deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-20194
Published: 2023-09-07
Description: A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulnerability is due to improper privilege management in the ERS API. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to elevate their privileges beyond the sphere of their intended access level, which would allow them to obtain sensitive information from the underlying operating system. Note: The ERS is not enabled by default. To verify the status of the ERS API in the Admin GUI, choose Administration > Settings > API Settings > API Service Settings.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-268, CWE-269
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-KJLp2Aw; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-KJLp2Aw
CVE: CVE-2023-41316
Published: 2023-09-07
Description: Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitation emails which appear as legitimate org invitations. Bad actors may direct users to malicious website or execute javascript in the context of the users browser. This vulnerability has been addressed in version 3.29.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://github.com/tolgee/tolgee-platform/commit/bab718b1c9b3e90327bfb10d27b9799996e5c35b; https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-gx3w-rwh5-w5cg; https://github.com/tolgee/tolgee-platform/commit/bab718b1c9b3e90327bfb10d27b9799996e5c35b
CVE: CVE-2023-30908
Published: 2023-09-07
Description: A remote authentication bypass issue exists in a OneView API.


CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04530en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04530en_us
CVE: CVE-2023-41161
Published: 2023-09-07
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41161; https://webmin.com/tags/webmin-changelog/; https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41161
CVE: CVE-2023-41646
Published: 2023-09-07
Description: Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-916
References: https://buttercup.pw/; https://github.com/tristao-marinho/CVE-2023-41646/; https://buttercup.pw/
CVE: CVE-2023-40029
Published: 2023-09-07
Description: Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pull request #7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the `kubectl.kubernetes.io/last-applied-configuration` annotation which includes full secret body. In order to view the cluster annotations via the Argo CD API, the user must have `clusters, get` RBAC access. **Note:** In many cases, cluster secrets do not contain any actually-secret information. But sometimes, as in bearer-token auth, the contents might be very sensitive. The bug has been patched in versions 2.8.3, 2.7.14, and 2.6.15. Users are advised to upgrade. Users unable to upgrade should update/deploy cluster secret with `server-side-apply` flag which does not use or rely on `kubectl.kubernetes.io/last-applied-configuration` annotation. Note: annotation for existing secrets will require manual removal.


CVSS Score: 9.9 (CRITICAL)
CWE: CWE-200, CWE-532
References: https://github.com/argoproj/argo-cd/commit/4b2e5b06bff2ffd8ed1970654ddd8e55fc4a41c4; https://github.com/argoproj/argo-cd/pull/7139; https://github.com/argoproj/argo-cd/security/advisories/GHSA-fwr2-64vr-xv9m
CVE: CVE-2023-40584
Published: 2023-09-07
Description: Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz archive in a way that prevents the deletion of its inner files when the manifest generation process is completed. A patch for this vulnerability has been released in versions 2.6.15, 2.7.14, and 2.8.3. Users are advised to upgrade. The only way to completely resolve the issue is to upgrade, however users unable to upgrade should configure RBAC (Role-Based Access Control) and provide access for configuring applications only to a limited number of administrators. These administrators should utilize trusted and verified Helm charts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/argoproj/argo-cd/commit/b8f92c4ff226346624f43de3f25d81dac6386674; https://github.com/argoproj/argo-cd/security/advisories/GHSA-g687-f2gx-6wm8; https://github.com/argoproj/argo-cd/commit/b8f92c4ff226346624f43de3f25d81dac6386674
CVE: CVE-2021-33834
Published: 2023-09-08
Description: An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2021004; https://www.insyde.com/security-pledge
CVE: CVE-2021-45811
Published: 2023-09-08
Description: A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://enhancesoft.com; http://osticket.com; https://members.backbox.org/osticket-sql-injection/
CVE: CVE-2022-27599
Published: 2023-09-08
Description: An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possibly provides local authenticated administrators with an additional, less-protected path to acquiring the information via unspecified vectors.

We have already fixed the vulnerability in the following version:
Windows 10 SP1, Windows 11, Mac OS, and Mac M1: QVR Pro Client 2.3.0.0420 and later

