deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-37206
Published: 2023-07-05
Description: Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. This vulnerability affects Firefox < 115.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1813299; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-22/
CVE: CVE-2023-37209
Published: 2023-07-05
Description: A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that object remained.  This resulted in a potentially exploitable condition when the reference to that object was later reused. This vulnerability affects Firefox < 115.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1837993; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-22/
CVE: CVE-2023-37210
Published: 2023-07-05
Description: A website could prevent a user from exiting full-screen mode via alert and prompt calls.  This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1821886; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-22/
CVE: CVE-2023-37211
Published: 2023-07-05
Description: Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1832306%2C1834862%2C1835886%2C1836550%2C1837450; https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html; https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html
CVE: CVE-2023-37212
Published: 2023-07-05
Description: Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1750870%2C1825552%2C1826206%2C1827076%2C1828690%2C1833503%2C1835710%2C1838587; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-22/
CVE: CVE-2023-3336
Published: 2023-07-05
Description: TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enable a brute force attack with valid users.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230401-tn-5900-series-user-enumeration-vulnerability; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230401-tn-5900-series-user-enumeration-vulnerability
CVE: CVE-2023-3482
Published: 2023-07-05
Description: When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites storing tracking data without permission. This vulnerability affects Firefox < 115.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1839464; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-22/
CVE: CVE-2021-46890
Published: 2023-07-05
Description: Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2023/7/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/7/
CVE: CVE-2021-46891
Published: 2023-07-05
Description: Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2023/7/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/7/
CVE: CVE-2021-46893
Published: 2023-07-05
Description: Vulnerability of unstrict data verification and parameter check. Successful exploitation of this vulnerability may affect integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://consumer.huawei.com/en/support/bulletin/2023/7/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/7/
CVE: CVE-2023-2538
Published: 2023-07-05
Description: A CWE-552 "Files or Directories Accessible to External Parties” in the web interface of the Tyan S5552 BMC version 3.00 allows an unauthenticated remote attacker to retrieve the private key of the TLS certificate in use by the BMC via forced browsing. This can then be abused to perform Man-in-the-Middle (MitM) attacks against victims that access the web interface through HTTPS.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-2538/; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-2538/
CVE: CVE-2023-3089
Published: 2023-07-05
Description: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
CVSS Score: 7.0 (HIGH)
CWE: CWE-693, CWE-521
References: https://access.redhat.com/security/cve/CVE-2023-3089; https://bugzilla.redhat.com/show_bug.cgi?id=2212085; https://access.redhat.com/security/cve/CVE-2023-3089
CVE: CVE-2023-3455
Published: 2023-07-05
Description: Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200, CWE-668
References: https://consumer.huawei.com/en/support/bulletin/2023/7/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/7/
CVE: CVE-2023-36665
Published: 2023-07-05
Description: "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/protobufjs/protobuf.js/commit/e66379f451b0393c27d87b37fa7d271619e16b0d; https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.3...protobufjs-v7.2.4; https://github.com/protobufjs/protobuf.js/pull/1899
CVE: CVE-2023-35971
Published: 2023-07-05
Description: A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE: CVE-2023-35972
Published: 2023-07-05
Description: An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE: CVE-2023-35973
Published: 2023-07-05
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE: CVE-2023-35974
Published: 2023-07-05
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE: CVE-2023-35975
Published: 2023-07-05
Description: An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE: CVE-2023-35976
Published: 2023-07-05
Description: Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level.
CVSS Score: 6.5 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE: CVE-2023-35977
Published: 2023-07-05
Description: Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level.
CVSS Score: 6.5 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE: CVE-2023-35978
Published: 2023-07-05
Description: A vulnerability in ArubaOS could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE: CVE-2023-35979
Published: 2023-07-05
Description: There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in a Denial-of-Service (DoS) condition affecting the web-based management interface of the controller.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE: CVE-2023-3515
Published: 2023-07-05
Description: Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/go-gitea/gitea/commit/9aaaf980f0ba15611f30568bd67bce3ec12954e2; https://huntr.dev/bounties/e335cd18-bc4d-4585-adb7-426c817ed053; https://security.gentoo.org/glsa/202312-13
