rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-40601 WordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Estatik
product: Estatik Mortgage Calculator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: thiennv (Patchstack Alliance)
Published: 2023-09-06T08:45:41.448Z
CVE-2023-40602 WordPress Doofinder for WooCommerce Plugin <= 1.5.49 is vulnerable to Open Redirection
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 1.5.49.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Doofinder
product: Doofinder WP & WooCommerce Search
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: minhtuanact (Patchstack Alliance)
Published: 2023-12-19T19:54:43.220Z
CVE-2023-40603 WordPress Simple Org Chart plugin <= 2.3.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Gangesh Matta Simple Org Chart.This issue affects Simple Org Chart: from n/a through 2.3.4.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Gangesh Matta
product: Simple Org Chart
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Abdi Pranata (Patchstack Alliance)
Published: 2024-06-12T09:51:54.422Z
CVE-2023-40604 WordPress Cookies by JM Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jes Madsen Cookies by JM plugin <= 1.0 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Jes Madsen
product: Cookies by JM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Nithissh S (Patchstack Alliance)
Published: 2023-09-27T05:18:30.166Z
CVE-2023-40605 WordPress Typing Effect Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor) Cross-Site Scripting (XSS) vulnerability in 93digital Typing Effect plugin <= 1.3.6 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: 93digital
product: Typing Effect
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: yuyudhn (Patchstack Alliance)
Published: 2023-09-27T05:31:37.272Z
CVE-2023-40606 WordPress Kanban Boards for WordPress Plugin <= 2.5.21 is vulnerable to Arbitrary Code Execution
Improper Control of Generation of Code ('Code Injection') vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Kanban for WordPress
product: Kanban Boards for WordPress
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: TomS (Patchstack Alliance)
Published: 2023-12-29T08:59:57.593Z
CVE-2023-40607 WordPress CLUEVO LMS, E-Learning Platform Plugin <= 1.10.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in CLUEVO CLUEVO LMS, E-Learning Platform plugin <= 1.10.0 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: CLUEVO
product: CLUEVO LMS, E-Learning Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Debangshu Kundu & Arpeet Rathi (Patchstack Alliance)
Published: 2023-10-06T14:51:15.772Z
CVE-2023-40608 WordPress Paid Memberships Pro CCBill Gateway plugin <= 0.3 - Unauthenticated Broken Access Control vulnerability
Missing Authorization vulnerability in Paid Memberships Pro Paid Memberships Pro CCBill Gateway.This issue affects Paid Memberships Pro CCBill Gateway: from n/a through 0.3.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Paid Memberships Pro
product: Paid Memberships Pro CCBill Gateway
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2024-06-19T11:51:46.618Z
CVE-2023-40609 WordPress Contact form 7 Custom validation Plugin <= 1.1.3 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aiyaz, maheshpatel Contact form 7 Custom validation allows SQL Injection.This issue affects Contact form 7 Custom validation: from n/a through 1.1.3.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Aiyaz, maheshpatel
product: Contact form 7 Custom validation
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: minhtuanact (Patchstack Alliance)
Published: 2023-11-06T08:15:24.225Z
CVE-2023-40610 Apache Superset: Privilege escalation with default examples database
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Apache Software Foundation
product: Apache Superset
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: LEXFO for Orange Innovation and Orange CERT-CC  at Orange group
Published: 2023-11-27T10:22:41.083Z
CVE-2023-40611 Apache Airflow Dag Runs Broken Access Control Vulnerability
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
default_status: unaffected
Credits: lang: en
value: happyhacking
Published: 2023-09-12T11:05:22.841Z
CVE-2023-40612 Authenticated XXE Injection Via The File Editor
In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
Problem types: cwe_id: CWE-91
description: CWE-91 XML Injection (aka Blind XPath Injection)
Affected products: vendor: The OpenNMS Group
product: Horizon
default_status: unaffected
vendor: The OpenNMS Group
product: Meridian
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Credits: lang: en
value: Erik Wynter
Published: 2023-08-23T18:22:49.025Z
CVE-2023-40617 
A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start 7 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'file' parameter in 'displayPDF.php'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-13T00:00:00.000Z
CVE-2023-40618 
A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Visual Project Explorer 1.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'service' parameter in 'headstart_snapshot.php'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-40619 
phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-40621 Code Injection vulnerability in SAP PowerDesigner Client
SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. The application has a security option to disable or prompt users before untrusted scripts are executed, but this is not set as default.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: SAP_SE
product: SAP PowerDesigner Client
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-09-12T02:10:22.051Z
CVE-2023-40622 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: SAP_SE
product: SAP BusinessObjects Business Intelligence Platform (Promotion Management)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-09-12T02:03:05.907Z
CVE-2023-40623 Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)
SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the operating system files causing a limited impact on integrity and completely compromising the availability of the system.


