md
CVE: CVE-2023-29861
Published: 2023-05-15
Description: An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Duke1410/CVE/blob/main/CVE-2023-29861; https://woolly-espadrille-ed5.notion.site/The-FLIR-DVTEL-camera-device-has-a-logic-flaw-vulnerability-363a2158e372440b80a2be739271c6f3; https://github.com/Duke1410/CVE/blob/main/CVE-2023-29861
CVE: CVE-2023-31607
Published: 2023-05-15
Description: An issue in the __libc_malloc component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1120; https://github.com/openlink/virtuoso-opensource/issues/1120
CVE: CVE-2023-31608
Published: 2023-05-15
Description: An issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1123; https://github.com/openlink/virtuoso-opensource/issues/1123
CVE: CVE-2023-31609
Published: 2023-05-15
Description: An issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1126; https://github.com/openlink/virtuoso-opensource/issues/1126
CVE: CVE-2023-31610
Published: 2023-05-15
Description: An issue in the _IO_default_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1118; https://github.com/openlink/virtuoso-opensource/issues/1118
CVE: CVE-2023-31611
Published: 2023-05-15
Description: An issue in the __libc_longjmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1119; https://github.com/openlink/virtuoso-opensource/issues/1119
CVE: CVE-2023-31612
Published: 2023-05-15
Description: An issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1125; https://github.com/openlink/virtuoso-opensource/issues/1125
CVE: CVE-2023-31613
Published: 2023-05-15
Description: An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1121; https://github.com/openlink/virtuoso-opensource/issues/1121
CVE: CVE-2023-31614
Published: 2023-05-15
Description: An issue in the mp_box_deserialize_string function in openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1117; https://github.com/openlink/virtuoso-opensource/issues/1117
CVE: CVE-2023-31615
Published: 2023-05-15
Description: An issue in the chash_array component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1124; https://github.com/openlink/virtuoso-opensource/issues/1124
CVE: CVE-2023-31616
Published: 2023-05-15
Description: An issue in the bif_mod component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1122; https://github.com/openlink/virtuoso-opensource/issues/1122
CVE: CVE-2023-31617
Published: 2023-05-15
Description: An issue in the dk_set_delete component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1127; https://github.com/openlink/virtuoso-opensource/issues/1127
CVE: CVE-2023-31618
Published: 2023-05-15
Description: An issue in the sqlc_union_dt_wrap component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1136; https://github.com/openlink/virtuoso-opensource/issues/1136
CVE: CVE-2023-31619
Published: 2023-05-15
Description: An issue in the sch_name_to_object component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1133; https://github.com/openlink/virtuoso-opensource/issues/1133
CVE: CVE-2023-31620
Published: 2023-05-15
Description: An issue in the dv_compare component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1128; https://github.com/openlink/virtuoso-opensource/issues/1128
CVE: CVE-2023-31621
Published: 2023-05-15
Description: An issue in the kc_var_col component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1130; https://github.com/openlink/virtuoso-opensource/issues/1130
CVE: CVE-2023-31622
Published: 2023-05-15
Description: An issue in the sqlc_make_policy_trig component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1135; https://github.com/openlink/virtuoso-opensource/issues/1135
CVE: CVE-2023-31623
Published: 2023-05-15
Description: An issue in the mp_box_copy component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1131; https://github.com/openlink/virtuoso-opensource/issues/1131
CVE: CVE-2023-31624
Published: 2023-05-15
Description: An issue in the sinv_check_exp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1134; https://github.com/openlink/virtuoso-opensource/issues/1134
CVE: CVE-2023-31625
Published: 2023-05-15
Description: An issue in the psiginfo component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1132; https://github.com/openlink/virtuoso-opensource/issues/1132
CVE: CVE-2023-31626
Published: 2023-05-15
Description: An issue in the gpf_notice component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1129; https://github.com/openlink/virtuoso-opensource/issues/1129
CVE: CVE-2023-31627
Published: 2023-05-15
Description: An issue in the strhash component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1140; https://github.com/openlink/virtuoso-opensource/issues/1140
CVE: CVE-2023-31628
Published: 2023-05-15
Description: An issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1141; https://github.com/openlink/virtuoso-opensource/issues/1141
CVE: CVE-2023-31629
Published: 2023-05-15
Description: An issue in the sqlo_union_scope component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1139; https://github.com/openlink/virtuoso-opensource/issues/1139
CVE: CVE-2023-31630
Published: 2023-05-15
Description: An issue in the sqlo_query_spec component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1138; https://github.com/openlink/virtuoso-opensource/issues/1138
CVE: CVE-2023-31631
Published: 2023-05-15
Description: An issue in the sqlo_preds_contradiction component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1137; https://github.com/openlink/virtuoso-opensource/issues/1137
CVE: CVE-2023-32787
Published: 2023-05-15
Description: The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-32787.pdf; https://github.com/OPCFoundation/UA-Java-Legacy; https://github.com/OPCFoundation/UA-Java-Legacy/commit/6f176f2b445a27c157f1a32f225accc9ce8873c0
CVE: CVE-2023-30245
Published: 2023-05-15
Description: SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id parameter of the edit_criteria.php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/qingning988/cve_report/blob/main/judging-management-system/SQLi-1.md; https://www.github.com; https://github.com/qingning988/cve_report/blob/main/judging-management-system/SQLi-1.md
CVE: CVE-2023-32313
Published: 2023-05-15
Description: vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550; https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238; https://github.com/patriksimek/vm2/releases/tag/3.9.18
