netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3jx9-v77h-f29p
GHSA-4987-x432-f9p7
GHSA-52qh-2823-96fv
GHSA-56wq-w554-cc9v
GHSA-5g9h-964v-38j5
GHSA-5gjp-jxxf-7xhq
GHSA-5hvx-pxpw-33vc
GHSA-6mmh-v9jp-6p75
GHSA-97ff-chmx-4frj
GHSA-cm73-3h75-8262
GHSA-f7qg-3x5j-3hfg
GHSA-hwc3-3qh6-r4gg
GHSA-jqmm-8mgc-x9fj
GHSA-mg2c-gg6q-f5px
GHSA-p732-x236-jpq6
GHSA-pfg6-x65v-gqv3
GHSA-q5xp-jm46-h2x4
GHSA-v3hp-mcj5-pg39
GHSA-vq4h-9ghm-qmrr
GHSA-vq6h-vf99-2cxx
GHSA-ww9v-392g-mw7p
GHSA-x2cf-9q9q-fjpq
GHSA-xhgx-hx6p-cqp4
This commit is contained in:
advisory-database[bot]
2023-03-30 03:31:51 +00:00
parent 113111ef70
commit b7c88984c6
23 changed files with 243 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/03/GHSA-3jx9-v77h-f29p/GHSA-3jx9-v77h-f29p.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3jx9-v77h-f29p",
"modified": "2023-03-24T21:30:53Z",
"modified": "2023-03-30T03:30:39Z",
"published": "2023-03-24T21:30:53Z",
"aliases": [
"CVE-2023-21077"
],
"details": "In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257289560References: N/A",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-4987-x432-f9p7/GHSA-4987-x432-f9p7.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4987-x432-f9p7",
"modified": "2023-03-24T21:30:52Z",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-24T21:30:52Z",
"aliases": [
"CVE-2023-21030"
],
"details": "In Confirmation of keystore_cli_v2.cpp, there is a possible way to corrupt memory due to a double free. This could lead to local escalation of privilege in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-226234140",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-52qh-2823-96fv/GHSA-52qh-2823-96fv.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-52qh-2823-96fv",
"modified": "2023-03-24T21:30:52Z",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-24T21:30:52Z",
"aliases": [
"CVE-2023-21035"
],
"details": "In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to another app with the same package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-184847040",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-56wq-w554-cc9v/GHSA-56wq-w554-cc9v.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-56wq-w554-cc9v",
"modified": "2023-03-24T21:30:53Z",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-24T21:30:53Z",
"aliases": [
"CVE-2023-21069"
],
"details": "In wl_update_hidden_ap_ie of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254029309References: N/A",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-5g9h-964v-38j5/GHSA-5g9h-964v-38j5.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5g9h-964v-38j5",
"modified": "2023-03-24T21:30:50Z",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-24T21:30:50Z",
"aliases": [
"CVE-2023-20974"
],
"details": "In btm_ble_add_resolving_list_entry_complete of btm_ble_privacy.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-260078907",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-5gjp-jxxf-7xhq/GHSA-5gjp-jxxf-7xhq.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5gjp-jxxf-7xhq",
"modified": "2023-03-24T21:30:53Z",
"modified": "2023-03-30T03:30:39Z",
"published": "2023-03-24T21:30:53Z",
"aliases": [
"CVE-2023-21072"
],
"details": "In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257290781References: N/A",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-5hvx-pxpw-33vc/GHSA-5hvx-pxpw-33vc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5hvx-pxpw-33vc",
"modified": "2023-03-24T21:30:52Z",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-24T21:30:52Z",
"aliases": [
"CVE-2023-21029"
],
"details": "In register of UidObserverController.java, there is a missing permission check. This could lead to local information disclosure of app usage with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-217934898",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-6mmh-v9jp-6p75/GHSA-6mmh-v9jp-6p75.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6mmh-v9jp-6p75",
"modified": "2023-03-24T21:30:53Z",
"modified": "2023-03-30T03:30:39Z",
"published": "2023-03-24T21:30:53Z",
"aliases": [
"CVE-2023-21075"
],
"details": "In get_svc_hash of nan.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-261857862References: N/A",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-97ff-chmx-4frj/GHSA-97ff-chmx-4frj.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-97ff-chmx-4frj",
"modified": "2023-03-24T21:30:53Z",
"modified": "2023-03-30T03:30:39Z",
"published": "2023-03-24T21:30:53Z",
"aliases": [
"CVE-2023-21070"
],
"details": "In add_roam_cache_list of wl_roam.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254028776References: N/A",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-cm73-3h75-8262/GHSA-cm73-3h75-8262.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cm73-3h75-8262",
"modified": "2023-03-24T21:30:53Z",
"modified": "2023-03-30T03:30:39Z",
"published": "2023-03-24T21:30:53Z",
"aliases": [
"CVE-2023-21079"
],
