yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-43505: A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in SMB shares. This could allow an attacker to access files that the user should not have access to.
Key phrases: access files that the user should not have
CVE-2023-43506: A vulnerability in the ClearPass OnGuard Linux agent couldallow malicious users on a Linux instance to elevate theiruser privileges to those of a higher role. A successfulexploit allows malicious users to execute arbitrary codewith root level privileges on the Linux instance.
Key phrases: execute arbitrary codewith root level privileges, execute arbitrary codewith root level privileges on the
CVE-2023-43507: A vulnerability in the web-based management interface ofClearPass Policy Manager could allow an authenticatedremote attacker to conduct SQL injection attacks againstthe ClearPass Policy Manager instance. An attacker couldexploit this vulnerability to obtain and modify sensitiveinformation in the underlying database potentially leadingto complete compromise of the ClearPass Policy Managercluster.
Key phrases: obtain and modify sensitiveinformation, conduct SQL injection attacks againstthe ClearPass Policy Manager, sql injection, complete compromise
CVE-2023-43508: Vulnerabilities in the web-based management interface ofClearPass Policy Manager allow an attacker with read-onlyprivileges to perform actions that change the state of theClearPass Policy Manager instance. Successful exploitationof these vulnerabilities allow an attacker to completestate-changing actions in the web-based management interfacethat should not be allowed by their current level ofauthorization on the platform.
Key phrases: perform actions that change the state of theClearPass, completestate-changing actions in the web-
CVE-2023-43509: A vulnerability in the web-based management interface ofClearPass Policy Manager could allow an unauthenticatedremote attacker to send notifications to computers that arerunning ClearPass OnGuard. These notifications can then beused to phish users or trick them into downloading malicioussoftware.
Key phrases: send notifications to computers that arerunning ClearPass OnGuard
CVE-2023-4351: Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: use after free, browser shutdown, heap corruption
CVE-2023-43510: A vulnerability in the ClearPass Policy Manager web-basedmanagement interface allows remote authenticated users torun arbitrary commands on the underlying host. A successfulexploit could allow an attacker to execute arbitrarycommands as a non-privileged user on the underlyingoperating system leading to partial system compromise.
Key phrases: torun arbitrary commands, execute arbitrarycommands as a non-privileged user, partial system compromise
CVE-2023-43511: Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
Key phrases: transient dos
CVE-2023-43512: Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
Key phrases: transient dos
CVE-2023-43513: Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Key phrases: memory corruption
CVE-2023-43514: Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
Key phrases: memory corruption
CVE-2023-43515: Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.
Key phrases: memory corruption
CVE-2023-43516: Memory corruption when malformed message payload is received from firmware.
Key phrases: memory corruption, malformed message payload
CVE-2023-43517: Memory corruption in Automotive Multimedia due to improper access control in HAB.
Key phrases: memory corruption, improper access control
CVE-2023-43518: Memory corruption in video while parsing invalid mp2 clip.
Key phrases: memory corruption
CVE-2023-43519: Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
Key phrases: memory corruption
CVE-2023-4352: Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: type confusion, heap corruption
CVE-2023-43520: Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
Key phrases: memory corruption
CVE-2023-43522: Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
Key phrases: transient dos
CVE-2023-43523: Transient DOS while processing 11AZ RTT management action frame received through OTA.
Key phrases: transient dos, rtt management action frame
CVE-2023-4353: Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: heap buffer overflow, heap corruption
CVE-2023-43532: Memory corruption while reading ACPI config through the user mode app.
Key phrases: memory corruption
CVE-2023-43533: Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
Key phrases: transient dos
CVE-2023-43534: Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
Key phrases: memory corruption
CVE-2023-43535: Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.
Key phrases: memory corruption, negative display ids
CVE-2023-43536: Transient DOS while parse fils IE with length equal to 1.
Key phrases: transient dos
CVE-2023-43539: Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
Key phrases: transient dos, improperly formatted
CVE-2023-4354: Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: heap buffer overflow, heap corruption
CVE-2023-43540: Memory corruption while processing the IOCTL FM HCI WRITE request.
Key phrases: memory corruption
CVE-2023-43541: Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render.
Key phrases: memory corruption
CVE-2023-43546: Memory corruption while invoking HGSL IOCTL context create.
Key phrases: memory corruption
CVE-2023-43547: Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
Key phrases: memory corruption
CVE-2023-43548: Memory corruption while parsing qcp clip with invalid chunk data size.
