yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-42531: Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on starting activities from the background.
Key phrases: bypass restrictions, bypass restrictions on starting activities from the background, improper access control
CVE-2023-42532: Improper Certificate Validation in FotaAgent prior to SMR Nov-2023 Release1 allows remote attacker to intercept the network traffic including Firmware information.
Key phrases: intercept the network traffic including Firmware information, improper certificate validation
CVE-2023-42533: Improper Input Validation with USB Gadget Interface prior to SMR Nov-2023 Release 1 allows a physical attacker to execute arbitrary code in Kernel.
Key phrases: execute arbitrary code, execute arbitrary code in Kernel, improper input validation
CVE-2023-42534: Improper input validation vulnerability in ChooserActivity prior to SMR Nov-2023 Release 1 allows local attackers to read arbitrary files with system privilege.
Key phrases: read arbitrary files, read arbitrary files with system privilege, improper input validation
CVE-2023-42535: Out-of-bounds Write in read_block of vold prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write
CVE-2023-42536: An improper input validation in saped_dec in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write.
Key phrases: cause out-of-bounds read and, out-of-bounds read and write, improper input validation, out of bounds read
CVE-2023-42537: An improper input validation in get_head_crc in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write.
Key phrases: cause out-of-bounds read and, out-of-bounds read and write, improper input validation, out of bounds read
CVE-2023-42538: An improper input validation in saped_rec_silence in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write.
Key phrases: cause out-of-bounds read and, out-of-bounds read and write, improper input validation, out of bounds read
CVE-2023-42539: PendingIntent hijacking vulnerability in ChallengeNotificationManager in Samsung Health prior to version 6.25 allows local attackers to access data.
Key phrases: access data, pendingintent hijacking
CVE-2023-4254: The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2023-42540: Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive information via implicit intent.
Key phrases: access sensitive information via implicit intent, improper access control
CVE-2023-42541: Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.
Key phrases: access unique id., improper authorization
CVE-2023-42542: Improper access control vulnerability in Samsung Push Service prior to 3.4.10 allows local attackers to get register ID to identify the device.
Key phrases: get register ID to identify the device, improper access control
CVE-2023-42543: Improper verification of intent by broadcast receiver vulnerability in Bixby Voice prior to version 3.3.35.12 allows attackers to access arbitrary data with Bixby Voice privilege.
Key phrases: access arbitrary data, access arbitrary data with Bixby Voice privilege, improper verification of intent by broadcast receiver
CVE-2023-42544: Improper access control vulnerability in Quick Share prior to 13.5.52.0 allows local attacker to access local files.
Key phrases: access local files, improper access control
CVE-2023-42545: Use of implicit intent for sensitive communication vulnerability in Phone prior to versions 12.7.20.12 in Android 11, 13.1.48, 13.5.28 in Android 12, and 14.7.38 in Android 13 allows attackers to access location data.
Key phrases: access location data, implicit intent, sensitive communication
CVE-2023-42546: Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
Key phrases: access arbitrary file, access arbitrary file with Samsung Account privilege, implicit intent for sensitive communication
CVE-2023-42547: Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
Key phrases: access arbitrary file, access arbitrary file with Samsung Account privilege, implicit intent for sensitive communication
CVE-2023-42548: Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
Key phrases: access arbitrary file, access arbitrary file with Samsung Account privilege, implicit intent, sensitive communication
CVE-2023-42549: Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
Key phrases: access arbitrary file, access arbitrary file with Samsung Account privilege, implicit intent for sensitive communication
CVE-2023-4255: An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition.
Key phrases: out-of-bounds write issue, application crashes, denial of service condition, out of bounds write
CVE-2023-42550: Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
Key phrases: access arbitrary file, access arbitrary file with Samsung Account privilege, implicit intent for sensitive communication
CVE-2023-42551: Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege.
Key phrases: access arbitrary file, access arbitrary file with Samsung Account privilege, implicit intent for sensitive communication
CVE-2023-42552: Implicit intent hijacking vulnerability in Firewall application prior to versions 12.1.00.24 in Android 11, 13.1.00.16 in Android 12 and 14.1.00.7 in Android 13 allows 3rd party application to tamper the database of Firewall.
Key phrases: tamper the database of Firewall, implicit intent hijacking
CVE-2023-42553: Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email.
Key phrases: read sandbox data of email, improper authorization verification
CVE-2023-42554: Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication.
Key phrases: bypass authentication, improper authentication vulnerabiity
CVE-2023-42555: Use of implicit intent for sensitive communication vulnerability in EasySetup prior to version 11.1.13 allows attackers to get the bluetooth address of user device.
Key phrases: get the bluetooth address of user device, implicit intent, sensitive communication
CVE-2023-42556: Improper usage of implicit intent in Contacts prior to SMR Dec-2023 Release 1 allows attacker to get sensitive information.
