deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-35176
Published: 2023-06-30
Description: Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restore feature through the embedded web service on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://support.hp.com/us-en/document/ish_8[PII_REDACTED]697-16/hpsbpi03852; https://support.hp.com/us-en/document/ish_8[PII_REDACTED]697-16/hpsbpi03852
CVE: CVE-2023-35177
Published: 2023-06-30
Description: Certain HP LaserJet Pro print products are potentially vulnerable to a stack-based buffer overflow related to the compact font format parser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://support.hp.com/us-en/document/ish_8[PII_REDACTED]916-16/hpsbpi03853; https://support.hp.com/us-en/document/ish_8[PII_REDACTED]916-16/hpsbpi03853
CVE: CVE-2023-35178
Published: 2023-06-30
Description: Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow when performing a GET request to scan jobs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://support.hp.com/us-en/document/ish_8[PII_REDACTED]769-16/hpsbpi03854; https://support.hp.com/us-en/document/ish_8[PII_REDACTED]769-16/hpsbpi03854
CVE: CVE-2023-37300
Published: 2023-06-30
Description: An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://gerrit.wikimedia.org/r/q/I993fdcae1fedb7dd543b35a477026bc727615b0a; https://phabricator.wikimedia.org/T330968; https://gerrit.wikimedia.org/r/q/I993fdcae1fedb7dd543b35a477026bc727615b0a
CVE: CVE-2023-37301
Published: 2023-06-30
Description: An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-326
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933663; https://phabricator.wikimedia.org/T250720; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933663
CVE: CVE-2023-37302
Published: 2023-06-30
Description: An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933650; https://phabricator.wikimedia.org/T339111
CVE: CVE-2023-37303
Published: 2023-06-30
Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-754
References: https://gerrit.wikimedia.org/r/q/I10a9273c542576b3f7bb38de68dcd2aa41cfb1b0; https://phabricator.wikimedia.org/T338276; https://gerrit.wikimedia.org/r/q/I10a9273c542576b3f7bb38de68dcd2aa41cfb1b0
CVE: CVE-2023-37304
Published: 2023-06-30
Description: An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignment feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DoubleWiki/+/932825; https://phabricator.wikimedia.org/T323651; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DoubleWiki/+/932825
CVE: CVE-2023-37305
Published: 2023-06-30
Description: An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php, hidden users can be exposed via public interfaces.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://gerrit.wikimedia.org/r/q/Ibe5f8e25dea155bbd811a65833394c0d4b906a34; https://phabricator.wikimedia.org/T326952; https://gerrit.wikimedia.org/r/q/Ibe5f8e25dea155bbd811a65833394c0d4b906a34
CVE: CVE-2023-37306
Published: 2023-06-30
Description: MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908; https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle; https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908
CVE: CVE-2023-37307
Published: 2023-06-30
Description: In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/176975/MISP-2.4.171-Cross-Site-Scripting.html; https://github.com/MISP/MISP/commit/286c84fab0047726a6a396ceefaae1bb666fc485; https://github.com/MISP/MISP/compare/v2.4.171...v2.4.172
CVE: CVE-2023-37360
Published: 2023-06-30
Description: pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-74
References: https://github.com/manugarg/pacparser/security/advisories/GHSA-62q6-v997-f7v9; https://github.com/manugarg/pacparser/security/advisories/GHSA-62q6-v997-f7v9
CVE: CVE-2023-3485
Published: 2023-06-30
Description: Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it is possible to interfere with pending tasks in other namespaces, such as marking a task failed or completed.
If a task is targeted for completion by the attacker, the targeted namespace must also be using the same data converter configuration as the initial, valid, namespace for the task completion payload to be decoded by workers in the target namespace.




CVSS Score: 3.0 (LOW)
CWE: CWE-863, CWE-1188, CWE-1188
References: https://github.com/temporalio/temporal/releases/tag/v1.20.0; https://github.com/temporalio/temporal/releases/tag/v1.20.0
CVE: CVE-2023-36477
Published: 2023-06-30
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the `CKEditor' space. This makes it possible to perform a variety of harmful actions, such as removing technical documents, leading to loss of service and editing the javascript configuration of CKEditor, leading to persistent XSS. This issue has been patched in XWiki 14.10.6 and XWiki 15.1. This issue has been patched on the CKEditor Integration extension 1.64.9 for XWiki version older than 14.6RC1. Users are advised to upgrade. Users unable to upgrade may manually address the issue by restricting the `edit` and `delete` rights to a trusted user or group (e.g. the `XWiki.XWikiAdminGroup` group), implicitly disabling those rights for all other users. See commit `9d9d86179` for details.




CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/9d9d86179457cb8dc48b[PII_REDACTED]878800be4f; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-793w-g325-hrw2; https://jira.xwiki.org/browse/CKEDITOR-508
CVE: CVE-2023-36807
Published: 2023-06-30
Description: pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF. Versions prior to 2.10.5 throw an error, but do not hang forever. This issue was fixed with https://github.com/py-pdf/pypdf/pull/1331 which has been included in release 2.10.6. Users are advised to upgrade. Users unable to upgrade should modify `PyPDF2/generic/_data_structures.py::read_object` to an an error throwing case. See GHSA-hm9v-vj3r-r55m for details. 
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-835
References: https://github.com/py-pdf/pypdf/issues/1329; https://github.com/py-pdf/pypdf/pull/1331; https://github.com/py-pdf/pypdf/security/advisories/GHSA-hm9v-vj3r-r55m
CVE: CVE-2023-36810
Published: 2023-06-30
Description: pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-407
References: https://github.com/py-pdf/pypdf/issues/582; https://github.com/py-pdf/pypdf/pull/808; https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw
CVE: CVE-2023-37365
Published: 2023-06-30
Description: Hnswlib 0.7.0 has a double free in init_index when the M argument is a large integer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/nmslib/hnswlib/issues/467; https://github.com/nmslib/hnswlib/issues/467
CVE: CVE-2023-27469
Published: 2023-06-30
Description: Malwarebytes Anti-Exploit 4.4.0.220 is vulnerable to arbitrary file deletion and denial of service via an ALPC message in which FullFileNamePath lacks a '\0' character.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://malwarebytes.com; https://www.malwarebytes.com/secure/cves/cve-2023-27469; https://malwarebytes.com
CVE: CVE-2023-29145
Published: 2023-06-30
Description: The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution. The attacker can set LD_LIBRARY_PATH, set LD_PRELOAD, or run an executable file in a debugger.
CVSS Score: 7.8 (HIGH)
CWE: CWE-640
References: https://malwarebytes.com; https://www.malwarebytes.com/secure/cves/cve-2023-29145; https://malwarebytes.com
CVE: CVE-2023-31543
Published: 2023-06-30
Description: A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-427
References: https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe; https://github.com/bndr/pipreqs/pull/364; https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe
CVE: CVE-2023-29147
Published: 2023-06-30
Description: In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the same identifier.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-290
References: https://malwarebytes.com; https://www.malwarebytes.com/secure/cves/cve-2023-29147; https://malwarebytes.com
CVE: CVE-2023-35946
Published: 2023-06-30
Description: Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache, it uses the dependency's coordinates to compute a file location. With specially crafted dependency coordinates, Gradle can be made to write files into an unintended location. The file may be written outside the dependency cache or over another file in the dependency cache. This vulnerability could be used to poison the dependency cache or overwrite important files elsewhere on the filesystem where the Gradle process has write permissions. Exploiting this vulnerability requires an attacker to have control over a dependency repository used by the Gradle build or have the ability to modify the build's configuration. It is unlikely that this would go unnoticed. A fix has been released in Gradle 7.6.2 and 8.2 to protect against this vulnerability. Gradle will refuse to cache dependencies that have path traversal elements in their dependency coordinates. It is recommended that users upgrade to a patched version. If you are unable to upgrade to Gradle 7.6.2 or 8.2, `dependency verification` will make this vulnerability more difficult to exploit.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-22
References: https://docs.gradle.org/current/userguide/dependency_verification.html; https://github.com/gradle/gradle/commit/859eae2b2acf751ae7db3c9ffefe275aa5da0d5d; https://github.com/gradle/gradle/commit/b07e528feb3a5ffa66bdcc358549edd73e4c8a12
CVE: CVE-2023-1206
Published: 2023-06-30
Description: A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=2175903; https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html; https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE: CVE-2023-22815
Published: 2023-06-30
Description: Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on vulnerable CGI files. This vulnerability can only be exploited over the network and the attacker must already have admin/root privileges to carry out the exploit. An authentication bypass is required for this exploit, thereby making it more complex. The attack may not require user interaction. Since an attacker must already be authenticated, the confidentiality impact is low while the integrity and availability impact is high. 

