rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-42298 
An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of file src/bifs/unquantize.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-12T00:00:00.000Z
CVE-2023-42299 
Buffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_subimage_data function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-42307 
Cross Site Scripting (XSS) vulnerability in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via "Subject Name" and "Subject Code" section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-12T00:00:00.000Z
CVE-2023-42308 
Cross Site Scripting (XSS) vulnerability in Manage Fastrack Subjects in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via the "Subject Name" and "Subject Code" Section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-12T00:00:00.000Z
CVE-2023-42319 
Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-18T00:00:00.000Z
CVE-2023-42320 
Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter in the GetParentControlInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-42321 
Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-42322 
Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-42323 
Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-30T00:00:00.000Z
CVE-2023-42325 
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-14T00:00:00.000Z
CVE-2023-42326 
An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-14T00:00:00.000Z
CVE-2023-42327 
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-14T00:00:00.000Z
CVE-2023-42328 
An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-42331 
A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage_uploads.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-42334 
An Indirect Object Reference (IDOR) in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to escalate privileges via the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-42335 
Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to execute arbitrary code via the add attachment function in the New Expense component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-42336 
An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter in the /etc/shadow.sample component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-16T00:00:00.000Z
CVE-2023-42343 
A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-08T00:00:00.000Z
CVE-2023-42344 
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-08T00:00:00.000Z
CVE-2023-42345 
A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-08T00:00:00.000Z
CVE-2023-42346 
Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-08T00:00:00.000Z
CVE-2023-42358 
An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the E2Manager API component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-03T00:00:00.000Z
CVE-2023-42359 
SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username parameter in /index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-42361 
Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an attacker to view arbitrary files and cause other impacts via use of crafted image during PDF export.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-07T00:00:00.000Z
CVE-2023-42362 
An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive information via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-14T00:00:00.000Z
CVE-2023-42363 
A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-27T00:00:00.000Z
CVE-2023-42364 
A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-27T00:00:00.000Z
CVE-2023-42365 
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-27T00:00:00.000Z
CVE-2023-42366 
A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-27T00:00:00.000Z
CVE-2023-42371 
Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via a crafted script to the insert link function in the editor component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-42374 
An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a crafted compressed script to the Sui node component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-13T00:00:00.000Z
CVE-2023-42387 
An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function in install.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-42398 
An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-15T00:00:00.000Z
CVE-2023-42399 
Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-19T00:00:00.000Z
CVE-2023-42404 
OneVision Workspace before WS23.1 SR1 (build w31.040) allows arbitrary Java EL execution.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: OneVision
product: Workspace
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-04-28T00:00:00.000Z
CVE-2023-42405 
SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalService.list(), and switchService.list().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-14T00:00:00.000Z
CVE-2023-42406 
SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute arbitrary code via the editrole.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-26T00:00:00.000Z
CVE-2023-42419 Improper Management of Cryptographic Keys in the Maintenance Server in QCOW Air-Gapped Distribution (China Edition)
Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key.


An attacker with administrative privileges & access to the air-gapped server could potentially use this key to run commands on the server.
The issue was resolved in version 2.28.
Earlier versions, including all Cybellum 1.x versions, and distributions for the rest of the world remain unaffected.


Problem types: description: cwe-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: Cybellum
product: Maintenance Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Delikely
Published: 2024-03-05T05:23:16.947Z
CVE-2023-42425 
An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-31T00:00:00.000Z
CVE-2023-42426 
Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-25T00:00:00.000Z
CVE-2023-42427 
Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: Japan System Techniques Co., Ltd.
product: UNIVERSAL PASSPORT RX
Published: 2024-06-03T03:44:54.434Z
CVE-2023-42428 
Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and files in the system.
Problem types: description: Directory traversal
Affected products: vendor: CubeCart Limited
product: CubeCart
Published: 2023-11-17T04:37:21.879Z
CVE-2023-42429 
Improper buffer restrictions in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-92
description: Improper buffer restrictions
Affected products: vendor: n/a
product: Intel NUC BIOS firmware
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-01-19T20:03:08.555Z
CVE-2023-42431 Potential XSS on user preferences page
Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Hallo Welt! GmbH
product: BlueSpice
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 2.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-10-30T10:48:21.487Z
CVE-2023-42433 
Incorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-276
description: Incorrect default permissions
Affected products: vendor: n/a
product: Endurance Gaming Mode software installers
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-05-16T20:47:38.359Z
CVE-2023-42435 Cross-Site Request Forgery in DEXMA DEXGate





The affected product is vulnerable to a cross-site request forgery vulnerability, which may allow an attacker to perform actions with the permissions of a victim user.






Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: DEXMA
product: DexGate
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez of S21sec reported these vulnerabilities to CISA.
Published: 2023-10-19T18:19:28.035Z
CVE-2023-42436 
Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2023-12-26T07:22:50.373Z
CVE-2023-42438 
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. Visiting a malicious website may lead to user interface spoofing.
Problem types: description: Visiting a malicious website may lead to user interface spoofing
Affected products: vendor: Apple
product: macOS
Published: 2023-10-25T18:31:56.057Z
CVE-2023-42439 GeoNode SSRF Bypass to return internal host data
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. The application is using a whitelist, but the whitelist can be bypassed. The bypass will trick the application that the first host is a whitelisted address, but the browser will use `@` or `%40` as a credential to the host geoserver on port 8080, this will return the data to that host on the response. Version 4.1.3.post1 is the first available version that contains a patch.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: GeoNode
product: geonode
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-09-15T20:22:19.102Z
CVE-2023-42441 Vyper has incorrect re-entrancy lock when key is empty string
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.
Problem types: cwe_id: CWE-833
description: CWE-833: Deadlock
Affected products: vendor: vyperlang
product: vyper
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-09-18T20:19:26.086Z
CVE-2023-42442 JumpServer session replays download without authentication
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).

Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: jumpserver
product: jumpserver
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Published: 2023-09-15T20:29:12.166Z
CVE-2023-42443 Vyper vulnerable to memory corruption in certain builtins utilizing `msize`
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context. For `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.

Each builtin has conditions that must be fulfilled for the corruption to happen. For `raw_call`, the `data` argument of the builtin must be `msg.data` and the `value` or `gas` passed to the builtin must be some complex expression that results in writing to the memory. For `create_copy_of`, the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. For `create_from_blueprint`, either no constructor parameters should be passed to the builtin or `raw_args` should be set to True, and the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory.

As of time of publication, no patched version exists. The issue is still being investigated, and there might be other cases where the corruption might happen. When the builtin is being called from an `internal` function `F`, the issue is not present provided that the function calling `F` wrote to memory before calling `F`. As a workaround, the complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: vyperlang
product: vyper
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-09-18T20:52:33.664Z
CVE-2023-42444 phonenumber panics on parsing crafted RF3966 inputs
phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.
Problem types: cwe_id: CWE-248
description: CWE-248: Uncaught Exception
cwe_id: CWE-392
description: CWE-392: Missing Report of Error Condition
cwe_id: CWE-1284
description: CWE-1284: Improper Validation of Specified Quantity in Input
Affected products: vendor: whisperfish
product: rust-phonenumber
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2023-09-19T14:47:22.026Z