Key phrases: memory corruption, invalid chunk data size
CVE-2023-43549: Memory corruption while processing TPC target power table in FTM TPC.
Key phrases: memory corruption
CVE-2023-4355: Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: out of bounds memory access, heap corruption
CVE-2023-43550: Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Key phrases: memory corruption
CVE-2023-43552: Memory corruption while processing MBSSID beacon containing several subelement IE.
Key phrases: memory corruption
CVE-2023-43553: Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
Key phrases: memory corruption
CVE-2023-4356: Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: use after free, heap corruption, convince
CVE-2023-43566: In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration
Key phrases: stored xss
CVE-2023-43567: A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-43568: A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.
Key phrases: disclose sensitive information, buffer over-read, buffer over read
CVE-2023-43569: A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-4357: Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: bypass file access restrictions, insufficient validation of untrusted input
CVE-2023-43570: A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute arbitrary code. 
Key phrases: execute arbitrary code
CVE-2023-43571: A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-43572: A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.
Key phrases: disclose sensitive information, buffer over-read, buffer over read
CVE-2023-43573: A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-43574: A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privilegesto disclose sensitive information.
Key phrases: a local attacker with elevated privilegesto disclose sensitive, buffer over-read, sensitive information, buffer over read
CVE-2023-43575: A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-43576: A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-43577: A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-43578: A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-43579: A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-4358: Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: use after free, heap corruption
CVE-2023-43580: A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-43581: A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2023-43582: Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.
Key phrases: conduct an escalation of privilege via network access, improper authorization, escalation privilege
CVE-2023-43583: Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information via network access.
Key phrases: conduct a disclosure of information via network access, cryptographic issues
CVE-2023-43585: Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access.
Key phrases: conduct a disclosure of information via network access, improper access control
CVE-2023-43586: Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access.
Key phrases: conduct an escalation of privilege via network access, path traversal, escalation privilege
CVE-2023-43588: Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access.
Key phrases: conduct an information disclosure via network access, insufficient control flow management
CVE-2023-4359: Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the security UI via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: spoofing
CVE-2023-43590: Link following  in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
Key phrases: conduct an escalation of privilege via local access, escalation privilege
CVE-2023-43591: Improper privilege management  in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
Key phrases: conduct an escalation of privilege via local access, improper privilege management, escalation privilege
CVE-2023-4360: Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-43608: A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.
Key phrases: data integrity, arbitrary command execution, man in the middle, arbitrary commands
CVE-2023-43609: In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could obtain access to sensitive information or cause a denial-of-service condition.
Key phrases: obtain access, network access, denial-of-service condition, access sensitive information, denial of service
CVE-2023-4361: Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: bypass Autofill restrictions
CVE-2023-43610: SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority) or higher privilege to perform unintended database operations.
Key phrases: perform unintended database operations, sql injection
CVE-2023-43611: The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418.Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Key phrases: elevate privileges
CVE-2023-43612: in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions.
Key phrases: a local attacker arbitrary file read and write, improper preservation of permissions
CVE-2023-43614: Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.
Key phrases: inject an arbitrary script, cross-site scripting
CVE-2023-43615: Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.
Key phrases: buffer overflow
CVE-2023-43616: An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.
Key phrases: overwrite files
CVE-2023-43617: An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.
CVE-2023-43618: An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message.
Key phrases: cleartext
CVE-2023-43619: An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file.
Key phrases: dangerous new files
CVE-2023-4362: Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: heap buffer overflow, heap corruption
CVE-2023-43620: An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver.
Key phrases: csi escape sequences
CVE-2023-43621: An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.
Key phrases: shared secret
CVE-2023-43622: An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Key phrases: slow loris
CVE-2023-43623: A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions < V5.4.0), Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.3), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.3), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.4.0). Applications using the affected module are vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users.
Key phrases: determine if a user is valid or not, mendix forgot password, brute force
CVE-2023-43624: CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4)  contains an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Designer is installed may be disclosed.
Key phrases: xml external entity reference (xxe), disclosed, sensitive information
CVE-2023-43625: A vulnerability has been identified in Simcenter Amesim (All versions < V2021.1). The affected application contains a SOAP endpoint that could allow an unauthenticated remote attacker to perform DLL injection and execute arbitrary code in the context of the affected application process.