CVE: CVE-2023-32314
Published: 2023-05-15
Description: vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac; https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf; https://github.com/patriksimek/vm2/releases/tag/3.9.18
CVE: CVE-2023-31145
Published: 2023-05-15
Description: Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account takeover attack. The vulnerability allows attackers to inject malicious code into web pages, which can be executed in the context of the victim's browser session. This means that an attacker can steal sensitive data, such as login credentials or personal information, or perform unauthorized actions on behalf of the victim, such as modifying or deleting data. In this specific case, the vulnerability allows for a trivial account takeover attack. An attacker can exploit the vulnerability to inject code into the victim's browser session, allowing the attacker to take over the victim's account without their knowledge or consent. This can lead to unauthorized access to sensitive information and data, as well as the ability to perform actions on behalf of the victim. Furthermore, the fact that the vulnerability bypasses the Content Security Policy (CSP) makes it more dangerous, as CSP is an important security mechanism used to prevent cross-site scripting attacks. By bypassing CSP, attackers can circumvent the security measures put in place by the web application and execute their malicious code. This issue has been patched in versions 22.05.13, 21.11.9, and 6.4.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/CollaboraOnline/online/security/advisories/GHSA-rqj2-2c2x-gjmm; https://github.com/CollaboraOnline/online/security/advisories/GHSA-rqj2-2c2x-gjmm
CVE: CVE-2023-32068
Published: 2023-05-15
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect.  The issue has now been patched against all patterns that are known for performing redirects. This issue has been patched in XWiki 14.10.4 and 15.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6gvj-8vc5-8v3j; https://jira.xwiki.org/browse/XWIKI-20096
CVE: CVE-2023-32308
Published: 2023-05-15
Description: anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database. This issue has been fixed in version 1.22.11.5781. Users are advised to upgrade. Users unable to upgrade may insert an additional check for errors in a condition before calling `ttGroupHelper::getActiveInvoices()` in invoices.php.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://github.com/anuko/timetracker/commit/8a7367d7f77ea697c090f5ca4e19669181cc7bcf; https://github.com/anuko/timetracker/security/advisories/GHSA-9g2c-7c7g-p58r; https://github.com/anuko/timetracker/commit/8a7367d7f77ea697c090f5ca4e19669181cc7bcf
CVE: CVE-2023-32309
Published: 2023-05-15
Description: PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to render the content of a file outside the specified base paths: `--8<-- "../../../../etc/passwd"`. Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to Directory Traversal. The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in snippets.py. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. It is never recommended to use Snippets to process user-facing, dynamic content. It is designed to process known content on the backend under the control of the host, but if someone were to accidentally enable it for user-facing content, undesired information could be exposed. This issue has been addressed in version 10.0. Users are advised to upgrade. Users unable to upgrade may restrict relative paths by filtering input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/facelessuser/pymdown-extensions/commit/b7bb4878d6017c03c8dc97c42d8d3bb6ee81db9d; https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-jh85-wwv9-24hv; https://github.com/facelessuser/pymdown-extensions/commit/b7bb4878d6017c03c8dc97c42d8d3bb6ee81db9d
CVE: CVE-2021-0877
Published: 2023-05-15
Description: Product: AndroidVersions: Android SoCAndroid ID: A-273754094
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2023-05-01; https://source.android.com/security/bulletin/2023-05-01
CVE: CVE-2023-1729
Published: 2023-05-15
Description: A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2188240; https://github.com/LibRaw/LibRaw/issues/557; https://lists.debian.org/debian-lts-announce/2023/05/msg00025.html
CVE: CVE-2023-20673
Published: 2023-05-15
Description: In vcu, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519103; Issue ID: ALPS07519103.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/May-2023; https://corp.mediatek.com/product-security-bulletin/May-2023
CVE: CVE-2023-20694
Published: 2023-05-15
Description: In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07733998 / ALPS07874388 (For MT6880 and MT6890 only); Issue ID: ALPS07733998 / ALPS07874388 (For MT6880 and MT6890 only).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2023; https://corp.mediatek.com/product-security-bulletin/May-2023
CVE: CVE-2023-20695
Published: 2023-05-15
Description: In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07734012 / ALPS07874363 (For MT6880, MT6890, MT6980 and MT6990 only); Issue ID: ALPS07734012 / ALPS07874363 (For MT6880, MT6890, MT6980 and MT6990 only).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2023; https://corp.mediatek.com/product-security-bulletin/May-2023
CVE: CVE-2023-20696
Published: 2023-05-15
Description: In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07856356 / ALPS07874388 (For MT6880 and MT6890 only); Issue ID: ALPS07856356 / ALPS07874388 (For MT6880 and MT6890 only).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2023; https://corp.mediatek.com/product-security-bulletin/May-2023
CVE: CVE-2023-20697
Published: 2023-05-15
Description: In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07589148; Issue ID: ALPS07589148.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/May-2023; https://corp.mediatek.com/product-security-bulletin/May-2023
CVE: CVE-2023-20698
Published: 2023-05-15
Description: In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07589144; Issue ID: ALPS07589144.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/May-2023; https://corp.mediatek.com/product-security-bulletin/May-2023