stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-28546 (severity: HIGH, weakness: CWE-120)
Memory Corruption in SPS Application while exporting public key in sorter TA.
CVE-2023-28547 (severity: HIGH, weakness: CWE-120)
Memory corruption in SPS Application while requesting for public key in sorter TA.
CVE-2023-28548 (severity: HIGH, weakness: CWE-129)
Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
CVE-2023-28549 (severity: HIGH, weakness: CWE-119)
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
CVE-2023-2855 (severity: MEDIUM, weakness: CWE-787)
Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
CVE-2023-28550 (severity: HIGH, weakness: CWE-119)
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
CVE-2023-28551 (severity: HIGH, weakness: CWE-119)
Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
CVE-2023-28553 (severity: MEDIUM, weakness: CWE-126)
Information Disclosure in WLAN Host when processing WMI event command.
CVE-2023-28554 (severity: MEDIUM, weakness: CWE-126)
Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
CVE-2023-28555 (severity: HIGH, weakness: CWE-126)
Transient DOS in Audio while remapping channel buffer in media codec decoding.
CVE-2023-28556 (severity: HIGH, weakness: CWE-285)
Cryptographic issue in HLOS during key management.
CVE-2023-28557 (severity: HIGH, weakness: CWE-129)
Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
CVE-2023-28558 (severity: HIGH, weakness: CWE-129)
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
CVE-2023-28559 (severity: HIGH, weakness: CWE-120)
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
CVE-2023-2856 (severity: MEDIUM, weakness: CWE-787)
VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
CVE-2023-28560 (severity: HIGH, weakness: CWE-120)
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
CVE-2023-28561 (severity: CRITICAL, weakness: CWE-120)
Memory corruption in QESL while processing payload from external ESL device to firmware.
CVE-2023-28562 (severity: CRITICAL, weakness: CWE-120)
Memory corruption while handling payloads from remote ESL.
CVE-2023-28563 (severity: MEDIUM, weakness: CWE-126)
Information disclosure in IOE Firmware while handling WMI command.
CVE-2023-28564 (severity: HIGH, weakness: CWE-823)
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
CVE-2023-28565 (severity: HIGH, weakness: CWE-129)
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
CVE-2023-28566 (severity: MEDIUM, weakness: CWE-126)
Information disclosure in WLAN HAL while handling the WMI state info command.
CVE-2023-28567 (severity: HIGH, weakness: CWE-129)
Memory corruption in WLAN HAL while handling command through WMI interfaces.
CVE-2023-28568 (severity: MEDIUM, weakness: CWE-126)
Information disclosure in WLAN HAL when reception status handler is called.
CVE-2023-28569 (severity: MEDIUM, weakness: CWE-126)
Information disclosure in WLAN HAL while handling command through WMI interfaces.
CVE-2023-2857 (severity: MEDIUM, weakness: CWE-787)
BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
CVE-2023-28570 (severity: HIGH, weakness: CWE-120)
Memory corruption while processing audio effects.
CVE-2023-28571 (severity: MEDIUM, weakness: CWE-126)
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
CVE-2023-28572 (severity: HIGH, weakness: CWE-126)
Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
CVE-2023-28573 (severity: HIGH, weakness: CWE-129)
Memory corruption in WLAN HAL while parsing WMI command parameters.
CVE-2023-28574 (severity: HIGH, weakness: CWE-20)
Memory corruption in core services when Diag handler receives a command to configure event listeners.
CVE-2023-28575 (severity: HIGH, weakness: CWE-823)
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
CVE-2023-28576 (severity: HIGH, weakness: CWE-367)
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues.
CVE-2023-28577 (severity: HIGH, weakness: CWE-416)
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.
CVE-2023-28578 (severity: HIGH, weakness: CWE-20)
Memory corruption in Core Services while executing the command for removing a single event listener.
CVE-2023-28579 (severity: HIGH, weakness: CWE-120)
Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.
CVE-2023-2858 (severity: MEDIUM, weakness: CWE-787)
NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
CVE-2023-28580 (severity: HIGH, weakness: CWE-120)
Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
CVE-2023-28581 (severity: CRITICAL, weakness: CWE-119)
Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.