Key phrases: execute arbitrary code, perform DLL injection and execute arbitrary code in, dll injection
CVE-2023-43627: Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticated attacker to alter critical information such as system files by sending a specially crafted request. They are affected when running in ST(Standalone) mode.
Key phrases: alter critical information such as system files by, path traversal
CVE-2023-43628: An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev. A specially crafted network packet can lead to memory corruption. An attacker can send a malicious packet to trigger this vulnerability.
Key phrases: integer underflow, memory corruption, malicious packet
CVE-2023-4363: Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: spoofing
CVE-2023-43630: PCR14 is not in the list of PCRs that seal/unseal the vault key, butdue to the change that was implemented in commit7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4, fixing this issue alone would not solve theproblem of the config partition not being measured correctly.Also, the vault key is sealed/unsealed with SHA1 PCRs instead ofSHA256. This issue was somewhat mitigated due to all of the PCR extend functionsupdating both the values of SHA256 and SHA1 for a given PCR ID.However, due to the change that was implemented in commit7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4, this is no longer the case for PCR14, asthe code in measurefs.go explicitly updates only the SHA256 instance of PCR14, whichmeans that even if PCR14 were to be added to the list of PCRs sealing/unsealing the vaultkey, changes to the config partition would still not be measured.An attacker could modify the config partition without triggering the measured boot, this couldresult in the attacker gaining full control over the device with full access to the contents of theencrypted vault
CVE-2023-43631: On boot, the Pillar eve container checks for the existence and content of/config/authorized_keys.If the file is present, and contains a supported public key, the container will go on to openport 22 and enable sshd with the given keys as the authorized keys for root login.An attacker could easily add their own keys and gain full control over the system withouttriggering the measured boot mechanism implemented by EVE OS, and without markingthe device as UUD (Unknown Update Detected).This is because the /config partition is not protected by measured boot, it is mutable, andit is not encrypted in any way.An attacker can gain full control over the device without changing the PCR values, thus nottriggering the measured boot mechanism, and having full access to the vault.Note:This issue was partially fixed in these commits (after disclosure to Zededa), where the configpartition measurement was added to PCR13: aa3501d6c57206ced222c33aea15a9169d629141 5fef4d92e75838cc78010edaed5247dfbdae1889.This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
Key phrases: gain full control, disclosure
CVE-2023-43632: As noted in the VTPM.md file in the eve documentation, VTPM is a server listening on port8877 in EVE, exposing limited functionality of the TPM to the clients. VTPM allows clients toexecute tpm2-tools binaries from a list of hardcoded optionsThe communication with this server is done using protobuf, and the data is comprised of 2parts:1. Header2. DataWhen a connection is made, the server is waiting for 4 bytes of data, which will be the header,and these 4 bytes would be parsed as uint32 size of the actual data to come.Then, in the function handleRequest this size is then used in order to allocate a payload onthe stack for the incoming data.As this payload is allocated on the stack, this will allow overflowing the stack size allocated forthe relevant process with freely controlled data.* An attacker can crash the system. * An attacker can gain control over the system, specifically on the vtpm_server processwhich has very high privileges.