This issue affects My Cloud OS 5 devices: before 5.26.300.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-78, CWE-77
References: https://www.westerndigital.com/support/product-security/wdc-23010-my-cloud-firmware-version-5-26-300; https://www.westerndigital.com/support/product-security/wdc-23010-my-cloud-firmware-version-5-26-300
CVE: CVE-2023-22816
Published: 2023-06-30
Description: A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and execute larger payloads.
This issue affects My Cloud OS 5 devices: before 5.26.300.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78, CWE-77
References: https://www.westerndigital.com/support/product-security/wdc-23010-my-cloud-firmware-version-5-26-300; https://www.westerndigital.com/support/product-security/wdc-23010-my-cloud-firmware-version-5-26-300
CVE: CVE-2023-29241
Published: 2023-06-30
Description: Improper Information in Cybersecurity Guidebook in Bosch Building Integration System (BIS) 5.0 may lead to wrong configuration which allows local users to access data via network
CVSS Score: 8.1 (HIGH)
CWE: CWE-1112
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-988400-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-988400-BT.html
CVE: CVE-2023-2908
Published: 2023-06-30
Description: A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/security/cve/CVE-2023-2908; https://bugzilla.redhat.com/show_bug.cgi?id=2218830; https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f
CVE: CVE-2023-33298
Published: 2023-06-30
Description: com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usingCAPath.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://support.perimeter81.com/docs/macos-agent-release-notes; https://www.kb.cert.org/vuls/id/653767; https://www.ns-echo.com/posts/cve_2023_33298.html
CVE: CVE-2023-3117
Published: 2023-06-30
Description: Rejected reason: Duplicate of CVE-2023-3390.
CVE: CVE-2023-3338
Published: 2023-06-30
Description: A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/security/cve/CVE-2023-3338; https://bugzilla.redhat.com/show_bug.cgi?id=2218618; https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
CVE: CVE-2023-3490
Published: 2023-06-30
Description:  SQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114; https://huntr.dev/bounties/4e60ebc1-e00f-48cb-b011-3cefce688ecd; https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114
CVE: CVE-2023-3491
Published: 2023-06-30
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114; https://huntr.dev/bounties/043bd900-ac78-44d2-a340-84ddd0bc4a1d; https://github.com/fossbilling/fossbilling/commit/2ddb7438ee0d05f9a9d01555edcfed820960f114
CVE: CVE-2023-3493
Published: 2023-06-30
Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1236
References: https://github.com/fossbilling/fossbilling/commit/9402d6c4d44b77ccd68d98d1e6cedf782bd913dc; https://huntr.dev/bounties/e9a272ca-b050-441d-a8cb-4fdecb76ccce; https://github.com/fossbilling/fossbilling/commit/9402d6c4d44b77ccd68d98d1e6cedf782bd913dc
CVE: CVE-2023-36144
Published: 2023-06-30
Description: An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://intelbras.com; https://github.com/leonardobg/CVE-2023-36144; http://intelbras.com
CVE: CVE-2023-36812
Published: 2023-06-30
Description: OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in  commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html; https://github.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9; https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba
CVE: CVE-2021-31982
Published: 2023-07-01
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31982; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31982
CVE: CVE-2021-34475
Published: 2023-07-01
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 5.4 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34475; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34475
CVE: CVE-2021-34506
Published: 2023-07-01
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 6.1 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34506; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34506
CVE: CVE-2021-42307
Published: 2023-07-01
Description: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42307; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42307
CVE: CVE-2023-22814
Published: 2023-07-01
Description: An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack.


This issue affects My Cloud OS 5 devices: before 5.26.202.


CVSS Score: 10.0 (CRITICAL)
CWE: CWE-290, CWE-290
References: https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202; https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202
CVE: CVE-2023-28323
Published: 2023-07-01
Description: A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS (Operating System) vulnerabilities to escalate privileges on the machine or be used as a stepping stone to get to other network attached machines.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://forums.ivanti.com/s/article/SA-2023-06-20-CVE-2023-28323; https://forums.ivanti.com/s/article/SA-2023-06-20-CVE-2023-28323
CVE: CVE-2023-28324
Published: 2023-07-01
Description: A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://forums.ivanti.com/s/article/SA-2023-06-06-CVE-2023-28324; https://forums.ivanti.com/s/article/SA-2023-06-06-CVE-2023-28324
CVE: CVE-2023-28364
Published: 2023-07-01
Description: An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned URLs automatically without showing the URL first. Now the user must manually navigate to the URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://hackerone.com/reports/1946534; https://hackerone.com/reports/1946534
CVE: CVE-2023-28365
Published: 2023-07-01
Description: A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://community.ui.com/releases/Security-Advisory-Bulletin-031-031/8c85fc64-e9a8-4082-9ec4-56b14effd545; https://community.ui.com/releases/Security-Advisory-Bulletin-031-031/8c85fc64-e9a8-4082-9ec4-56b14effd545