CVE-2023-49344

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-377 CWE-668

Affected software

Vendor	Product	Versions
Ubuntu Budgie	Budgie Extras	>= v1.4.0, < v1.7.1

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49344Third Party Advisory
https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-rhwf-6fc9-9jvmThird Party Advisory
https://ubuntu.com/security/notices/USN-6556-1Vendor Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49344Third Party Advisory
https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-rhwf-6fc9-9jvmThird Party Advisory
https://ubuntu.com/security/notices/USN-6556-1Vendor Advisory

Timeline

Published: Dec 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-493457.8Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data CVE-2023-493467.8Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The dat CVE-2023-493477.8Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data CVE-2023-49354.3The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco CVE-2023-493519.8A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite o CVE-2023-493557.5decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is not CVE-2023-493567.5A stack buffer overflow vulnerability in MP3Gain v1.6.2 allows an attacker to cause a denial of service via the WriteMP3GainAPETag function CVE-2023-49366.7It is possible to sideload a compromised DLL during the installation at elevated privilege.CVE-2023-493639.8Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php.CVE-2023-493678.8An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information via inspecting sent pa CVE-2023-49374.3The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco CVE-2023-493719.8RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.