Key phrases: gain control, come, overflowing the stack size allocated forthe relevant process, hardcoded, crash, crash system
CVE-2023-43633: On boot, the Pillar eve container checks for the existence and content of/config/GlobalConfig/global.json.If the file exists, it overrides the existing configuration on the device on boot.This allows an attacker to change the systems configuration, which also includes somedebug functions.This could be used to unlock the ssh with custom authorized_keys via thedebug.enable.ssh key, similar to the authorized_keys finding that was noted before.Other usages include unlocking the usb to enable the keyboard via the debug.enable.usbkey, allowing VNC access via the app.allow.vnc key, and more.An attacker could easily enable these debug functionalities without triggering the measuredboot mechanism implemented by EVE OS, and without marking the device as UUD(Unknown Update Detected).This is because the /config partition is not protected by measured boot, it is mutable and itis not encrypted in any way.An attacker can gain full control over the device without changing the PCR values, thereby nottriggering the measured boot mechanism, and having full access to the vault.Note:This issue was partially fixed in these commits (after disclosure to Zededa), where the configpartition measurement was added to PCR13: aa3501d6c57206ced222c33aea15a9169d629141 5fef4d92e75838cc78010edaed5247dfbdae1889.This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
Key phrases: gain full control, change the systems configuration, the vault, disclosure
CVE-2023-43634: When sealing/unsealing the vault key, a list of PCRs is used, which defines which PCRsare used.In a previous project, CYMOTIVE found that the configuration is not protected by the secureboot, and in response Zededa implemented measurements on the config partition that wasmapped to PCR 13.In that process, PCR 13 was added to the list of PCRs that seal/unseal the key.In commit 56e589749c6ff58ded862d39535d43253b249acf, the config partitionmeasurement moved from PCR 13 to PCR 14, but PCR 14 was not added to the list ofPCRs that seal/unseal the key.This change makes the measurement of PCR 14 effectively redundant as it would not affectthe sealing/unsealing of the key.An attacker could modify the config partition without triggering the measured boot, this couldresult in the attacker gaining full control over the device with full access to the contents of theencrypted vault
CVE-2023-43635: Vault Key Sealed With SHA1 PCRsThe measured boot solution implemented in EVE OS leans on a PCR locking mechanism.Different parts of the system update different PCR values in the TPM, resulting in a uniquevalue for each PCR entry.These PCRs are then used in order to seal/unseal a key from the TPM which is used toencrypt/decrypt the vault directory.This vault directory is the most sensitive point in the system and as such, its content shouldbe protected.This mechanism is noted in Zededas documentation as the measured boot mechanism,designed to protect said vault.The code thats responsible for generating and fetching the key from the TPM assumes thatSHA256 PCRs are used in order to seal/unseal the key, and as such their presence is beingchecked.The issue here is that the key is not sealed using SHA256 PCRs, but using SHA1 PCRs.This leads to several issues: Machines that have their SHA256 PCRs enabled but SHA1 PCRs disabled, as wellas not sealing their keys at all, meaning the vault is not protected from an attacker. SHA1 is considered insecure and reduces the complexity level required to unseal thekey in machines which have their SHA1 PCRs enabled.An attacker can very easily retrieve the contents of the vault, which will effectively renderthe measured boot mechanism meaningless.
Key phrases: insecure
CVE-2023-43636: In EVE OS, the measured boot mechanism prevents a compromised device from accessingthe encrypted data located in the vault.As per the measured boot design, the PCR values calculated at different stages of the bootprocess will change if any of their respective parts are changed.This includes, among other things, the configuration of the bios, grub, the kernel cmdline,initrd, and more.However, this mechanism does not validate the entire rootfs, so an attacker can edit thefilesystem and gain control over the system.As the default filesystem used by EVE OS is squashfs, this is somewhat harder than an ext4,which is easily changeable.This will not stop an attacker, as an attacker can repackage the squashfs with their changesin it and replace the partition altogether.This can also be done directly on the device, as the 003-storage-init container contains themksquashfs and unsquashfs binaries (with the corresponding libs).An attacker can gain full control over the device without changing the PCR values, thus nottriggering the measured boot mechanism, and having full access to the vault.Note:This issue was partially fixed in these commits (after disclosure to Zededa), where the configpartition measurement was added to PCR13: aa3501d6c57206ced222c33aea15a9169d629141 5fef4d92e75838cc78010edaed5247dfbdae1889.This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
Key phrases: gain control, gain full control, disclosure
CVE-2023-43637: Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault keywould always have the last 16 bytes predetermined to be "arfoobarfoobarfo".This issue happens because "deriveVaultKey" calls "retrieveCloudKey" (which will alwaysreturn "foobarfoobarfoobarfoobarfoobarfo" as the key), and then merges the 32byterandomly generated key with this key (by takeing 16bytes from each, see "mergeKeys").This makes the key a lot weaker.This issue does not persist in devices that were initialized on/after version 7.10, but devicesthat were initialized before that and updated to a newer version still have this issue.Roll an update that enforces the full 32bytes key usage.
CVE-2023-4364: Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-43640: TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in TaxonWorks that allows authenticated attackers to extract arbitrary data from the TaxonWorks database (including the users table). This issue may lead to information disclosure. Version 0.34.0 contains a fix for the issue.
Key phrases: extract arbitrary data, extract arbitrary data from the TaxonWorks database (, sql injection, information disclosure
CVE-2023-43641: libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.
Key phrases: gain code execution, out-of-bounds array access
CVE-2023-43642: snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.
Key phrases: Denial of Service (DoS), denial of service (dos)
CVE-2023-43643: AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later. 