CVSS Score: 6.7 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.qnap.com/en/security-advisory/qsa-23-08; https://www.qnap.com/en/security-advisory/qsa-23-08
CVE: CVE-2023-36184
Published: 2023-09-08
Description: CMysten Labs Sui blockchain v1.2.0 was discovered to contain a stack overflow via the component /spec/openrpc.json.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/MystenLabs/sui/commit/8b681515c0cf435df2a54198a28ab4ef574d202b; https://github.com/aptos-labs/aptos-core/commit/47a0391c612407fe0b1051ef658a29e35d986963; https://github.com/move-language/move/issues/1059
CVE: CVE-2023-40271
Published: 2023-09-08
Description: In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the Authenticated Encryption with Associated Data Chacha20-Poly1305 algorithm is used, with the single-part verification function (defined during the build-time configuration phase) implemented with a dedicated function (i.e., not relying on usage of multipart functions), the buffer comparison during the verification of the authentication tag does not happen on the full 16 bytes but just on the first 4 bytes, thus leading to the possibility that unauthenticated payloads might be identified as authentic. This affects TF-Mv1.6.0, TF-Mv1.6.1, TF-Mv1.7.0, and TF-Mv1.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/docs/security/security_advisories/cc3xx_partial_tag_compare_on_chacha20_poly1305.rst; https://tf-m-user-guide.trustedfirmware.org/releases/index.html; https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/docs/security/security_advisories/cc3xx_partial_tag_compare_on_chacha20_poly1305.rst
CVE: CVE-2014-5329
Published: 2023-09-08
Description: GIGAPOD file servers (Appliance model and Software model) provide two web interfaces, 80/tcp and 443/tcp for user operation, and 8001/tcp for administrative operation.
8001/tcp is served by a version of Apache HTTP server containing a flaw in handling HTTP requests (CVE-2011-3192), which may lead to a denial-of-service (DoS) condition.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/en/jp/JVN23809730/; https://jvn.jp/en/jp/JVN23809730/
CVE: CVE-2021-27715
Published: 2023-09-08
Description: An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitrary code via crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://mofi.com; https://www.nagarro.com/services/security/mofi-cve-security-advisory; http://mofi.com
CVE: CVE-2023-37367
Published: 2023-09-08
Description: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. In the NAS Task, an improperly implemented security check for standard can disallow desired services for a while via consecutive NAS messages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-37368
Published: 2023-09-08
Description: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos Mobile Processor, Automotive Processor, and Modem - Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123). In the Shannon MM Task, Missing validation of a NULL pointer can cause abnormal termination via a malformed NR MM packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-37377
Published: 2023-09-08
Description: An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor (Exynos 980, Exynos 850, Exynos 2100, and Exynos W920). Improper handling of length parameter inconsistency can cause incorrect packet filtering.
CVSS Score: 2.0 (LOW)
CWE: CWE-125
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-37759
Published: 2023-09-08
Description: Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://codecanyon.net/item/crypto-currency-tracker-prices-charts-news-icos-info-and-more/21588008; https://packetstormsecurity.com/files/174240/Crypto-Currency-Tracker-CCT-9.5-Add-Administrator.html; https://tregix.com/
CVE: CVE-2023-39620
Published: 2023-09-08
Description: An Issue in Buffalo America, Inc. TeraStation NAS TS5410R v.5.00 thru v.0.07 allows a remote attacker to obtain sensitive information via the guest account function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/bcross520/bcross520.github.io/wiki/Buffalo-Terastation-NAS-Disabled-guest-built%E2%80%90in-account-allows-for-SMB%5CRPC-device-enumeration.; https://github.com/bcross520/bcross520.github.io/wiki/Buffalo-Terastation-NAS-Disabled-guest-built%E2%80%90in-account-allows-for-SMB%5CRPC-device-enumeration; https://github.com/bcross520/bcross520.github.io/wiki/Buffalo-Terastation-NAS-Disabled-guest-built%E2%80%90in-account-allows-for-SMB%5CRPC-device-enumeration.
CVE: CVE-2023-40353
Published: 2023-09-08
Description: An issue was discovered in Exynos Mobile Processor 980 and 2100. An integer overflow at a buffer index can prevent the execution of requested services via a crafted application.
CVSS Score: 2.0 (LOW)
CWE: CWE-190
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-40953
Published: 2023-09-08
Description: icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/ChubbyZ/e1e5c1858c389334dcf581a19c741308; https://www.icmsdev.com/; https://gist.github.com/ChubbyZ/e1e5c1858c389334dcf581a19c741308
CVE: CVE-2023-41594
Published: 2023-09-08
Description: Dairy Farm Shop Management System Using PHP and MySQL v1.1 was discovered to contain multiple SQL injection vulnerabilities in the Login function via the Username and Password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/MATRIXDEVIL/CVE/blob/main/CVE-2023-41594; https://portswigger.net/web-security/sql-injection; https://www.acunetix.com/vulnerabilities/web/sql-injection/
CVE: CVE-2023-41615
Published: 2023-09-08
Description: Zoo Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the Admin sign-in page via the username and password fields.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://medium.com/%40guravtushar231/sql-injection-in-login-field-a9073780f7e8; https://phpgurukul.com/student-management-system-using-php-and-mysql/; https://portswigger.net/web-security/sql-injection
CVE: CVE-2023-32470
Published: 2023-09-08
Description: 
Dell Digital Delivery versions prior to 5.0.82.0 contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious user could potentially exploit this vulnerability to create arbitrary folder leading to permanent Denial of Service (DOS).


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-1386
References: https://www.dell.com/support/kbdoc/en-us/000216243/dsa-2023-224; https://www.dell.com/support/kbdoc/en-us/000216243/dsa-2023-224
CVE: CVE-2023-34041
Published: 2023-09-08
Description: Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations.

