Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-37991 State: PUBLISHED Published: 2023-10-03T09:39:40.857Z Last Updated: 2024-09-20T13:17:14.265Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Monchito.net Products: WP Emoji One Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Monchito.Net WP Emoji One plugin <= 0.6.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-emoji-one/wordpress-wp-emoji-one-plugin-0-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-37992 State: PUBLISHED Published: 2023-10-03T09:43:18.159Z Last Updated: 2025-02-19T21:22:11.637Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: PressPage Entertainment Inc. Products: Smarty for WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/smarty-for-wordpress/wordpress-smarty-for-wordpress-plugin-3-1-35-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-37993 State: PUBLISHED Published: 2023-07-27T13:46:48.651Z Last Updated: 2024-09-25T16:58:15.657Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: maennchen1.de Products: wpShopGermany IT-RECHT KANZLEI Problem Types: CWE-79 Description: Auth. Stored Cross-Site Scripting (XSS) vulnerability in maennchen1.De wpShopGermany IT-RECHT KANZLEI plugin <= 1.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpshopgermany-it-recht-kanzlei/wordpress-wpshopgermany-it-recht-kanzlei-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-37994 State: PUBLISHED Published: 2023-09-01T11:26:07.267Z Last Updated: 2024-09-24T19:06:45.219Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Artem Abramovich Products: Art Decoration Shortcode Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Artem Abramovich Art Decoration Shortcode plugin <= 1.5.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/art-decoration-shortcode/wordpress-art-decoration-shortcode-plugin-1-5-6-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-37995 State: PUBLISHED Published: 2023-10-04T10:21:12.924Z Last Updated: 2024-09-19T18:11:47.746Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Chetan Gole Products: WP-CopyProtect [Protect your blog posts] Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-copyprotect/wordpress-wp-copyprotect-protect-your-blog-posts-plugin-3-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-37996 State: PUBLISHED Published: 2023-10-03T09:48:40.535Z Last Updated: 2025-02-19T21:22:01.319Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: GTmetrix Products: GTmetrix for WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gtmetrix-for-wordpress/wordpress-gtmetrix-for-wordpress-plugin-0-4-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-37997 State: PUBLISHED Published: 2023-09-01T11:47:09.090Z Last Updated: 2024-09-24T18:57:52.579Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Dharmesh Patel Products: Post List With Featured Image Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dharmesh Patel Post List With Featured Image plugin <= 1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/post-list-with-featured-image/wordpress-post-list-with-featured-image-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-37998 State: PUBLISHED Published: 2023-10-03T09:51:18.147Z Last Updated: 2024-08-02T17:23:27.814Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Saas Products: Disabler Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/disabler/wordpress-disabler-plugin-3-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-37999 State: PUBLISHED Published: 2024-05-17T06:51:44.725Z Last Updated: 2024-08-02T17:23:27.887Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HasThemes Products: HT Mega Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in HasThemes HT Mega allows Privilege Escalation.This issue affects HT Mega: from n/a through 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ht-mega-for-elementor/wordpress-ht-mega-absolute-addons-for-elementor-plugin-2-2-0-unauthenticated-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2023-38000 State: PUBLISHED Published: 2023-10-13T09:55:54.690Z Last Updated: 2024-08-02T17:23:27.829Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WordPress.org, Gutenberg Team Products: WordPress, Gutenberg Problem Types: CWE-79 Description: Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve -
iner: References: - https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve - https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-3-2-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/gutenberg/wordpress-gutenberg-plugin-16-8-0-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cve
CVE ID: CVE-2023-38001 State: PUBLISHED Published: 2024-07-30T16:54:07.076Z Last Updated: 2024-08-02T17:23:27.885Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: IBM Products: Aspera Orchestrator Problem Types: CWE-352 Description: IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 260206. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7161538 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260206
CVE ID: CVE-2023-38002 State: PUBLISHED Published: 2024-04-30T14:40:43.603Z Last Updated: 2024-08-02T17:23:27.889Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Storage Scale Problem Types: CWE-384 Description: IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system. IBM X-Force ID: 260208. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7149699 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260208
CVE ID: CVE-2023-38003 State: PUBLISHED Published: 2023-12-04T00:12:37.484Z Last Updated: 2025-05-29T14:14:19.248Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: 264 Permissions, Privileges, Access Controls Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a user with DATAACCESS privileges to execute routines that they should not have access to. IBM X-Force ID: 260214. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7078681 - https://exchange.xforce.ibmcloud.
CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7078681 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260214 - https://security.netapp.com/advisory/ntap-20240119-0001/
CVE ID: CVE-2023-38007 State: PUBLISHED Published: 2025-06-27T14:48:28.581Z Last Updated: 2025-08-17T00:24:09.866Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cloud Pak System Problem Types: CWE-80 Description: IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/supp
y context of the hosting site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7237162
CVE ID: CVE-2023-38009 State: PUBLISHED Published: 2025-01-26T15:57:42.477Z Last Updated: 2025-01-27T14:52:09.533Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cognos Analytics Mobile Problem Types: CWE-295 Description: IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7172691 - https://www.ibm.com/support/pages/node/7172692
CVE ID: CVE-2023-38012 State: PUBLISHED Published: 2025-01-25T13:49:36.358Z Last Updated: 2025-01-27T17:03:37.389Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cloud Pak System Problem Types: CWE-22 Description: IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7148474
CVE ID: CVE-2023-38013 State: PUBLISHED Published: 2025-01-25T13:55:05.494Z Last Updated: 2025-01-27T17:02:47.819Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cloud Pak System Problem Types: CWE-201 Description: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7159533
CVE ID: CVE-2023-38018 State: PUBLISHED Published: 2024-08-09T16:25:10.609Z Last Updated: 2024-08-09T21:35:43.415Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Aspera Shares Problem Types: CWE-384 Description: IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7164325
CVE ID: CVE-2023-38019 State: PUBLISHED Published: 2024-02-02T03:34:56.977Z Last Updated: 2024-08-02T17:23:27.824Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: IBM Products: SOAR QRadar Plugin App Problem Types: CWE-22 Description: IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 260575. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7111679 - https://exchange.xforce.
