CIRCL/vulnerability-attack-techniques huggingface dataset:
CVE-2025-24991: Windows NTFS Information Disclosure Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

Affected products: Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)
CWE: CWE-125: Out-of-bounds Read
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C
ATT&CK exploitation technique(s): T1091
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1091
CVE-2020-3177: Cisco Unified Communications Manager Path Traversal Vulnerability
A vulnerability in the Tool for Auto-Registered Phones Support (TAPS) of Cisco Unified Communications Manager (UCM) and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the TAPS interface of the affected device. An attacker could exploit this vulnerability by sending a crafted request to the TAPS interface. A successful exploit could allow the attacker to read arbitrary files in the system.

Affected products: Cisco Cisco Unified Communications Manager
CWE: CWE-22
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1190
CVE-2021-42237: 
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

CWE: CWE-502 Deserialization of Untrusted Data
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059
CVE-2020-3416: Cisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution Vulnerabilities
Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services Routers with a Route Switch Processor 3 (RSP3) installed could allow an authenticated, local attacker with high privileges to execute persistent code at bootup and break the chain of trust. These vulnerabilities are due to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set. An attacker could exploit these vulnerabilities by copying a specific file to the local file system of an affected device and defining specific ROMMON variables. A successful exploit could allow the attacker to run arbitrary code on the underlying operating system (OS) with root privileges. To exploit these vulnerabilities, an attacker would need to have access to the root shell on the device or have physical access to the device.

Affected products: Cisco Cisco IOS XE Software
CWE: CWE-749
CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1542.004
ATT&CK techniques (all): T1078, T1542.004
CVE-2012-6685: 
Nokogiri before 1.5.4 is vulnerable to XXE attacks

ATT&CK techniques (all): T1046
CVE-2021-44077: 
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

CWE: CWE-306 Missing Authentication for Critical Function
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1505.003
ATT&CK secondary impact: T1003, T1003.003, T1027, T1047, T1070.004, T1087.002, T1136, T1140, T1218, T1560.001, T1573.001
ATT&CK techniques (all): T1003, T1003.003, T1027, T1047, T1070.004, T1087.002, T1136, T1140, T1190, T1218, T1505.003, T1560.001, T1573.001
CVE-2018-7526: 
In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specific uniform resource locator (URL) on the webserver, a malicious user may be able to access information in the application without authenticating.

ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005
CVE-2013-5065: 
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1068, T1548.002
CVE-2018-5459: 
An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenticated remote operations because of the CoDeSys Runtime application, which is available via network by default on Port 2455. An attacker could execute some unauthenticated commands such as reading, writing, or deleting arbitrary files, or manipulate the PLC application during runtime by sending specially-crafted TCP packets to Port 2455.

Affected products: WAGO PFC200 Series
CWE: CWE-287
ATT&CK secondary impact: T1005, T1485, T1565.001
ATT&CK techniques (all): T1005, T1485, T1565.001
CVE-2017-8291: 
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1190
CVE-2020-3309: Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerability
A vulnerability in Cisco Firepower Device Manager (FDM) On-Box software could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by uploading a malicious file to an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on as well as modify the underlying operating system of an affected device.

Affected products: Cisco Cisco Firepower Threat Defense Software
CWE: CWE-20
CVSS: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
ATT&CK exploitation technique(s): T1133, T1190
ATT&CK primary impact: T1574
ATT&CK secondary impact: T1565.001
ATT&CK techniques (all): T1133, T1190, T1565.001, T1574
CVE-2019-16760: Cargo prior to Rust 1.26.0 may download the wrong dependency
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue.

Affected products: rust cargo
CWE: CWE-16 Configuration
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
ATT&CK primary impact: T1190
ATT&CK techniques (all): T1190
CVE-2019-0880: 
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.

Affected products: Microsoft Windows Server, Microsoft Windows, Microsoft Windows 10 Version 1903 for 32-bit Systems, Microsoft Windows 10 Version 1903 for x64-based Systems, Microsoft Windows 10 Version 1903 for ARM64-based Systems, Microsoft Windows Server, version 1903 (Server Core installation)
CWE: Elevation of Privilege, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1190
CVE-2020-5250: Possible information disclosure in PrestaShop
In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.

Affected products: PrestaShop PrestaShop
CWE: CWE-285: Improper Authorization
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
ATT&CK primary impact: T1036
ATT&CK techniques (all): T1036
CVE-2018-17910: 
WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow condition that allows for arbitrary remote code execution.

Affected products: WebAccess Versions 8.3.2 and prior.
CWE: CWE-121 STACK-BASED BUFFER OVERFLOW CWE-121
ATT&CK primary impact: T1574
ATT&CK techniques (all): T1574
CVE-2010-1424: 
Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government 2006 through 2010 allows user-assisted remote attackers to execute arbitrary code via a crafted font file.

ATT&CK techniques (all): T1203, T1204.002
CVE-2013-5057: 
hxds.dll in Microsoft Office 2007 SP3 and 2010 SP1 and SP2 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted COM component on a web site that is visited with Internet Explorer, as exploited in the wild in December 2013, aka "HXDS ASLR Vulnerability."

ATT&CK techniques (all): T1190
CVE-2023-6548: 
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Affected products: Cloud Software Group NetScaler ADC, Cloud Software Group NetScaler Gateway, citrix netscaler_application_delivery_controller, citrix netscaler_gateway
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
ATT&CK exploitation technique(s): T1055
ATT&CK techniques (all): T1055
CVE-2014-6332: 
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."

CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1189, T1203
CVE-2019-13922: 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). An attacker with administrative privileges can obtain the hash of a connected device's password. The security vulnerability could be exploited by an attacker with network access to the SINEMA Remote Connect Server and administrative privileges. At the time of advisory publication no public exploitation of this security vulnerability was known.