CVE: CVE-2023-27390
Published: 2023-07-05
Description: A heap-based buffer overflow vulnerability exists in the Sequence::DrawText functionality of Diagon v1.0.139. A specially crafted markdown file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1744; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1744; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1744
CVE: CVE-2023-31194
Published: 2023-07-05
Description: An improper array index validation vulnerability exists in the GraphPlanar::Write functionality of Diagon v1.0.139. A specially crafted markdown file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-129
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1745; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1745; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1745
CVE: CVE-2023-36932
Published: 2023-07-05
Description: In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023; https://www.progress.com/moveit; https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023
CVE: CVE-2023-36933
Published: 2023-07-05
Description: In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023; https://www.progress.com/moveit; https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023
CVE: CVE-2023-36934
Published: 2023-07-05
Description: In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023; https://www.progress.com/moveit; https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023
CVE: CVE-2020-25969
Published: 2023-07-05
Description: gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://sourceforge.net/p/gnuplot/bugs/2311/; https://sourceforge.net/p/gnuplot/bugs/2311/
CVE: CVE-2023-25399
Published: 2023-07-05
Description: A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: http://www.square16.org/achievement/cve-2023-25399/; https://github.com/scipy/scipy/issues/16235; https://github.com/scipy/scipy/issues/16235#issuecomment[PII_REDACTED]
CVE: CVE-2020-23452
Published: 2023-07-05
Description: A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hub parameter under the /grid/console page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/SeleniumHQ/selenium/issues/8259; https://github.com/SeleniumHQ/selenium/issues/8259
CVE: CVE-2023-30607
Published: 2023-07-05
Description: icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-352
References: https://github.com/Icinga/icingaweb2-module-jira/commit/7f0c53b7a3e87be2f4c2e8840805d7b7c9762424; https://github.com/Icinga/icingaweb2-module-jira/releases/tag/v1.3.2; https://github.com/Icinga/icingaweb2-module-jira/security/advisories/GHSA-gh7w-7f7j-gwp5
CVE: CVE-2023-33335
Published: 2023-07-05
Description: Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://inf0seq.github.io/cve/2023/05/03/Cross-Site-scripting-%28XSS%29-in-Sophos-iView.html; https://inf0seq.github.io/cve/2023/05/03/Cross-Site-scripting-%28XSS%29-in-Sophos-iView.html
CVE: CVE-2023-34106
Published: 2023-07-05
Description: GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should upgrade to version 10.0.8 to receive a patch.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://github.com/glpi-project/glpi/releases/tag/10.0.8; https://github.com/glpi-project/glpi/security/advisories/GHSA-923r-hqh4-wj7c; https://github.com/glpi-project/glpi/releases/tag/10.0.8
CVE: CVE-2023-35863
Published: 2023-07-05
Description: In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://ctrl-c.club/~blue/nfsdk.html; https://www.madefornet.com/products.html; https://www.michaelrowley.dev/research/posts/nfsdk/nfsdk.html
CVE: CVE-2023-31248
Published: 2023-07-05
Description: Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html; http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html; http://www.openwall.com/lists/oss-security/2023/07/05/2
CVE: CVE-2023-34337
Published: 2023-07-05
Description: 
AMI SPx contains a vulnerability in the BMC where a user may cause an inadequate encryption strength by hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability. 




CVSS Score: 7.6 (HIGH)
CWE: CWE-326, CWE-326
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf
CVE: CVE-2023-34338
Published: 2023-07-05
Description: AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability. 
CVSS Score: 7.1 (HIGH)
CWE: CWE-321, CWE-798
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf
CVE: CVE-2023-34471
Published: 2023-07-05
Description: 
 AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to the loss confidentiality, integrity, and authentication.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-325
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf
CVE: CVE-2023-34472
Published: 2023-07-05
Description: AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A successful exploit of this vulnerability may lead to a loss of integrity.




CVSS Score: 5.7 (MEDIUM)
CWE: CWE-93, CWE-113
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf
CVE: CVE-2023-34473
Published: 2023-07-05
Description: 
AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability. 


CVSS Score: 6.6 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf
CVE: CVE-2023-35001
Published: 2023-07-05
Description: Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html; http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html; http://www.openwall.com/lists/oss-security/2023/07/05/3
CVE: CVE-2023-27197
Published: 2023-07-05
Description: PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
References: https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2023/CVEs/CVE-2023-27197.md; https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2023/; https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2023/CVEs/CVE-2023-27197.md