deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-21368
Published: 2023-10-30
Description: In Audio, there is a possible out of bounds read due to missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21369
Published: 2023-10-30
Description: In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21370
Published: 2023-10-30
Description: In the Security Element API, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21371
Published: 2023-10-30
Description: In Secure Element, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-36920
Published: 2023-10-30
Description: In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information.



CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://launchpad.support.sap.com/#/notes/3326769; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3326769
CVE: CVE-2023-47090
Published: 2023-10-30
Description: NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2023/10/30/1; https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23; https://www.openwall.com/lists/oss-security/2023/10/13/2
CVE: CVE-2023-21372
Published: 2023-10-30
Description: In libdexfile, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21373
Published: 2023-10-30
Description: In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21374
Published: 2023-10-30
Description: In System UI, there is a possible factory reset protection bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21375
Published: 2023-10-30
Description: In Sysproxy, there is a possible out of bounds write due to an integer underflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21376
Published: 2023-10-30
Description: In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21377
Published: 2023-10-30
Description: In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21378
Published: 2023-10-30
Description: In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21379
Published: 2023-10-30
Description: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21380
Published: 2023-10-30
Description: In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21381
Published: 2023-10-30
Description: In Media Resource Manager, there is a possible local arbitrary code execution due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21382
Published: 2023-10-30
Description: In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21383
Published: 2023-10-30
Description: In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21384
Published: 2023-10-30
Description: In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21385
Published: 2023-10-30
Description: In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21387
Published: 2023-10-30
Description: In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21388
Published: 2023-10-30
Description: In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21389
Published: 2023-10-30
Description: In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21390
Published: 2023-10-30
Description: In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21391
Published: 2023-10-30
Description: In Messaging, there is a possible way to disable the messaging application due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21392
Published: 2023-10-30
Description: In Bluetooth, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege when connecting to a Bluetooth device with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21393
Published: 2023-10-30
Description: In Settings, there is a possible way for the user to change SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21394
Published: 2023-10-30
Description: In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/platform/packages/services/Telecomm/+/68dca62035c49e14ad26a54f614199cb29a3393f; https://source.android.com/security/bulletin/2023-12-01; https://android.googlesource.com/platform/packages/services/Telecomm/+/68dca62035c49e14ad26a54f614199cb29a3393f
CVE: CVE-2023-21395
Published: 2023-10-30
Description: In Bluetooth, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21396
Published: 2023-10-30
Description: In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21397
Published: 2023-10-30
Description: In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-21398
Published: 2023-10-30
Description: In sdksandbox, there is a possible strandhogg style overlay attack due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-40101
Published: 2023-10-30
Description: In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-45780
Published: 2023-10-30
Description: In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.3 (HIGH)
References: https://source.android.com/docs/security/bulletin/android-14; https://source.android.com/docs/security/bulletin/android-14
CVE: CVE-2023-47101
Published: 2023-10-30
Description: The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://cyvisory.group/advisory/CYADV-2023-012; https://sourceforge.net/p/securepoint/news/2023/08/2040-is-now-available/; https://cyvisory.group/advisory/CYADV-2023-012
CVE: CVE-2020-36767
Published: 2023-10-30
Description: tinyfiledialogs (aka tiny file dialogs) before 3.8.0 allows shell metacharacters in titles, messages, and other input data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://github.com/servo/servo/issues/25498#issuecomment-703527082; https://github.com/servo/servo/issues/25498#issuecomment-703527082
CVE: CVE-2023-41891
Published: 2023-10-30
Description: FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-89
References: https://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fd; https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-r847-6w6h-r8g4; https://owasp.org/www-community/attacks/SQL_Injection#
CVE: CVE-2023-42803
Published: 2023-10-30
Description: BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures. BigBlueButton 2.6.0-beta.2 contains a patch. There are no known workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/bigbluebutton/bigbluebutton/pull/15990; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-w98f-6x8w-xhjc; https://github.com/bigbluebutton/bigbluebutton/pull/15990
CVE: CVE-2023-42804
Published: 2023-10-30
Description: BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the files have certain extensions (txt, swf, svg, png). In version 2.6.0-beta.1, input validation was added on the parameters being passed and dangerous characters are stripped. There are no known workarounds.
CVSS Score: 3.1 (LOW)
CWE: CWE-22
References: https://github.com/bigbluebutton/bigbluebutton/pull/15960; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3qjg-229m-vq84; https://github.com/bigbluebutton/bigbluebutton/pull/15960
CVE: CVE-2023-43647
Published: 2023-10-30
Description: baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Version 4.8.0 contains a patch for this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://basercms.net/security/JVN_24381990; https://github.com/baserproject/basercms/commit/eb5977533d05db4f3bb03bd19630b66052799b2e; https://github.com/baserproject/basercms/security/advisories/GHSA-ggj4-78rm-6xgv
CVE: CVE-2023-43648
Published: 2023-10-30
Description: baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://basercms.net/security/JVN_81174674; https://github.com/baserproject/basercms/commit/7555a5cf0006755dc0223fffc2d882b50a97758b; https://github.com/baserproject/basercms/security/advisories/GHSA-hmqj-gv2m-hq55
CVE: CVE-2023-43649
Published: 2023-10-30
Description: baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352
References: https://basercms.net/security/JVN_99052047; https://github.com/baserproject/basercms/commit/874c55433fead93e0be9df96fd28740f8047c8b6; https://github.com/baserproject/basercms/security/advisories/GHSA-fw9x-cqjq-7jx5
CVE: CVE-2023-47104
Published: 2023-10-30
Description: tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-77
References: https://github.com/servo/servo/issues/25498#issuecomment-703527082; https://sourceforge.net/p/tinyfiledialogs/code/ci/ac9f9f6d8cdf45ca8d9b4cf1f201ee472301e114/; https://github.com/servo/servo/issues/25498#issuecomment-703527082
CVE: CVE-2023-43792
Published: 2023-10-30
Description: baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time of publication, no known patched versions are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://basercms.net/security/JVN_45547161; https://github.com/baserproject/basercms/security/advisories/GHSA-vrm6-c878-fpq6; https://basercms.net/security/JVN_45547161
CVE: CVE-2023-5349
Published: 2023-10-30
Description: A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://access.redhat.com/security/cve/CVE-2023-5349; https://bugzilla.redhat.com/show_bug.cgi?id=2247064; https://github.com/rmagick/rmagick/issues/1401
CVE: CVE-2022-39172
Published: 2023-10-30
Description: A stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low-privileged attacker to execute arbitrary code in the victim's browser via name field of a process.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sec-consult.com/vulnerability-lab/advisory/stored-cross-site-scripting-in-mb-support-broker-management-solution-openviva-c2/; https://sec-consult.com/vulnerability-lab/advisory/stored-cross-site-scripting-in-mb-support-broker-management-solution-openviva-c2/
CVE: CVE-2023-42323
Published: 2023-10-30
Description: Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/mnbvcxz131421/douhaocms/blob/main/README.md; https://github.com/mnbvcxz131421/douhaocms/blob/main/README.md
CVE: CVE-2023-45956
Published: 2023-10-30
Description: An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Govee%20LED%20Strip%20Vulnerability%20Report.pdf; https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Govee%20LED%20Strip%20Vulnerability%20Report.pdf