Problem types: cwe_id: CWE-1386
description: CWE-1386: Insecure Operation on Windows Junction / Mount Point
Affected products: vendor: SAP_SE
product: SAP BusinessObjects Suite (Installer)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H
version: 3.1
Published: 2023-09-12T02:02:38.194Z
CVE-2023-40624 Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering)
SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can be executed in the web-application. An attacker could thereby control the behavior of this web-application.


Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: SAP_SE
product: SAP NetWeaver AS ABAP (applications based on Unified Rendering)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-09-12T02:00:30.824Z
CVE-2023-40625 Missing Authorization check in SAP Manage Purchase Contracts App
S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and integrity with no impact on availibility of the system.


Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: SAP_SE
product: SAP Manage Purchase Contracts App
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2023-09-12T02:00:13.727Z
CVE-2023-40626 [20231101] - Core - Exposure of environment variables
The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
Problem types: description: Information Disclosure
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Published: 2023-11-29T12:28:47.787Z
CVE-2023-40627 Extension - MLWebTechnologies - Reflected XSS in LivingWord component for Joomla 1.0.0-3.0.0
A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: https://github.com/MLWebTechnologies
product: LivingWord component for Joomla
default_status: unaffected
Credits: lang: en
value: Vishal Saini and Siva Pothuluru S (Team Payatu)
Published: 2023-12-14T08:52:05.011Z
CVE-2023-40628 Extension - Extplorer.net - Reflected XSS in Extplorer component for Joomla 1.0.0-2.1.15
A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Extplorer.net
product: Extplorer component for Joomla
default_status: unaffected
Credits: lang: en
value: Vishal Saini and Siva Pothuluru S (Team Payatu)
Published: 2023-12-14T08:52:00.887Z
CVE-2023-40629 Extension - king-products.net - SQLi vulnerability in LMS Lite component for Joomla 1.0.0-3.3.0.1
SQLi vulnerability in LMS Lite component for Joomla.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: king-products.net
product: LMS Lite component for Joomla
default_status: unaffected
Credits: lang: en
value: Sai Krishna P and Siva Pothuluru S
Published: 2023-12-14T08:52:00.533Z
CVE-2023-40630 Extension - joomcode.com - Unauthenticated LFI/SSRF in JCDashboards component for Joomla 1.0.0-1.1.30
Unauthenticated LFI/SSRF in JCDashboards component for Joomla.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery
Affected products: vendor: joomcode.com
product: JCDashboards component for Joomla
default_status: unaffected
Credits: lang: en
value: Vishal Saini and Siva Pothuluru S (Team Payatu)
Published: 2023-12-14T08:51:55.669Z
CVE-2023-40631 
In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-10-08T03:35:57.807Z
CVE-2023-40632 
In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execution privileges needed
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: T606/T612/T616
default_status: unaffected
Published: 2023-10-08T03:35:58.116Z
CVE-2023-40633 
In phasecheckserver, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-10-08T03:35:58.412Z
CVE-2023-40634 
In phasechecksercer, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-10-08T03:35:58.711Z
CVE-2023-40635 
In linkturbo, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-10-08T03:35:59.024Z
CVE-2023-40636 
In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with System execution privileges needed
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: T760/T770/T820/S8000
default_status: unaffected
Published: 2023-10-08T03:35:59.325Z
CVE-2023-40637 
In telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-10-08T03:35:59.619Z
CVE-2023-40638 
In Telecom service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: T760/T770/T820/S8000
default_status: unaffected
Published: 2023-10-08T03:35:59.919Z
CVE-2023-40639 
In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-10-08T03:36:00.240Z
CVE-2023-40640 
In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-10-08T03:36:00.549Z
CVE-2023-40641 
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A
default_status: unaffected
Published: 2023-10-08T03:36:00.842Z
CVE-2023-40642 
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A
default_status: unaffected
Published: 2023-10-08T03:36:01.134Z
CVE-2023-40643 
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A
default_status: unaffected
Published: 2023-10-08T03:36:01.449Z