deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28849
Published: 2023-08-11
Description: Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ChurchCRM/CRM/issues/5477; https://github.com/ChurchCRM/CRM/issues/5477
CVE: CVE-2020-35139
Published: 2023-08-11
Description: An issue was discovered in OFPBundleCtrlMsg in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop).
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/faucetsdn/ryu/issues/118; https://github.com/faucetsdn/ryu/issues/118
CVE: CVE-2020-35141
Published: 2023-08-11
Description: An issue was discovered in OFPQueueGetConfigReply in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop).
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/faucetsdn/ryu/issues/118; https://github.com/faucetsdn/ryu/issues/118
CVE: CVE-2020-35990
Published: 2023-08-11
Description: Buffer Overflow vulnerability in cFilenameInit parameter in browseForDoc function in Foxit Software Foxit PDF Reader version 10.1.0.37527, allows local attackers to cause a denial of service (DoS) via crafted .pdf file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: http://foxit.com; https://www.foxitsoftware.com/support/security-bulletins.php; http://foxit.com
CVE: CVE-2020-36023
Published: 2023-08-11
Description: An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://gitlab.freedesktop.org/poppler/poppler/-/issues/1013; https://lists.debian.org/debian-lts-announce/2023/08/msg00017.html; https://gitlab.freedesktop.org/poppler/poppler/-/issues/1013
CVE: CVE-2020-36024
Published: 2023-08-11
Description: An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gitlab.freedesktop.org/poppler/poppler/-/issues/1016; https://lists.debian.org/debian-lts-announce/2023/08/msg00017.html; https://gitlab.freedesktop.org/poppler/poppler/-/issues/1016
CVE: CVE-2020-36034
Published: 2023-08-11
Description: SQL Injection vulnerability in oretnom23 School Faculty Scheduling System version 1.0, allows remote attacker to execute arbitrary code, escalate privilieges, and gain sensitive information via crafted payload to id parameter in manage_user.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/TCSWT/School-Faculty-Scheduling-System; https://www.sourcecodester.com/download-code?nid=14535&title=School+Faculty+Scheduling+System+using+PHP%2FMySQLi+with+Source+Code; https://www.sourcecodester.com/php/14535/school-faculty-scheduling-system-using-phpmysqli-source-code.html
CVE: CVE-2020-36037
Published: 2023-08-11
Description: An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php.
CVSS Score: 8.8 (HIGH)
References: https://github.com/wuzhicms/wuzhicms/issues/192; https://github.com/wuzhicms/wuzhicms/issues/192
CVE: CVE-2020-36082
Published: 2023-08-11
Description: File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via crafted webshell file to upload module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/alexlang24/bloofoxCMS/issues/7; https://github.com/alexlang24/bloofoxCMS/issues/7
CVE: CVE-2020-36136
Published: 2023-08-11
Description: SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_model.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/cskaza/cszcms/issues/26; https://github.com/cskaza/cszcms/issues/26
CVE: CVE-2020-36138
Published: 2023-08-11
Description: An issue was discovered in decode_frame in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/FFmpeg/FFmpeg/commit/292e41ce650a7b5ca5de4ae87fff0d6a90d9fc97; https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2020-November/272001.html; https://trac.ffmpeg.org/ticket/8960
CVE: CVE-2021-25786
Published: 2023-08-11
Description: An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416
References: https://github.com/qpdf/qpdf/issues/492; https://lists.debian.org/debian-lts-announce/2023/08/msg00037.html; https://github.com/qpdf/qpdf/issues/492
CVE: CVE-2021-25856
Published: 2023-08-11
Description: An issue was discovered in pcmt superMicro-CMS version 3.11, allows attackers to delete files via crafted image file in images.php.
CVSS Score: 4.9 (MEDIUM)
References: https://github.com/pcmt/superMicro-CMS/issues/1; https://github.com/pcmt/superMicro-CMS/issues/1
CVE: CVE-2021-25857
Published: 2023-08-11
Description: An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the font_type parameter to setup.php.