Key phrases: get sensitive information, improper usage of implicit intent
CVE-2023-42557: Out-of-bound write vulnerability in libIfaaCa prior to SMR Dec-2023 Release 1 allows local system attackers to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bound write, out of bound write
CVE-2023-42558: Out of bounds write vulnerability in HDCP in HAL prior to SMR Dec-2023 Release 1 allows attacker to perform code execution.
Key phrases: perform code execution, out of bounds write
CVE-2023-42559: Improper exception management vulnerability in Knox Guard prior to SMR Dec-2023 Release 1 allows Knox Guard lock bypass via changing system time.
Key phrases: bypass via changing system time, Knox Guard lock bypass, Knox Guard lock bypass via changing system time, improper exception management
CVE-2023-4256: Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw enables a local attacker to initiate a Denial of Service (DoS) attack.
Key phrases: Denial of Service (DoS), double free, denial of service (dos)
CVE-2023-42560: Heap out-of-bounds write vulnerability in dec_mono_audb of libsavsac.so prior to SMR Dec-2023 Release 1 allows an attacker to execute arbitrary code.
Key phrases: execute arbitrary code, heap out-of-bounds write, out of bounds write
CVE-2023-42561: Heap out-of-bounds write vulnerability in bootloader prior to SMR Dec-2023 Release 1 allows a physical attacker to execute arbitrary code.
Key phrases: execute arbitrary code, heap out-of-bounds write, out of bounds write
CVE-2023-42562: Integer overflow vulnerability in detectionFindFaceSupportMultiInstance of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attacker to trigger heap overflow.
Key phrases: trigger heap overflow, integer overflow
CVE-2023-42563: Integer overflow vulnerability in landmarkCopyImageToNative of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attacker to trigger heap overflow.
Key phrases: trigger heap overflow, integer overflow
CVE-2023-42564: Improper access control in knoxcustom service prior to SMR Dec-2023 Release 1 allows attacker to send broadcast with system privilege.
Key phrases: send broadcast with system privilege, improper access control
CVE-2023-42565: Improper input validation vulnerability in Smart Clip prior to SMR Dec-2023 Release 1 allows local attackers with shell privilege to execute arbitrary code.
Key phrases: execute arbitrary code, improper input validation
CVE-2023-42566: Out-of-bound write vulnerability in libsavsvc prior to SMR Dec-2023 Release 1 allows local attackers to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bound write, out of bound write
CVE-2023-42567: Improper size check vulnerability in softsimd prior to SMR Dec-2023 Release 1 allows stack-based buffer overflow.
Key phrases: stack-based buffer overflow, improper size check, stack based buffer overflow
CVE-2023-42568: Improper access control vulnerability in SmartManagerCN prior to SMR Dec-2023 Release 1 allows local attackers to access arbitrary files with system privilege.
Key phrases: access arbitrary files, access arbitrary files with system privilege, improper access control
CVE-2023-42569: Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR Emoji.
Key phrases: read sandbox data of AR Emoji, improper authorization verification
CVE-2023-4257: Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.
Key phrases: unchecked user input length, buffer overflows
CVE-2023-42570: Improper access control vulnerability in KnoxCustomManagerService prior to SMR Dec-2023 Release 1 allows attacker to access device SIM PIN.
Key phrases: access device SIM PIN, improper access control
CVE-2023-42571: Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the Samsung Account password with SMS verification when user lost the device.
Key phrases: unlock the device remotely by resetting the Samsung, remote unlock
CVE-2023-42572: Implicit intent hijacking vulnerability in Samsung Account Web SDK prior to version 1.5.24 allows attacker to get sensitive information.
Key phrases: get sensitive information, implicit intent hijacking
CVE-2023-42573: PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data.
Key phrases: access data, pendingintent hijacking
CVE-2023-42574: Improper access control vulnerablility in GameHomeCN prior to version 4.2.60.2 allows local attackers to launch arbitrary activity in GameHomeCN.
Key phrases: launch arbitrary activity, launch arbitrary activity in GameHomeCN, improper access control vulnerablility
CVE-2023-42575: Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid flag setting.
Key phrases: bypass authentication, bypass authentication due to invalid flag setting, improper authentication
CVE-2023-42576: Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid exception handler.
Key phrases: bypass authentication, bypass authentication due to invalid exception handler, improper authentication
CVE-2023-42577: Improper Access Control in Samsung Voice Recorder prior to versions 21.4.15.01 in Android 12 and Android 13, 21.4.50.17 in Android 14 allows physical attackers to access Voice Recorder information on the lock screen.
Key phrases: access Voice Recorder information on the lock screen, improper access control
CVE-2023-42578: Improper handling of insufficient permissions or privileges vulnerability in Samsung Data Store prior to version 5.2.00.7 allows remote attackers to access location information without permission.
Key phrases: access location information without permission, insufficient permissions or privileges
CVE-2023-42579: Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middle attack.
Key phrases: access keystroke data using Man-in-, man-in-the-middle
CVE-2023-4258: In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
Key phrases: oob
CVE-2023-42580: Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to install APK from Galaxy Store.