chment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7111679 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260575
CVE ID: CVE-2023-38020 State: PUBLISHED Published: 2024-02-02T03:36:26.147Z Last Updated: 2024-08-02T17:23:27.839Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: SOAR QRadar Plugin App Problem Types: CWE-117 Description: IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to manipulate output written to log files. IBM X-Force ID: 260576. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7111679 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260576
CVE ID: CVE-2023-38021 State: PUBLISHED Published: 2023-12-30T00:00:00 Last Updated: 2024-08-02T17:23:27.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX. Lack of pointer-alignment validation logic in entry functions allows a local attacker to access unauthorized information. This relates to the enclave_ecall function and system call layer. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html - https://www.intel.com/content/www/us/en/developer/articles/technical/sof
/security-center/advisory/intel-sa-00657.html - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/processor-mmio-stale-data-vulnerabilities.html#inpage-nav-3-2-2 - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/stale-data-read-from-xapic.html - https://github.com/openenclave/openenclave/security/advisories/GHSA-v3vm-9h66-wm76 - https://jovanbulck.github.io/files/oakland24-pandora.pdf
CVE ID: CVE-2023-38022 State: PUBLISHED Published: 2023-12-30T00:00:00 Last Updated: 2024-09-09T17:26:49.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a local attacker to access unauthorized information. This relates to strlen and sgx_is_within_user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jovanbulck.github.io/files/ccs19-tale.pdf - https://jovanbulck.github.io/files/oakland24-pandora.pdf
CVE ID: CVE-2023-38023 State: PUBLISHED Published: 2023-12-30T00:00:00 Last Updated: 2024-11-20T17:42:52.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack of pointer-alignment logic in __scone_dispatch and other entry functions allows a local attacker to access unauthorized information, aka an "AEPIC Leak." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sconedocs.github.io/release5.7/ - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html - https://www.intel.com/content/www/us/en/developer/articles/t
nt/www/us/en/security-center/advisory/intel-sa-00657.html - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/processor-mmio-stale-data-vulnerabilities.html#inpage-nav-3-2-2 - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/stale-data-read-from-xapic.html - https://github.com/openenclave/openenclave/security/advisories/GHSA-v3vm-9h66-wm76 - https://sconedocs.github.io/release5.8/ - https://jovanbulck.github.io/files/oakland24-pandora.pdf
CVE ID: CVE-2023-38024 State: PUBLISHED Published: 2023-08-28T03:14:20.410Z Last Updated: 2024-10-02T15:01:18.201Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SPOTCAM CO., LTD. Products: SpotCam FHD 2 Problem Types: CWE-798 Description: SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7331-9099e-1.html
CVE ID: CVE-2023-38025 State: PUBLISHED Published: 2023-08-28T03:21:04.106Z Last Updated: 2024-10-02T15:00:17.631Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SPOTCAM CO., LTD. Products: SpotCam FHD 2 Problem Types: CWE 78 OS Command Injection Description: SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7332-ee011-1.html
CVE ID: CVE-2023-38026 State: PUBLISHED Published: 2023-08-28T03:29:08.582Z Last Updated: 2024-10-02T14:59:17.672Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SPOTCAM CO., LTD. Products: SpotCam FHD 2 Problem Types: CWE-798 Description: SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html
CVE ID: CVE-2023-38027 State: PUBLISHED Published: 2023-08-28T03:37:19.941Z Last Updated: 2024-10-14T03:32:16.132Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SPOTCAM CO., LTD. Products: SpotCam Sense Problem Types: CWE-78 Description: SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system commands or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7334-351fb-1.html
CVE ID: CVE-2023-38028 State: PUBLISHED Published: 2023-08-28T04:12:44.854Z Last Updated: 2024-10-03T16:12:23.404Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Saho Products: ADM100, ADM-100FP Problem Types: CWE-306 Description: Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can’t control system or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7335-d300a-1.html
CVE ID: CVE-2023-38029 State: PUBLISHED Published: 2023-08-28T05:59:47.039Z Last Updated: 2024-10-03T16:16:59.825Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Saho Products: ADM100, ADM-100FP Problem Types: CWE-434 Description: Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.h
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html
CVE ID: CVE-2023-38030 State: PUBLISHED Published: 2023-08-28T06:44:16.870Z Last Updated: 2024-10-03T12:58:30.760Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Saho Products: ADM100, ADM-100FP Problem Types: CWE-306 Description: Saho’s attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can execute system commands in partial website URLs to read sensitive device information without permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7337-501df-1.html
CVE ID: CVE-2023-38031 State: PUBLISHED Published: 2023-09-07T03:24:38.199Z Last Updated: 2024-09-26T19:27:07.193Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AC86U Problem Types: CWE-78 Description: ASUS RT-AC86U Adaptive QoS - Web History function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7348-56989-1.html
CVE ID: CVE-2023-38032 State: PUBLISHED Published: 2023-09-07T06:30:47.345Z Last Updated: 2024-09-26T19:24:39.207Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AC86U Problem Types: CWE-78 Description: ASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7349-7f8cd-1.html
CVE ID: CVE-2023-38033 State: PUBLISHED Published: 2023-09-07T06:42:16.805Z Last Updated: 2024-09-26T19:23:15.089Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AC86U Problem Types: CWE-78 Description: ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7350-ded5e-1.html