CVE-2023-28582 (severity: CRITICAL, weakness: CWE-120)
Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.
CVE-2023-28583 (severity: HIGH, weakness: CWE-415)
Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
CVE-2023-28584 (severity: HIGH, weakness: CWE-285)
Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
CVE-2023-28585 (severity: HIGH, weakness: CWE-680)
Memory corruption while loading an ELF segment in TEE Kernel.
CVE-2023-28586 (severity: MEDIUM, weakness: CWE-119)
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
CVE-2023-28587 (severity: HIGH, weakness: CWE-119)
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
CVE-2023-28588 (severity: HIGH, weakness: CWE-190)
Transient DOS in Bluetooth Host while rfc slot allocation.
CVE-2023-2859 (severity: HIGH, weakness: CWE-94)
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVE-2023-28596 (severity: HIGH, weakness: CWE-427)
Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.
CVE-2023-28597 (severity: HIGH, weakness: CWE-501)
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.
CVE-2023-28598 (severity: MEDIUM, weakness: CWE-79)
Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash.
CVE-2023-28599 (severity: MEDIUM, weakness: CWE-79)
Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation.
CVE-2023-2860 (severity: MEDIUM, weakness: CWE-125)
An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. The flaw exists within the processing of seg6 attributes. The issue results from the improper validation of user-supplied data, which can result in a read past the end of an allocated buffer. This flaw allows a privileged local user to disclose sensitive information on affected installations of the Linux kernel.
CVE-2023-28600 (severity: MEDIUM, weakness: CWE-378)
Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files potentially causing a loss of integrity and availability to the Zoom Client.
CVE-2023-28601 (severity: MEDIUM, weakness: CWE-358)
Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client.
CVE-2023-28602 (severity: HIGH, weakness: CWE-347)
Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions.
CVE-2023-28603 (severity: HIGH, weakness: CWE-73)
Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.
CVE-2023-28604 (severity: MEDIUM, weakness: CWE-79)
The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases that may be edge cases.
CVE-2023-28606 (severity: MEDIUM, weakness: CWE-79)
js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.
CVE-2023-28607 (severity: MEDIUM, weakness: CWE-79)
js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.
CVE-2023-28609 (severity: CRITICAL, weakness: CWE-287)
api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.
CVE-2023-2861 (severity: HIGH, weakness: CWE-284)
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.
CVE-2023-28610 (severity: CRITICAL, weakness: CWE-347)
The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image. This allows a remote attacker to gain root access to the system.
CVE-2023-28611 (severity: CRITICAL, weakness: CWE-863)
Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions.
CVE-2023-28613 (severity: CRITICAL, weakness: CWE-190)
An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300. An integer overflow in IPv4 fragment handling can occur due to insufficient parameter validation when reassembling these fragments.
CVE-2023-28614 (severity: CRITICAL, weakness: CWE-78)
Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page.
CVE-2023-28616 (severity: HIGH, weakness: CWE-319)
An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component.
CVE-2023-28617 (severity: HIGH, weakness: CWE-78)
org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.
CVE-2023-28618 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.
CVE-2023-2862 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file /api/stl/actions/search. The manipulation of the argument ajaxDivId leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-229818 is the identifier assigned to this vulnerability.
CVE-2023-28620 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cyberus Labs Cyberus Key plugin <= 1.0 versions.
CVE-2023-28621 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wishfulthemes Raise Mag, Wishfulthemes Wishful Blog themes allows Reflected XSS.This issue affects Raise Mag: from n/a through 1.0.7; Wishful Blog: from n/a through 2.0.1.
CVE-2023-28622 (severity: MEDIUM, weakness: CWE-79)
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Trident Technolabs Easy Slider Revolution plugin <= 1.0.0 versions.
CVE-2023-28623 (severity: LOW, weakness: CWE-285)
Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only ones enabled in `AUTHENTICATION_BACKENDS` in `/etc/zulip/settings.py` and 2: The organization permissions don't require invitations to join. An attacker can create a new account in the organization with an arbitrary email address in their control that's not in the organization's LDAP directory. The impact is limited to installations which have this specific combination of authentication backends as described above in addition to having `Invitations are required for joining this organization` organization permission disabled. This issue has been addressed in version 6.2. Users are advised to upgrade. Users unable to upgrade may enable the `Invitations are required for joining this organization` organization permission to prevent this issue.