Key phrases: for certain tags at the same time, mutation xss (mxss), crafty inputs
CVE-2023-43644: Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.
Key phrases: bypass when specially crafted requests are sent to sing, bypass authentication, authentication bypass, insecure environments
CVE-2023-43645: OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it's possible for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any offending models. There are no known workarounds for this vulnerability. Note that for models which contained cycles or a relation definition that has the relation itself in its evaluation path, checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. Users who do not have cyclic models are unaffected.
Key phrases: denial of service
CVE-2023-43646: get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\\\\t'.repeat(54773) + '\\\\t/function/i'. This issue has been addressed in commit `f934b228b` which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: denial of service (redos), regular expression denial of service, cpu load, processing time
CVE-2023-43647: baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Version 4.8.0 contains a patch for this issue.
Key phrases: cross-site scripting, file upload
CVE-2023-43648: baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue.
Key phrases: directory traversal
CVE-2023-43649: baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.
Key phrases: cross site request forgery
CVE-2023-4365: Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-43650: JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code, ranging from 000000 to 999999, to facilitate the password reset. Although the code is only available in 1 minute, this window potentially allows for up to 1,000,000 validation attempts. This issue has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: reset forgotten passwords, 1,000,000 validation attempts, brute-force
CVE-2023-43651: JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands. This vulnerability has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: execute arbitrary commands, gain root privileges, mongodb sessions, remote code execution
CVE-2023-43652: JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and should not used as an authentication secret alone. JumpServer provides an API for the KoKo component to validate user private key logins. This API does not verify the source of requests and will generate a personal authentication token. Given that public keys can be easily leaked, an attacker can exploit the leaked public key and username to authenticate, subsequently gaining access to the current user's information and authorized actions. This issue has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-43654: TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.
Key phrases: to write files, integrity
CVE-2023-43655: Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Key phrases: remote code execution
CVE-2023-43656: matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have `generic.allowJsTransformationFunctions` in their config), may be vulnerable to an attack where it is possible to break out of the `vm2` sandbox and as a result Hookshot will be vulnerable to this. This problem is only likely to affect users who have allowed untrusted users to apply their own transformation functions. If you have only enabled a limited set of trusted users, this threat is reduced (though not eliminated). Version 4.5.0 and above of hookshot include a new sandbox library which should better protect users. Users are advised to upgrade. Users unable to upgrade should disable `generic.allowJsTransformationFunctions` in the config.
CVE-2023-43657: discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit `9c75810af9` which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured.
Key phrases: cross site scripting (xss) issue
CVE-2023-43658: dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP disabled. Having CSP disabled is a non-default configuration, so the vast majority of sites are unaffected. This problem is resolved in the latest version of the discourse-calendar plugin. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.
Key phrases: cross-site scripting (xss)
CVE-2023-43659: Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.
Key phrases: cross-site scripting
CVE-2023-4366: Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: use after free, heap corruption, convince
CVE-2023-43660: Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: upgrade, bypass authentication
CVE-2023-43661: Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.
Key phrases: create templates allows them to execute any code, execute any code on the server during the, bad filtration, execute code
CVE-2023-43662: ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter `serverImagePath`, which is not sanitized in any way before being passed to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read which is exacerbated in the windows installer which installs the ShokoServer as administrator. Any unauthenticated attacker may be able to access sensitive information and read files stored on the server. The `/api/Image/WithPath` endpoint has been removed in commit `6c57ba0f0` which will be included in subsequent releases. Users should limit access to the `/api/Image/WithPath` endpoint or manually patch their installations until a patched release is made. This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191.
Key phrases: arbitrary file read, access sensitive information
CVE-2023-43663: PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit `ce1f6708` addresses this issue and is included in version 8.1.2. Users are advised to upgrade. There are no known workarounds for this issue.
Key phrases: disable portions of a shops functionality
CVE-2023-43664: PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been addressed in commit `15bd281c` which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue.
CVE-2023-43665: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
Key phrases:  DoS (denial of service)
CVE-2023-43666: Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,General user can view all user data like Admin account.Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.[1] https://github.com/apache/inlong/pull/8623 
Key phrases: insufficient verification of data authenticity
CVE-2023-43667: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false records, making it harder to auditand trace malicious activities.Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.[1]  https://github.com/apache/inlong/pull/8628 
Key phrases: sql command, sql injection