Key phrases: execute JavaScript API to install APK from Galaxy, improper url validation
CVE-2023-42581: Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to access data.
Key phrases: execute JavaScript API to access data, improper url validation
CVE-2023-4259: Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.
Key phrases: buffer overflow
CVE-2023-4260: Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
Key phrases: buffer overflow
CVE-2023-4262: Possible buffer overflow in Zephyr mgmt subsystem when asserts are disabled
Key phrases: buffer overflow
CVE-2023-42627: Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, stored cross-site scripting (xss)
CVE-2023-42628: Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's Content text field.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML into a, stored cross-site scripting (xss)
CVE-2023-42629: Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, stored cross-site scripting (xss)
CVE-2023-4263: Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
Key phrases: buffer overflow
CVE-2023-42631: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42632: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42633: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42634: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42635: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42636: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42637: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42638: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42639: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-4264: Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.
Key phrases: potential buffer overflow
CVE-2023-42640: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42641: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42642: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42643: In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42644: In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42645: In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42646: In Ifaa service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42647: In Ifaa service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42648: In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42649: In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-4265: Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359  https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis... https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis.c#L841 
Key phrases: buffer overflow
CVE-2023-42650: In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42651: In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42652: In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42653: In faceid service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2023-42654: In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42655: In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed
Key phrases: missing permission check, local escalation of privilege, escalation privilege
CVE-2023-42656: In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting(XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payload targetingMOVEit Transfer users during the package composition procedure. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.
Key phrases: cross-site scripting(xss)
CVE-2023-42657: In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.
Key phrases: directory traversal
CVE-2023-42658: Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.
Key phrases: local command execution via maliciously crafted profile
CVE-2023-42659: In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified.  An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.
Key phrases: upload a file to a specified location on, file upload flaw, unrestricted file upload
CVE-2023-42660: In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interfacethat could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content.
Key phrases: gain unauthorized access, gain unauthorized access to the MOVEit Transfer database, sql injection, disclosure
CVE-2023-42661: JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.
Key phrases: arbitrary file write, dos, remote code execution
CVE-2023-42662: JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.
CVE-2023-42663: Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
Key phrases: read specific DAGs only
CVE-2023-42664: A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Key phrases: post authentication command injection, arbitrary command injection, arbitrary commands
CVE-2023-42666: The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attacker to create malicious requests for obtaining the information of the version about the web server used.
Key phrases: create malicious requests for obtaining the information of, exposure of sensitive information
CVE-2023-42669: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.
Key phrases: the "rpcecho" server to be blocked, service disruptions, dos, denial of service
CVE-2023-42670: A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as "The procedure number is out of range" when using tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
Key phrases: disrupt AD DC services, disruptions
CVE-2023-42671: In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42672: In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42673: In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42674: In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42675: In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42676: In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42677: In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42678: In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42679: In gpu driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2023-42680: In gpu driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2023-42681: In ion service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: missing permission check, local escalation of privilege, escalation privilege
CVE-2023-42682: In gsp driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2023-42683: In gsp driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2023-42684: In gsp driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2023-42685: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42686: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42687: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42688: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42689: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-4269: The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
Key phrases: perform such action and retrieve PII such as
CVE-2023-42690: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42691: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42692: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42693: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42694: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42695: In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42696: In telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Key phrases: permission check, local escalation of privilege, escalation privilege
CVE-2023-42697: In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42698: In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42699: In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-4270: The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Key phrases: reflected cross-site scripting
CVE-2023-42700: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42701: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42702: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42703: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42704: In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42705: In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42706: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42707: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42708: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42709: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-4271: The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the psres_button_size parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-42710: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42711: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42712: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42713: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42714: In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42715: In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42716: In telephony service, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed
Key phrases: permission check, remote information disclosure
CVE-2023-42717: In telephony service, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed
Key phrases: permission check, remote information disclosure
CVE-2023-42718: In dialer, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Key phrases: missing permission check, local information disclosure
CVE-2023-42719: In video service, there is a possible out of bounds read due to a incorrect bounds check. This could lead to local denial of service with no additional execution privileges needed
Key phrases: out of bounds read, incorrect bounds check, local denial of service
CVE-2023-4272: A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory. 
Key phrases: sensitive data, previously freed memory
CVE-2023-42720: In video service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2023-42721: In flv extractor, there is a possible missing verification incorrect input. This could lead to local denial of service with no additional execution privileges needed
Key phrases: missing verification incorrect input, local denial of service
CVE-2023-42722: In camera service, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed
Key phrases: use after free, logic error, local escalation of privilege, escalation privilege
CVE-2023-42723: In camera service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2023-42724: In gpu driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2023-42725: In gpu driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2023-42726: In TeleService, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2023-42727: In gpu driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds write, incorrect bounds check, local denial of service
CVE-2023-42728: In phasecheckserver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2023-42729: In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds write, missing bounds check, local denial of service