rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-37122 
A stored cross-site scripting (XSS) vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-37124 
A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-37125 
A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-37131 
A Cross-Site Request Forgery (CSRF) in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily change the Administrator password via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-37132 
A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-37133 
A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-37134 
A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-37135 
A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-37136 
A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-37139 
ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlotArray().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-18T00:00:00.000Z
CVE-2023-37140 
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-18T00:00:00.000Z
CVE-2023-37141 
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-18T00:00:00.000Z
CVE-2023-37142 
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-18T00:00:00.000Z
CVE-2023-37143 
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-18T00:00:00.000Z
CVE-2023-37144 
Tenda AC10 v15.03.06.26 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-07T00:00:00.000Z
CVE-2023-37145 
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-07T00:00:00.000Z
CVE-2023-37146 
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-07T00:00:00.000Z
CVE-2023-37148 
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-07T00:00:00.000Z
CVE-2023-37149 
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-07T00:00:00.000Z
CVE-2023-37150 
Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in "/admin/index.php?page=categories" Category item.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-10T00:00:00.000Z
CVE-2023-37152 
Projectworlds Online Art Gallery Project 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page. Note: This has been disputed as not a valid vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-10T00:00:00.000Z
CVE-2023-37153 
KodExplorer 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature. An attacker can exploit this vulnerability by injecting XSS syntax into the Description field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-10T00:00:00.000Z
CVE-2023-37154 
check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \${IFS}. This has been categorized both as fixed in e8810de, and as intended behavior.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-09T00:00:00.000Z
CVE-2023-37164 
Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the cat_id parameter at /shop/?module=shop&action=search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-20T00:00:00.000Z
CVE-2023-37165 
Millhouse-Project v1.414 was discovered to contain a remote code execution (RCE) vulnerability via the component /add_post_sql.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-20T00:00:00.000Z
CVE-2023-37170 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-07T00:00:00.000Z
CVE-2023-37171 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-07T00:00:00.000Z
CVE-2023-37172 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-07T00:00:00.000Z
CVE-2023-37173 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-07T00:00:00.000Z
CVE-2023-37174 
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dump_isom_scene function at /mp4box/filedump.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-11T00:00:00.000Z
CVE-2023-37177 
SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via the query parameter in the /admin/convert/export_z3950.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-21T00:00:00.000Z
CVE-2023-37185 
C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2023-37186 
C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2023-37187 
C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2023-37188 
C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2023-37189 
A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-11T00:00:00.000Z
CVE-2023-37190 
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Virtual Fax Name and Caller ID Name parameters under the New Virtual Fax feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-11T00:00:00.000Z
CVE-2023-37191 
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-11T00:00:00.000Z
CVE-2023-37192 
Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-37194 
A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 1628 (All versions). The kernel memory of affected devices is exposed to user-mode via direct memory access (DMA) which could allow a local attacker with administrative privileges to execute arbitrary code on the host system without any restrictions.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: SIMATIC CP 1604
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1616
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1623
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1626
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1628
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 6.7
baseSeverity: MEDIUM
Published: 2023-10-10T10:21:22.914Z
CVE-2023-37195 
A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 1628 (All versions). Affected devices insufficiently control continuous mapping of direct memory access (DMA) requests. This could allow local attackers with administrative privileges to cause a denial of service situation on the host. A physical power cycle is required to get the system working again.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Siemens
product: SIMATIC CP 1604
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1616
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1623
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1626
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1628
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
baseScore: 4.4
baseSeverity: MEDIUM
Published: 2023-10-10T10:21:24.004Z
CVE-2023-37196 

A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command
('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to
access unauthorized content, change, or delete content, or perform unauthorized actions when
tampering with the alert settings of endpoints on DCE.


Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Schneider Electric
product: StruxureWare Data Center Expert 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-07-12T06:22:46.848Z
CVE-2023-37197 



A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command
('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to
access unauthorized content, change, or delete content, or perform unauthorized actions when
tampering with the mass configuration settings of endpoints on DCE. 




Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Schneider Electric
product: StruxureWare Data Center Expert 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-07-12T06:41:30.783Z
CVE-2023-37198 





A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that
could cause remote code execution when an admin user on DCE uploads or tampers with install
packages. 

 




Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Schneider Electric
product: StruxureWare Data Center Expert 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-07-12T06:44:34.037Z
CVE-2023-37199 

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that
could cause remote code execution when an admin user on DCE tampers with backups which
are then manually restored. 



Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Schneider Electric
product: StruxureWare Data Center Expert 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-07-12T07:04:08.510Z
CVE-2023-37200 

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that
could cause loss of confidentiality when replacing a project file on the local filesystem and after
manual restart of the server. 



Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: Schneider Electric
product: EcoStruxure OPC UA Server Expert
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-07-12T07:11:30.005Z
CVE-2023-37201 
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
Problem types: description: Use-after-free in WebRTC certificate generation
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Irvan Kurniawan
Published: 2023-07-05T08:51:01.631Z
CVE-2023-37202 
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
Problem types: description: Potential use-after-free from compartment mismatch in SpiderMonkey
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: zx
Published: 2023-07-05T08:52:01.098Z
CVE-2023-37203 
Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files.  This could have been leveraged to execute arbitrary code. This vulnerability affects Firefox < 115.
Problem types: description: Drag and Drop API may provide access to local system files
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Paul Nickerson and Ameen Basha M K
Published: 2023-07-05T09:01:27.313Z
CVE-2023-37204 
A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational function. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.
Problem types: description: Fullscreen notification obscured via option element
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Irvan Kurniawan
Published: 2023-07-05T09:01:40.288Z
CVE-2023-37205 
The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox < 115.
Problem types: description: URL spoofing in address bar using RTL characters
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Rohan Sharma
Published: 2023-07-05T09:01:53.093Z
CVE-2023-37206 
Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. This vulnerability affects Firefox < 115.
Problem types: description: Insufficient validation of symlinks in the FileSystem API
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Ameen Basha M K
Published: 2023-07-05T09:02:02.430Z
CVE-2023-37207 
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
Problem types: description: Fullscreen notification obscured
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Shaheen Fazim
Published: 2023-07-05T08:52:52.315Z
CVE-2023-37208 
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
Problem types: description: Lack of warning when opening Diagcab files
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: P Umar Farooq
Published: 2023-07-05T08:54:19.005Z
CVE-2023-37209 
A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that object remained.  This resulted in a potentially exploitable condition when the reference to that object was later reused. This vulnerability affects Firefox < 115.
Problem types: description: Use-after-free in `NotifyOnHistoryReload`
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Simon Descarpentries
Published: 2023-07-05T09:05:08.334Z
CVE-2023-37210 
A website could prevent a user from exiting full-screen mode via alert and prompt calls.  This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.
Problem types: description: Full-screen mode exit prevention
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Hafiizh
Published: 2023-07-05T09:05:30.754Z
CVE-2023-37211 
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
Problem types: description: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Andrew McCreight, Matthew Gaudet, Tom Ritter, and the Mozilla Fuzzing Team,
Published: 2023-07-05T09:00:58.955Z
CVE-2023-37212 
Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115.
Problem types: description: Memory safety bugs fixed in Firefox 115
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Andrew McCreight, and the Mozilla Fuzzing Team
Published: 2023-07-05T09:05:53.775Z