CVE-2023-6540

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could result in the disclosure of sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Lenovo	Lenovo Browser Mobile	< 8.7.1.1
Lenovo	Lenovo Browser HD	< 2.1.4.1

References

https://iknow.lenovo.com.cn/detail/419251Vendor Advisory
https://iknow.lenovo.com.cn/detail/419251Vendor Advisory

Timeline

Published: Jan 3, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-65416.1The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to up CVE-2023-65427.1Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself we CVE-2023-65445.4A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows host CVE-2023-65454.7The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redire CVE-2023-65467.0A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCON CVE-2023-65475.4Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but n CVE-2023-65488.8Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLI CVE-2023-65497.5Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial CVE-2023-65515.4As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the def CVE-2023-65526.1Lack of "current" GET parameter validation during the action of changing a language leads to an open redirect vulnerability.CVE-2023-65539.8The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includ CVE-2023-65546.5When access to the "admin" folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any