stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-43498 (severity: HIGH, weakness: CWE-377)
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
CVE-2023-43499 (severity: MEDIUM, weakness: CWE-79)
Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.
CVE-2023-4350 (severity: MEDIUM, weakness: NVD-CWE-Other)
Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
CVE-2023-43500 (severity: HIGH, weakness: CWE-352)
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.
CVE-2023-43501 (severity: MEDIUM, weakness: CWE-862)
A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
CVE-2023-43502 (severity: MEDIUM, weakness: CWE-352)
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.
CVE-2023-43503 (severity: HIGH, weakness: CWE-319)
A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and project information in cleartext via UDP.
CVE-2023-43504 (severity: CRITICAL, weakness: CWE-120)
A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affected application is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition.
CVE-2023-43505 (severity: MEDIUM, weakness: CWE-284)
A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in SMB shares. This could allow an attacker to access files that the user should not have access to.
CVE-2023-43506 (severity: HIGH, weakness: CWE-269)
A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role. A successful exploit allows malicious users to execute arbitrary code with root level privileges on the Linux instance.
CVE-2023-43507 (severity: HIGH, weakness: CWE-89)
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster.
CVE-2023-43508 (severity: MEDIUM, weakness: CWE-863)
Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of these vulnerabilities allow an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform.
CVE-2023-43509 (severity: MEDIUM, weakness: CWE-79)
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.
CVE-2023-4351 (severity: HIGH, weakness: CWE-416)
Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-43510 (severity: MEDIUM, weakness: CWE-77)
A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a non-privileged user on the underlying operating system leading to partial system compromise.
CVE-2023-43511 (severity: HIGH, weakness: CWE-835)
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
CVE-2023-43512 (severity: HIGH, weakness: CWE-126)
Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
CVE-2023-43513 (severity: HIGH, weakness: CWE-823)
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
CVE-2023-43514 (severity: HIGH, weakness: CWE-416)
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
CVE-2023-43515 (severity: HIGH, weakness: CWE-120)
Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.
CVE-2023-43516 (severity: HIGH, weakness: CWE-823)
Memory corruption when malformed message payload is received from firmware.
CVE-2023-43517 (severity: HIGH, weakness: CWE-284)
Memory corruption in Automotive Multimedia due to improper access control in HAB.
CVE-2023-43518 (severity: CRITICAL, weakness: CWE-822)
Memory corruption in video while parsing invalid mp2 clip.
CVE-2023-43519 (severity: CRITICAL, weakness: CWE-120)
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
CVE-2023-4352 (severity: HIGH, weakness: CWE-843)
Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-43520 (severity: CRITICAL, weakness: CWE-121)
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
CVE-2023-43521 (severity: HIGH, weakness: CWE-416)
Memory corruption when multiple listeners are being registered with the same file descriptor.
CVE-2023-43522 (severity: HIGH, weakness: CWE-476)
Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
CVE-2023-43523 (severity: HIGH, weakness: CWE-617)
Transient DOS while processing 11AZ RTT management action frame received through OTA.
CVE-2023-43524 (severity: HIGH, weakness: CWE-120)
Memory corruption when the bandpass filter order received from AHAL is not within the expected range.
CVE-2023-43525 (severity: HIGH, weakness: CWE-120)
Memory corruption while copying the sound model data from user to kernel buffer during sound model register.
CVE-2023-43526 (severity: HIGH, weakness: CWE-120)
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
CVE-2023-43527 (severity: MEDIUM, weakness: CWE-126)
Information disclosure while parsing dts header atom in Video.
CVE-2023-43528 (severity: MEDIUM, weakness: CWE-126)
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
CVE-2023-43529 (severity: HIGH, weakness: CWE-617)
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.
CVE-2023-4353 (severity: HIGH, weakness: CWE-787)
Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-43530 (severity: HIGH, weakness: CWE-190)
Memory corruption in HLOS while checking for the storage type.
CVE-2023-43531 (severity: HIGH, weakness: CWE-824)
Memory corruption while verifying the serialized header when the key pairs are generated.
CVE-2023-43532 (severity: HIGH, weakness: CWE-822)
Memory corruption while reading ACPI config through the user mode app.
CVE-2023-43533 (severity: HIGH, weakness: CWE-126)
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
CVE-2023-43534 (severity: CRITICAL, weakness: CWE-823)
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
CVE-2023-43535 (severity: HIGH, weakness: CWE-129)
Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.
CVE-2023-43536 (severity: HIGH, weakness: CWE-126)
Transient DOS while parse fils IE with length equal to 1.
CVE-2023-43537 (severity: HIGH, weakness: CWE-126)
Information disclosure while handling T2LM Action Frame in WLAN Host.
CVE-2023-43538 (severity: HIGH, weakness: CWE-120)
Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.
CVE-2023-43539 (severity: HIGH, weakness: CWE-126)
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
CVE-2023-4354 (severity: HIGH, weakness: CWE-787)
Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-43540 (severity: HIGH, weakness: CWE-120)
Memory corruption while processing the IOCTL FM HCI WRITE request.
