Publish Advisories

GHSA-hpr7-fpw7-jcx2 GHSA-23wc-j7fg-6xp5 GHSA-38fw-5cvw-p8h6 GHSA-3f7x-wmqw-jp3f GHSA-572f-p654-83g9 GHSA-58wq-3769-jr35 GHSA-596g-2p2m-3392 GHSA-7gq7-rh5h-8vq2 GHSA-8jp5-89m5-6xp3 GHSA-g49f-jx9g-vhr8 GHSA-hwp3-3266-mxg2 GHSA-j27g-hjp9-xf7w GHSA-q8jx-8wr3-gv52 GHSA-qvcf-7rv4-rh36 GHSA-vphq-5544-c678 GHSA-wm3v-q675-6282 GHSA-wxqm-9ppv-v25j
2026-05-22 18:04:22 -07:00 · 2023-11-06 06:31:50 +00:00
parent 15f1dc216e
commit 1a32dcb271
17 changed files with 616 additions and 2 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hpr7-fpw7-jcx2",
-  "modified": "2023-08-23T18:30:34Z",
+  "modified": "2023-11-06T06:30:26Z",
  "published": "2023-08-18T15:30:23Z",
  "aliases": [
    "CVE-2023-27576"
@@ -21,16 +21,24 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27576"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/phpList/phplist3/pull/986"
+    },
    {
      "type": "WEB",
      "url": "https://cupc4k3.lol/cve-2023-27576-hacking-phplist-how-i-gained-super-admin-access-44c7c90d82da"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.phplist.org/newslist/phplist-3-6-14-release-notes/"
    }
  ],
  "database_specific": {
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-18T15:15:09Z"
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-23wc-j7fg-6xp5",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-4625"
+  ],
+  "details": "Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4625"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jvn.jp/vu/JVNVU94620134"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-307"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T05:15:15Z"
+  }
+}
@@ -0,0 +1,43 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-38fw-5cvw-p8h6",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-38407"
+  ],
+  "details": "bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38407"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FRRouting/frr/pull/12951"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FRRouting/frr/pull/12956"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T06:15:40Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3f7x-wmqw-jp3f",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-32838"
+  ],
+  "details": "In dpe, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07310805; Issue ID: ALPS07310805.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32838"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:08Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-572f-p654-83g9",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-32832"
+  ],
+  "details": "In video, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08235273; Issue ID: ALPS08235273.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32832"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:07Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-58wq-3769-jr35",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-20702"
+  ],
+  "details": "In 5G NRLC, there is a possible invalid memory access due to lack of error handling. This could lead to remote denial of service, if UE received invalid 1-byte rlc sdu, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00921261; Issue ID: MOLY01128895.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20702"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:07Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-596g-2p2m-3392",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-32834"
+  ],
+  "details": "In secmem, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08161762; Issue ID: ALPS08161762.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32834"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:07Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7gq7-rh5h-8vq2",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-32836"
+  ],
+  "details": "In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08126725; Issue ID: ALPS08126725.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32836"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:07Z"
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8jp5-89m5-6xp3",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-38406"
+  ],
+  "details": "bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a \"flowspec overflow.\"",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38406"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FRRouting/frr/pull/12884"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FRRouting/frr/compare/frr-8.4.2...frr-8.4.3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T06:15:40Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g49f-jx9g-vhr8",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-32825"
+  ],
+  "details": "In bluethooth service, there is a possible out of bounds reads due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07884130; Issue ID: ALPS07884130.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32825"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:07Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hwp3-3266-mxg2",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-32839"
+  ],
+  "details": "In dpe, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262576; Issue ID: ALPS07262576.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32839"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:08Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j27g-hjp9-xf7w",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-32835"
+  ],
+  "details": "In keyinstall, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08157918; Issue ID: ALPS08157918.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32835"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:07Z"
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q8jx-8wr3-gv52",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-4699"
+  ],
+  "details": "Insufficient Verification of Data Authenticity vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules and MELSEC iQ-F Series CPU modules allows a remote unauthenticated attacker to reset the memory of the products to factory default state and cause denial-of-service (DoS) condition on the products by sending specific packets.\n\n\n\n\n\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4699"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jvn.jp/vu/JVNVU94620134/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-03"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-013_en.pdf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-345"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T06:15:41Z"
+  }
+}
@@ -0,0 +1,47 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qvcf-7rv4-rh36",
+  "modified": "2023-11-06T06:30:27Z",
+  "published": "2023-11-06T06:30:27Z",
+  "aliases": [
+    "CVE-2023-47253"
+  ],
+  "details": "Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47253"
+    },
+    {
+      "type": "WEB",
+      "url": "https://openxp.xpsec.co/blog/cve-2023-47253"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.linkedin.com/in/hairrison-wenning-4631a4124/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.linkedin.com/in/xvinicius/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualitor.com.br/qualitor-8-20"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T06:15:40Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vphq-5544-c678",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-32818"
+  ],
+  "details": "In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08163896 & ALPS08013430; Issue ID: ALPS07867715.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32818"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:07Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wm3v-q675-6282",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-32837"
+  ],
+  "details": "In video, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08235273; Issue ID: ALPS08250357.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32837"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:07Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wxqm-9ppv-v25j",
+  "modified": "2023-11-06T06:30:26Z",
+  "published": "2023-11-06T06:30:26Z",
+  "aliases": [
+    "CVE-2023-32840"
+  ],
+  "details": "In modem CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction may be also needed for exploitation Patch ID: MOLY01138425; Issue ID: MOLY01138425 (MSV-862).",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32840"
+    },
+    {
+      "type": "WEB",
+      "url": "https://corp.mediatek.com/product-security-bulletin/November-2023"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-06T04:15:08Z"
+  }
+}