CVE-2023-5937

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

On Windows systems, the Arc configuration files resulted to be world-readable.

This can lead to information disclosure by local attackers, via exfiltration of sensitive data from configuration files.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-538

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-59388.0Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal viCVE-2023-59397.2The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, CVE-2023-59404.8The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privileCVE-2023-59419.8In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio functionCVE-2023-59425.4The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a pCVE-2023-59434.8The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users suchCVE-2023-59447.8Delta Electronics DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can leCVE-2023-59455.4The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missCVE-2023-59466.1The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 duCVE-2023-59485.5Improper Authorization in GitHub repository teamamaze/amazefileutilities prior to 1.91.CVE-2023-59497.5The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.CVE-2023-59506.1Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attacker
CVE-2023-5937: Low severity, CVSS 3.8 | Vulnix