CVSS Score: 7.2 (HIGH)
References: https://github.com/pcmt/superMicro-CMS/issues/2; https://github.com/pcmt/superMicro-CMS/issues/2
CVE: CVE-2021-26504
Published: 2023-08-11
Description: Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request in res.sendFile API in hue-magic.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/Foddy/node-red-contrib-huemagic/issues/217; https://github.com/Foddy/node-red-contrib-huemagic/issues/217
CVE: CVE-2021-26505
Published: 2023-08-11
Description: Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/MrSwitch/hello.js/issues/634; https://github.com/MrSwitch/hello.js/issues/634
CVE: CVE-2021-27523
Published: 2023-08-11
Description: An issue was discovered in open-falcon dashboard version 0.2.0, allows remote attackers to gain, modify, and delete sensitive information via crafted POST request to register interface.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/open-falcon/dashboard/issues/153; https://github.com/open-falcon/dashboard/issues/153
CVE: CVE-2021-27524
Published: 2023-08-11
Description: Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embed media feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/margox/braft-editor/issues/880; https://github.com/margox/braft-editor/issues/880
CVE: CVE-2021-28025
Published: 2023-08-11
Description: Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://bugreports.qt.io/browse/QTBUG-91507; https://bugreports.qt.io/browse/QTBUG-91507
CVE: CVE-2021-28411
Published: 2023-08-11
Description: An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers to escalate privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://github.com/lerry903/RuoYi/issues/20; https://github.com/lerry903/RuoYi/issues/20
CVE: CVE-2021-28427
Published: 2023-08-11
Description: Buffer Overflow vulnerability in XNView version 2.49.3, allows local attackers to execute arbitrary code via crafted TIFF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://newsgroup.xnview.com/viewtopic.php?f=35&t=41035; https://newsgroup.xnview.com/viewtopic.php?f=35&t=41035
CVE: CVE-2021-28429
Published: 2023-08-11
Description: Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/c94875471e3ba3dc396c6919ff3ec9b14539cd71; https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/c94875471e3ba3dc396c6919ff3ec9b14539cd71
CVE: CVE-2021-28835
Published: 2023-08-11
Description: Buffer Overflow vulnerability in XNView before 2.50, allows local attackers to execute arbitrary code via crafted GEM bitmap file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://newsgroup.xnview.com/viewtopic.php?f=35&t=44679; https://www.xnview.com/en/xnview/#changelog; https://newsgroup.xnview.com/viewtopic.php?f=35&t=44679
CVE: CVE-2021-29057
Published: 2023-08-11
Description: An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/SUCHMOKUO/node-worker-threads-pool/issues/20; https://github.com/SUCHMOKUO/node-worker-threads-pool/issues/20
CVE: CVE-2021-29378
Published: 2023-08-11
Description: SQL Injection in pear-admin-think version 2.1.2, allows attackers to execute arbitrary code and escalate privileges via crafted GET request to Crud.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gitee.com/pear-admin/Pear-Admin-Think/issues/I3DIEC; https://gitee.com/pear-admin/Pear-Admin-Think/issues/I3DIEC
CVE: CVE-2021-3236
Published: 2023-08-11
Description: vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/vim/vim/issues/7674; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/vim/vim/issues/7674
CVE: CVE-2023-32267
Published: 2023-08-11
Description: A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited.

CVSS Score: 6.4 (MEDIUM)
References: https://portal.microfocus.com/s/article/KM000020296?language=en_US; https://portal.microfocus.com/s/article/KM000020296?language=en_US
CVE: CVE-2023-39534
Published: 2023-08-11
Description: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, and 2.6.5 contain a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap; https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252; https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863
CVE: CVE-2023-39945
Published: 2023-08-11
Description: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a data submessage sent to PDP port raises unhandled `BadParamException` in fastcdr, which in turn crashes fastdds. Versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5 contain a patch for this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-248
References: https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-exception-20230509-02.pcap; https://github.com/eProsima/Fast-CDR/blob/v1.0.26/src/cpp/Cdr.cpp#L72-L79; https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-2rq6-8j7x-frr9
CVE: CVE-2023-39946
Published: 2023-08-11
Description: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PID_PROPERTY_LIST parameter that contains a CDR string with length larger than the size of actual content. In `eprosima::fastdds::dds::ParameterPropertyList_t::push_back_helper`, `memcpy` is called to first copy the octet'ized length and then to copy the data into `properties_.data`. At the second memcpy, both `data` and `size` can be controlled by anyone that sends the CDR string to the discovery multicast port. This can remotely crash any Fast-DDS process. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 contain a patch for this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/eProsima/Fast-DDS/commit/[PII_REDACTED]27e8a67a0406b823138b5068cc47dc; https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-j297-rg6j-m7hx; https://www.debian.org/security/2023/dsa-5481
CVE: CVE-2023-39947
Published: 2023-08-11
Description: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, even after the fix at commit 3492270, malformed `PID_PROPERTY_LIST` parameters cause heap overflow at a different program counter. This can remotely crash any Fast-DDS process. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 contain a patch for this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/eProsima/Fast-DDS/commit/[PII_REDACTED]27e8a67a0406b823138b5068cc47dc; https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-mf55-5747-c4pv; https://www.debian.org/security/2023/dsa-5481