"details": "In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254839721References: N/A",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-f7qg-3x5j-3hfg/GHSA-f7qg-3x5j-3hfg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f7qg-3x5j-3hfg",
"modified": "2023-03-25T00:30:27Z",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-25T00:30:27Z",
"aliases": [
"CVE-2023-26864"
],
"details": "SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatchingRedirectionsFromPartscomponent.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T22:15:00Z"
advisories/unreviewed/2023/03/GHSA-hwc3-3qh6-r4gg/GHSA-hwc3-3qh6-r4gg.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hwc3-3qh6-r4gg",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-30T03:30:38Z",
"aliases": [
"CVE-2023-0665"
],
"details": "HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0665"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-30T01:15:00Z"
}
}
advisories/unreviewed/2023/03/GHSA-jqmm-8mgc-x9fj/GHSA-jqmm-8mgc-x9fj.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jqmm-8mgc-x9fj",
"modified": "2023-03-24T21:30:53Z",
"modified": "2023-03-30T03:30:39Z",
"published": "2023-03-24T21:30:53Z",
"aliases": [
"CVE-2023-21078"
],
"details": "In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254840211References: N/A",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-mg2c-gg6q-f5px/GHSA-mg2c-gg6q-f5px.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mg2c-gg6q-f5px",
"modified": "2023-03-24T21:30:50Z",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-24T21:30:50Z",
"aliases": [
"CVE-2023-20975"
],
"details": "In getAvailabilityStatus of EnableContentCapturePreferenceController.java, there is a possible way to bypass DISALLOW_CONTENT_CAPTURE due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-250573776",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-p732-x236-jpq6/GHSA-p732-x236-jpq6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p732-x236-jpq6",
"modified": "2023-03-25T00:30:27Z",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-25T00:30:27Z",
"aliases": [
"CVE-2023-1583"
],
"details": "A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the Linux Kernel. When fixed files are unregistered, some context information (file_alloc_{start,end} and alloc_hint) is not cleared. A subsequent request that has auto index selection enabled via IORING_FILE_INDEX_ALLOC can cause a NULL pointer dereference. An unprivileged user can use the flaw to cause a system crash.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T22:15:00Z"
advisories/unreviewed/2023/03/GHSA-pfg6-x65v-gqv3/GHSA-pfg6-x65v-gqv3.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pfg6-x65v-gqv3",
"modified": "2023-03-24T21:30:53Z",
"modified": "2023-03-30T03:30:39Z",
"published": "2023-03-24T21:30:53Z",
"aliases": [
"CVE-2023-21073"
],
"details": "In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257290396References: N/A",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-q5xp-jm46-h2x4/GHSA-q5xp-jm46-h2x4.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q5xp-jm46-h2x4",
"modified": "2023-03-24T21:30:53Z",
"modified": "2023-03-30T03:30:39Z",
"published": "2023-03-24T21:30:53Z",
"aliases": [
"CVE-2023-21068"
],
"details": "In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user. This could lead to local escalation of privilege after preparing the device, hiding the warning, and passing the phone to a new user, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243433344References: N/A",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"
advisories/unreviewed/2023/03/GHSA-v3hp-mcj5-pg39/GHSA-v3hp-mcj5-pg39.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v3hp-mcj5-pg39",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-30T03:30:38Z",
"aliases": [
"CVE-2023-0620"
],
"details": "HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0620"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080/1"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-30T01:15:00Z"
}
}
advisories/unreviewed/2023/03/GHSA-vq4h-9ghm-qmrr/GHSA-vq4h-9ghm-qmrr.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vq4h-9ghm-qmrr",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-30T03:30:38Z",
"aliases": [
"CVE-2023-25000"
],
"details": "HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25000"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-30T01:15:00Z"
}
}
advisories/unreviewed/2023/03/GHSA-vq6h-vf99-2cxx/GHSA-vq6h-vf99-2cxx.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vq6h-vf99-2cxx",
"modified": "2023-03-24T21:30:53Z",
"modified": "2023-03-30T03:30:39Z",
"published": "2023-03-24T21:30:53Z",
"aliases": [
"CVE-2023-21071"
],
"details": "In dhd_prot_ioctcmplt_process of dhd_msgbuf.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254028518References: N/A",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z"

Some files were not shown because too many files have changed in this diff Show More