CVE-2023-28625 (severity: HIGH, weakness: CWE-476)
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.
CVE-2023-28626 (severity: HIGH, weakness: CWE-400)
comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047`
CVE-2023-28627 (severity: HIGH, weakness: CWE-78)
pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-28628 (severity: MEDIUM, weakness: CWE-706)
lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in question doesn't handle the backslash (`\`) character in the username correctly, leading to a wrong output. ex. a payload of `https://example.com\\@google.com` would return that the host is `google.com`, but the correct host should be `example.com`. Given that the library returns the wrong authority this may be abused to bypass host restrictions depending on how the library is used in an application. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-28629 (severity: MEDIUM, weakness: CWE-79)
GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that has permissions to configure GoCD pipelines could include JavaScript elements within the label template, causing a XSS vulnerability to be triggered for any users viewing the Value Stream Map or Job Details for runs of the affected pipeline, potentially allowing them to perform arbitrary actions within the victim's browser context rather than their own. This issue has been fixed in GoCD 23.1.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-2863 (severity: MEDIUM, weakness: CWE-313)
A vulnerability has been found in Simple Design Daily Journal 1.012.GP.B on Android and classified as problematic. Affected by this vulnerability is an unknown functionality of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229819.
CVE-2023-28630 (severity: MEDIUM, weakness: CWE-532)
GoCD is an open source continuous delivery server. In GoCD versions from 20.5.0 and below 23.1.0, if the server environment is not correctly configured by administrators to provide access to the relevant PostgreSQL or MySQL backup tools, the credentials for database access may be unintentionally leaked to admin alerts on the GoCD user interface. The vulnerability is triggered only if the GoCD server host is misconfigured to have backups enabled, but does not have access to the `pg_dump` or `mysqldump` utility tools to backup the configured database type (PostgreSQL or MySQL respectively). In such cases, failure to launch the expected backup utility reports the shell environment used to attempt to launch in the server admin alert, which includes the plaintext database password supplied to the configured tool. This vulnerability does not affect backups of the default on-disk H2 database that GoCD is configured to use. This issue has been addressed and fixed in GoCD 23.1.0. Users are advised to upgrade. Users unable to upgrade may disable backups, or administrators should ensure that the required `pg_dump` (PostgreSQL) or `mysqldump` (MySQL) binaries are available on the GoCD server when backups are triggered.
CVE-2023-28631 (severity: CRITICAL, weakness: CWE-755)
comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A Comrak AST can be constructed manually by a program instead of parsing a Markdown document with `parse_document`. This AST can then be converted to HTML via `html::format_document_with_plugins`. However, the HTML formatting code assumes that the AST is well-formed. For example, many AST notes contain `[u8]` fields which the formatting code assumes is valid UTF-8 data. Several bugs can be triggered if this is not the case. Version 0.17.0 contains adjustments to the AST, storing strings instead of unvalidated byte arrays. Users are advised to upgrade. Users unable to upgrade may manually validate UTF-8 correctness of all data when assigning to `&[u8]` and `Vec<u8>` fields in the AST. This issue is also tracked as `GHSL-2023-049`.
CVE-2023-28632 (severity: HIGH, weakness: CWE-269)
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to `Forgotten password?` event. However, it will not prevent unauthorized modification of any user emails.
CVE-2023-28633 (severity: MEDIUM, weakness: CWE-918)
GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
CVE-2023-28634 (severity: HIGH, weakness: CWE-285)
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
CVE-2023-28635 (severity: MEDIUM, weakness: CWE-863)
vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for example, if user id 13 is allowed to run tasks, and an attacker creates a username with username '13', they would be wrongly allowed to run an algorithm. There may also be other places in the code where such a mixup of resource ID or name leads to issues. Version 4.0.0 contains a patch for this issue. The best solution is to check when resources are created or modified, that the resource name always starts with a character.
CVE-2023-28636 (severity: MEDIUM, weakness: CWE-79)
GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7.
CVE-2023-28637 (severity: HIGH, weakness: CWE-74)
DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to remote code execution. This vulnerability has been fixed in v1.18.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.