Affected products: Siemens AG SINEMA Remote Connect Server
CWE: CWE-311: Missing Encryption of Sensitive Data
ATT&CK techniques (all): T1552
CVE-2018-18995: 
Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web interfaces, which could enable various effects vectors, including conducting device resets, reading or modifying registers, and changing configuration settings such as IP addresses.

Affected products: ABB GATE-E1 and GATE-E2
CWE: CWE-306 Missing Authentication for Critical Function CWE-306
ATT&CK secondary impact: T1213, T1529
ATT&CK techniques (all): T1213, T1529
CVE-2016-5062: 
The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute arbitrary Java code by registering MBeans.

ATT&CK techniques (all): T1059, T1190
CVE-2020-3513: Cisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution Vulnerabilities
Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services Routers with a Route Switch Processor 3 (RSP3) installed could allow an authenticated, local attacker with high privileges to execute persistent code at bootup and break the chain of trust. These vulnerabilities are due to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set. An attacker could exploit these vulnerabilities by copying a specific file to the local file system of an affected device and defining specific ROMMON variables. A successful exploit could allow the attacker to run arbitrary code on the underlying operating system (OS) with root privileges. To exploit these vulnerabilities, an attacker would need to have access to the root shell on the device or have physical access to the device.

Affected products: Cisco Cisco IOS XE Software
CWE: CWE-749
CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1542.004
ATT&CK techniques (all): T1078, T1542.004
CVE-2011-2462: 
Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.

CWE: CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1204.002
ATT&CK techniques (all): T1204.002
CVE-2023-5217: 
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Affected products: Google Chrome, Google libvpx
CWE: Heap buffer overflow, CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1204.001
ATT&CK primary impact: T1574
ATT&CK techniques (all): T1204.001, T1574
CVE-2009-3129: 
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."

CWE: CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1203, T1204.002
CVE-2020-5267: Possible XSS vulnerability in ActionView
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

Affected products: rails actionview
CWE: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1185
ATT&CK techniques (all): T1059, T1185
CVE-2016-1019: 
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1189
ATT&CK primary impact: T1105
ATT&CK secondary impact: T1486
ATT&CK techniques (all): T1105, T1189, T1486
CVE-2021-36380: 
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.

Affected products: sunhillo sureline
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059.004
ATT&CK techniques (all): T1059.004, T1190
CVE-2023-36844: Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.

Using a crafted request an attacker is able to modify 

certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on EX Series:



  *  All versions prior to 20.4R3-S9;
  *  21.1 versions 21.1R1 and later;
  *  21.2 versions prior to 21.2R3-S7;
  *  21.3 versions 

prior to 

 21.3R3-S5;
  *  21.4 versions 

prior to 

21.4R3-S5;
  *  22.1 versions 

prior to 

22.1R3-S4;
  *  22.2 versions 

prior to 

22.2R3-S2;
  *  22.3 versions 

prior to 22.3R3-S1;
  *  22.4 versions 

prior to 

22.4R2-S2, 22.4R3;
  *  23.2 versions prior to 

23.2R1-S1, 23.2R2.

Affected products: Juniper Networks Junos OS
CWE: CWE-473 PHP External Variable Modification
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ATT&CK exploitation technique(s): T1203
ATT&CK primary impact: T1190
ATT&CK techniques (all): T1190, T1203
CVE-2020-1020: 
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0938.

Affected products: Microsoft Windows, Microsoft Windows Server, Microsoft Windows 10 Version 1909 for 32-bit Systems, Microsoft Windows 10 Version 1909 for x64-based Systems, Microsoft Windows 10 Version 1909 for ARM64-based Systems, Microsoft Windows Server, version 1909 (Server Core installation), Microsoft Windows 10 Version 1903 for 32-bit Systems, Microsoft Windows 10 Version 1903 for x64-based Systems, Microsoft Windows 10 Version 1903 for ARM64-based Systems, Microsoft Windows Server, version 1903 (Server Core installation)
CWE: Remote Code Execution, CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1203, T1566
CVE-2024-37085: 
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously  configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html  by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

Affected products: VMware ESXi, VMware Cloud Foundation, vmware esxi, vmware cloud_foundation
CWE: Authentication bypass vulnerability, CWE-305 Authentication Bypass by Primary Weakness
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1068
ATT&CK secondary impact: T1608.001
ATT&CK techniques (all): T1068, T1078, T1608.001
CVE-2013-7102: 
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.

ATT&CK techniques (all): T1190
CVE-2020-11896: 
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

ATT&CK techniques (all): T1190, T1203, T1499
CVE-2018-18987: 
VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied input via a file without first checking for validity, allowing attacker supplied input to be written to known memory locations. This may cause the program to crash or allow remote code execution.

ATT&CK primary impact: T1059
ATT&CK secondary impact: T1499.004, T1574
ATT&CK techniques (all): T1059, T1499.004, T1574
CVE-2018-8852: 
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. When authenticating a user or otherwise establishing a new user session, the software gives an attacker the opportunity to steal authenticated sessions without invalidating any existing session identifier.

Affected products: Philips e-Alert Unit (non-medical device)
CWE: CWE-384 SESSION FIXATION CWE-384
ATT&CK primary impact: T1563
ATT&CK techniques (all): T1563
CVE-2023-26360: Adobe ColdFusion Improper Access Control Arbitrary code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Affected products: Adobe ColdFusion
CWE: CWE-284 Improper Access Control (CWE-284)
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059.007
ATT&CK secondary impact: T1003.001, T1036.005, T1046, T1071.001, T1105, T1484.001, T1505.003
ATT&CK techniques (all): T1003.001, T1036.005, T1046, T1059.007, T1071.001, T1105, T1190, T1484.001, T1505.003