CVSS Score: 5.3 (MEDIUM)
References: https://www.cloudfoundry.org/blog/abuse-of-http-hop-by-hop-headers-in-cloud-foundry-gorouter/; https://www.cloudfoundry.org/blog/abuse-of-http-hop-by-hop-headers-in-cloud-foundry-gorouter/
CVE: CVE-2023-41775
Published: 2023-09-08
Description: Improper access control vulnerability in 'direct' Desktop App for macOS ver 2.6.0 and earlier allows a local attacker to bypass access restriction and to use camrea, microphone, etc. of the device where the product is installed without the user's consent.
CVSS Score: 5.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN42691027/; https://status.direct4b.com/2023/08/31/[PII_REDACTED]/; https://jvn.jp/en/jp/JVN42691027/
CVE: CVE-2023-4777
Published: 2023-09-08
Description: 
An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins and to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. 


CVSS Score: 3.1 (LOW)
CWE: CWE-732, CWE-732
References: https://www.qualys.com/security-advisories/; https://www.qualys.com/security-advisories/
CVE: CVE-2023-4807
Published: 2023-09-08
Description: Issue summary: The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications on the
Windows 64 platform when running on newer X86_64 processors supporting the
AVX512-IFMA instructions.

Impact summary: If in an application that uses the OpenSSL library an attacker
can influence whether the POLY1305 MAC algorithm is used, the application
state might be corrupted with various application dependent consequences.

The POLY1305 MAC (message authentication code) implementation in OpenSSL does
not save the contents of non-volatile XMM registers on Windows 64 platform
when calculating the MAC of data larger than 64 bytes. Before returning to
the caller all the XMM registers are set to zero rather than restoring their
previous content. The vulnerable code is used only on newer x86_64 processors
supporting the AVX512-IFMA instructions.

The consequences of this kind of internal application state corruption can
be various - from no consequences, if the calling application does not
depend on the contents of non-volatile XMM registers at all, to the worst
consequences, where the attacker could get complete control of the application
process. However given the contents of the registers are just zeroized so
the attacker cannot put arbitrary values inside, the most likely consequence,
if any, would be an incorrect result of some application dependent
calculations or a crash leading to a denial of service.

The POLY1305 MAC algorithm is most frequently used as part of the
CHACHA20-POLY1305 AEAD (authenticated encryption with associated data)
algorithm. The most common usage of this AEAD cipher is with TLS protocol
versions 1.2 and 1.3 and a malicious client can influence whether this AEAD
cipher is used by the server. This implies that server applications using
OpenSSL can be potentially impacted. However we are currently not aware of
any concrete application that would be affected by this issue therefore we
consider this a Low severity security issue.

As a workaround the AVX512-IFMA instructions support can be disabled at
runtime by setting the environment variable OPENSSL_ia32cap:

   OPENSSL_ia32cap=:~0x200000

The FIPS provider is not affected by this issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-440
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff
CVE: CVE-2023-39076
Published: 2023-09-08
Description: Injecting random data into the USB memory area on a General Motors (GM) Chevrolet Equinox 2021 Software. 2021.03.26 (build version) vehicle causes a Denial of Service (DoS) in the in-car infotainment system.
CVSS Score: 4.6 (MEDIUM)
References: https://blog.dhjeong.kr/posts/vuln/202307/gm-chevrolet/; https://blog.jhyeon.dev/posts/vuln/202307/gm-chevrolet/; https://nvd.nist.gov/vuln/detail/CVE-2023-39076
CVE: CVE-2023-39584
Published: 2023-09-08
Description: Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/hexojs/hexo/blob/a3e68e7576d279db22bd[PII_REDACTED]104e867834/lib/plugins/tag/include_code.js#L49; https://github.com/hexojs/hexo/issues/5250; https://www.gem-love.com/2023/07/25/hexo%E5%8D%9A%E5%AE%A2%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E5%92%8C%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/#undefined
CVE: CVE-2023-40924
Published: 2023-09-08
Description: SolarView Compact < 6.00 is vulnerable to Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/Yobing1/CVE-2023-40924/blob/main/README.md; https://nvd.nist.gov/vuln/detail/CVE-2023-33620; https://github.com/Yobing1/CVE-2023-40924/blob/main/README.md
CVE: CVE-2023-39676
Published: 2023-09-08
Description: FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sorcery.ie/posts/fieldpopupnewsletter_xss/; https://sorcery.ie; https://themeforest.net/user/fieldthemes
CVE: CVE-2023-39318
Published: 2023-09-08
Description: The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://go.dev/cl/526156; https://go.dev/issue/62196; https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
CVE: CVE-2023-39319
Published: 2023-09-08
Description: The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://go.dev/cl/526157; https://go.dev/issue/62197; https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
CVE: CVE-2023-39320
Published: 2023-09-08
Description: The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://go.dev/cl/526158; https://go.dev/issue/62198; https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
CVE: CVE-2023-39321
Published: 2023-09-08
Description: Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://go.dev/cl/523039; https://go.dev/issue/62266; https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