CVE-2023-43541 (severity: HIGH, weakness: CWE-476)
Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render.
CVE-2023-43542 (severity: HIGH, weakness: CWE-120)
Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.
CVE-2023-43543 (severity: HIGH, weakness: CWE-416)
Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object.
CVE-2023-43544 (severity: HIGH, weakness: CWE-416)
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
CVE-2023-43545 (severity: HIGH, weakness: CWE-190)
Memory corruption when more scan frequency list or channels are sent from the user space.
CVE-2023-43546 (severity: HIGH, weakness: CWE-416)
Memory corruption while invoking HGSL IOCTL context create.
CVE-2023-43547 (severity: HIGH, weakness: CWE-416)
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
CVE-2023-43548 (severity: CRITICAL, weakness: CWE-120)
Memory corruption while parsing qcp clip with invalid chunk data size.
CVE-2023-43549 (severity: HIGH, weakness: CWE-121)
Memory corruption while processing TPC target power table in FTM TPC.
CVE-2023-4355 (severity: HIGH, weakness: CWE-787)
Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-43550 (severity: HIGH, weakness: CWE-190)
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
CVE-2023-43551 (severity: HIGH, weakness: CWE-287)
Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
CVE-2023-43552 (severity: CRITICAL, weakness: CWE-416)
Memory corruption while processing MBSSID beacon containing several subelement IE.
CVE-2023-43553 (severity: CRITICAL, weakness: CWE-823)
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
CVE-2023-43554 (severity: HIGH, weakness: CWE-119)
Memory corruption while processing IOCTL handler in FastRPC.
CVE-2023-43555 (severity: HIGH, weakness: CWE-126)
Information disclosure in Video while parsing mp2 clip with invalid section length.
CVE-2023-43556 (severity: HIGH, weakness: CWE-120)
Memory corruption in Hypervisor when platform information mentioned is not aligned.
CVE-2023-4356 (severity: HIGH, weakness: CWE-416)
Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-43566 (severity: MEDIUM, weakness: CWE-79)
In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration
CVE-2023-43567 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-43568 (severity: MEDIUM, weakness: CWE-126)
A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.
CVE-2023-43569 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-4357 (severity: HIGH, weakness: CWE-20)
Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-43570 (severity: MEDIUM, weakness: CWE-20)
A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute arbitrary code.
CVE-2023-43571 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-43572 (severity: MEDIUM, weakness: CWE-126)
A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.
CVE-2023-43573 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-43574 (severity: MEDIUM, weakness: CWE-126)
A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.
CVE-2023-43575 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-43576 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-43577 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-43578 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-43579 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-4358 (severity: HIGH, weakness: CWE-416)
Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-43580 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-43581 (severity: MEDIUM, weakness: CWE-120)
A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVE-2023-43582 (severity: HIGH, weakness: CWE-939)
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.
CVE-2023-43583 (severity: MEDIUM, weakness: CWE-798)
Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information via network access.
CVE-2023-43585 (severity: MEDIUM, weakness: CWE-449)
Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access.
CVE-2023-43586 (severity: HIGH, weakness: CWE-426)
Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access.
CVE-2023-43588 (severity: MEDIUM, weakness: CWE-449)
Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access.
CVE-2023-4359 (severity: MEDIUM, weakness: NVD-CWE-Other)
Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the security UI via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-43590 (severity: HIGH, weakness: CWE-59)
Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
CVE-2023-43591 (severity: HIGH, weakness: CWE-280)
Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
CVE-2023-4360 (severity: MEDIUM, weakness: NVD-CWE-Other)
Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-43608 (severity: HIGH, weakness: CWE-494)
A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.
CVE-2023-43609 (severity: CRITICAL, weakness: CWE-285)
In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could obtain access to sensitive information or cause a denial-of-service condition.
CVE-2023-4361 (severity: MEDIUM, weakness: NVD-CWE-Other)
Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-43610 (severity: HIGH, weakness: CWE-89)
SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority) or higher privilege to perform unintended database operations.
CVE-2023-43611 (severity: HIGH, weakness: CWE-347)
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2023-43612 (severity: HIGH, weakness: CWE-281)
in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions.
CVE-2023-43614 (severity: MEDIUM, weakness: CWE-79)
Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.
CVE-2023-43615 (severity: HIGH, weakness: CWE-120)
Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.
CVE-2023-43616 (severity: MEDIUM, weakness: CWE-22)
An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.
CVE-2023-43617 (severity: MEDIUM, weakness: CWE-200)
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.
CVE-2023-43618 (severity: MEDIUM, weakness: CWE-311)
An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message.
CVE-2023-43619 (severity: HIGH, weakness: CWE-434)
An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file.
CVE-2023-4362 (severity: HIGH, weakness: CWE-787)
Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-43620 (severity: HIGH, weakness: CWE-116)
An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver.
CVE-2023-43621 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.
CVE-2023-43622 (severity: HIGH, weakness: CWE-400)
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
CVE-2023-43623 (severity: MEDIUM, weakness: CWE-203)
A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions < V5.4.0), Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.3), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.3), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.4.0). Applications using the affected module are vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users.