CVE: CVE-2023-39948
Published: 2023-08-11
Description: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS. This can remotely crash any Fast DDS process. Versions 2.10.0 and 2.6.5 contain a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://github.com/eProsima/Fast-DDS/files/11117197/fastdds-assert.pcap.zip; https://github.com/eProsima/Fast-DDS/issues/3422; https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-x9pj-vrgf-f68f
CVE: CVE-2023-39949
Published: 2023-08-11
Description: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure. This can remotely crash any Fast-DDS process. Versions 2.9.1 and 2.6.5 contain a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/eProsima/Fast-DDS/blob/v2.9.0/src/cpp/rtps/messages/MessageReceiver.cpp#L1059; https://github.com/eProsima/Fast-DDS/issues/3236; https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-3jv9-j9x3-95cg
CVE: CVE-2023-0871
Published: 2023-08-11
Description: XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://docs.opennms.com/horizon/32/releasenotes/changelog.html; https://github.com/OpenNMS/opennms/pull/6355; https://docs.opennms.com/horizon/32/releasenotes/changelog.html
CVE: CVE-2023-22955
Published: 2023-08-11
Description: An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums for the flasher tool, an attacker is able to store malicious firmware.
CVSS Score: 7.8 (HIGH)
CWE: CWE-345
References: http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.html; http://seclists.org/fulldisclosure/2023/Aug/17; https://syss.de
CVE: CVE-2023-22956
Published: 2023-08-11
Description: An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is able to decrypt encrypted configuration files and retrieve sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://packetstormsecurity.com/files/174216/AudioCodes-VoIP-Phones-Hardcoded-Key.html; http://seclists.org/fulldisclosure/2023/Aug/16; https://syss.de
CVE: CVE-2023-22957
Published: 2023-08-11
Description: An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive information, e.g., the device root password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://packetstormsecurity.com/files/174215/AudioCodes-VoIP-Phones-Hardcoded-Key.html; http://seclists.org/fulldisclosure/2023/Aug/15; https://syss.de
CVE: CVE-2023-3452
Published: 2023-08-12
Description: The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/canto/trunk/includes/lib/tree.php?rev=2841358#L5; https://plugins.trac.wordpress.org/changeset/2951888/canto/trunk/includes/lib/tree.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a76077c6-700a-4d21-a930-b0d6455d959c?source=cve
CVE: CVE-2023-4293
Published: 2023-08-12
Description: The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/5.7.4/wpdm-premium-packages.php#L1158; https://plugins.trac.wordpress.org/changeset/2951917/wpdm-premium-packages#file5; https://www.wordfence.com/threat-intel/vulnerabilities/id/82137302-60ca-44d5-b087-dc96e2815fca?source=cve
CVE: CVE-2023-4265
Published: 2023-08-12
Description: Potential buffer overflow vulnerabilities in the following locations:
 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 
 https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis... https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis.c#L841
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-120, CWE-120
References: http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html; http://seclists.org/fulldisclosure/2023/Nov/1; http://www.openwall.com/lists/oss-security/2023/11/07/1
CVE: CVE-2023-39380
Published: 2023-08-13
Description: Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnormally.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264, CWE-287, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39381
Published: 2023-08-13
Description:  Input verification vulnerability in the storage module. Successful exploitation of this vulnerability may cause the device to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20, CWE-116
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39382
Published: 2023-08-13
Description:  Input verification vulnerability in the audio module. Successful exploitation of this vulnerability may cause virtual machines (VMs) to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20, CWE-116
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39383
Published: 2023-08-13
Description: Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromise apps' data security.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-668
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39384
Published: 2023-08-13
Description: Vulnerability of incomplete permission verification in the input method module. Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264, CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39388
Published: 2023-08-13
Description: Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause home screen unavailability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-20, CWE-1285
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39389
Published: 2023-08-13
Description: Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause home screen unavailability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-20, CWE-1285
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/
CVE: CVE-2023-39392
Published: 2023-08-13
Description: Vulnerability of insecure signatures in the OsuLogin module. Successful exploitation of this vulnerability may cause OsuLogin to be maliciously modified and overwritten.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16, CWE-347
References: https://consumer.huawei.com/en/support/bulletin/2023/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/8/