Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-22738 State: PUBLISHED Published: 2023-03-01T20:22:13.113Z Last Updated: 2025-03-06T19:07:40.465Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: vantage6 Products: vantage6 Problem Types: CWE-281 Description: vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0. A
therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vantage6/vantage6/security/advisories/GHSA-vvjv-97j8-94xh - https://github.com/vantage6/vantage6/commit/798aca1de142a4eca175ef51112e2235642f4f24
CVE ID: CVE-2023-22739 State: PUBLISHED Published: 2023-01-26T08:45:37.676Z Last Updated: 2025-03-10T21:19:25.590Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-770 Description: Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed) are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an arbitrarily large draft, forcing the instance to a crawl. This issue is patched in versions 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.
draft, forcing the instance to a crawl. This issue is patched in versions 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed). There are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-rqgr-g6v7-jcfc
CVE ID: CVE-2023-22740 State: PUBLISHED Published: 2023-01-27T00:39:52.641Z Last Updated: 2025-03-10T21:18:54.870Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-770 Description: Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the server. Additionally, an unlimited number of drafts were loaded when loading the user. This issue has been patched in version 2.1.0.beta
ally, an unlimited number of drafts were loaded when loading the user. This issue has been patched in version 2.1.0.beta1 (beta) and (tests-passed). Users should upgrade to the latest version where a limit has been introduced. There are no workarounds available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-pwj4-rf62-p224 - https://github.com/discourse/discourse/commit/5eaf0802398ff06604f03b27a28dd274f2ffa576
CVE ID: CVE-2023-22741 State: PUBLISHED Published: 2023-01-19T21:20:22.744Z Last Updated: 2025-03-10T21:21:43.727Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: freeswitch Products: sofia-sip Problem Types: CWE-120 Description: Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks both message length and attributes length checks** when it handles STUN packets, leading to controllable heap-over-flow. For example, in stun_parse_attribute(), after we get the attribute's type and length value, the length will be used directly to copy from the heap, regardless of the message's
e attribute's type and length value, the length will be used directly to copy from the heap, regardless of the message's left size. Since network users control the overflowed length, and the data is written to heap chunks later, attackers may achieve remote code execution by heap grooming or other exploitation methods. The bug was introduced 16 years ago in sofia-sip 1.12.4 (plus some patches through 12/21/2006) to in tree libs with git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@3774 d0543943-73ff-0310-b7d9-9358b9ac24b2. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
o known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54 - https://github.com/freeswitch/sofia-sip/commit/da53e4fbcb138b080a75576dd49c1fff2ada2764 - https://www.debian.org/security/2023/dsa-5410
CVE ID: CVE-2023-22742 State: PUBLISHED Published: 2023-01-20T22:49:06.378Z Last Updated: 2025-03-10T21:21:08.962Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: libgit2 Products: libgit2 Problem Types: CWE-347 Description: libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default -
certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libgit2/libgit2/security/advisories/GHSA-8643-3wh5-rmjq - https://github.com/libgit2/libgit2/commit/42e5db98b963ae503229c63e44e06e439df50e56 - https://github.com/libgit
h5-rmjq - https://github.com/libgit2/libgit2/commit/42e5db98b963ae503229c63e44e06e439df50e56 - https://github.com/libgit2/libgit2/commit/cd6f679af401eda1f172402006ef8265f8bd58ea - https://github.com/libgit2/libgit2/releases/tag/v1.4.5 - https://github.com/libgit2/libgit2/releases/tag/v1.5.1 - https://www.libssh2.org - http://www.openwall.com/lists/oss-security/2023/11/06/5
CVE ID: CVE-2023-22743 State: PUBLISHED Published: 2023-02-14T20:39:30.094Z Last Updated: 2025-03-10T21:11:18.086Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: git-for-windows Products: git Problem Types: CWE-426 Description: Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows i
th local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/git-for-windows/git/security/advisories/GHSA-p2x9-prp4-8gvq - https://github.com/git-for-windows/git/security/advisories/GHSA-gf48-x3vr-j5c3 - https://attack.mitre.org/technique
vq - https://github.com/git-for-windows/git/security/advisories/GHSA-gf48-x3vr-j5c3 - https://attack.mitre.org/techniques/T1574/002/ - https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1 - https://learn.microsoft.com/en-us/windows/win32/controls/cookbook-overview?redirectedfrom=MSDN#using-comctl32dll-version-6-in-an-application-that-uses-only-standard-extensions - https://learn.microsoft.com/en-us/windows/win32/sbscs/about-side-by-side-assemblies-
CVE ID: CVE-2023-22745 State: PUBLISHED Published: 2023-01-19T22:12:40.208Z Last Updated: 2025-11-21T19:10:18.693Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: tpm2-software Products: tpm2-tss Problem Types: CWE-120 Description: tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a resp
nly has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
4.0.1, and 3.2.2-rc1 fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-4j3v-fh23-vx67 - https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5 - https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89dae4e34e7 - https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabf
CVE ID: CVE-2023-22746 State: PUBLISHED Published: 2023-02-03T21:07:11.551Z Last Updated: 2025-03-10T21:16:37.925Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: ckan Products: ckan Problem Types: CWE-344, CWE-330 Description: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the `.env` file, that key was shared across different CKAN instances, making it easy to forge authentication requests. Users overriding the default secret
ed across different CKAN instances, making it easy to forge authentication requests. Users overriding the default secret key in their own `.env` file are not affected by this issue. Note that the legacy images (ckan/ckan) located in the main CKAN repo are not affected by this issue. The affected images are ckan/ckan-docker, (ckan/ckan-base images), okfn/docker-ckan (openknowledge/ckan-base and openknowledge/ckan-dev images) keitaroinc/docker-ckan (keitaro/ckan images). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ckan/ckan/security/advisories/GHSA-pr8j-v4c8-h62x - https://github.com/ckan/ckan/commit/44af0f0a148fcc0e0fbcf02fe69b7
om/ckan/ckan/security/advisories/GHSA-pr8j-v4c8-h62x - https://github.com/ckan/ckan/commit/44af0f0a148fcc0e0fbcf02fe69b7db13459a84b - https://github.com/ckan/ckan/commit/4c22c135fa486afa13855d1cdb9765eaf418d2aa
CVE ID: CVE-2023-22747 State: PUBLISHED Published: 2023-02-28T15:47:31.864Z Last Updated: 2025-03-11T14:09:40.056Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities re
I (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE ID: CVE-2023-22748 State: PUBLISHED Published: 2023-02-28T15:59:17.666Z Last Updated: 2025-03-07T21:04:02.055Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities re
CVE ID: CVE-2023-22749 State: PUBLISHED Published: 2023-02-28T16:05:47.658Z Last Updated: 2025-03-07T20:48:40.497Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities re
CVE ID: CVE-2023-22750 State: PUBLISHED Published: 2023-02-28T16:09:16.831Z Last Updated: 2025-03-07T20:47:28.814Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities re
CVE ID: CVE-2023-22751 State: PUBLISHED Published: 2023-02-28T16:28:42.105Z Last Updated: 2025-03-07T20:46:05.021Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities r
PI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE ID: CVE-2023-22752 State: PUBLISHED Published: 2023-02-28T16:30:06.487Z Last Updated: 2025-03-11T14:08:57.916Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities r
CVE ID: CVE-2023-22753 State: PUBLISHED Published: 2023-02-28T16:33:36.424Z Last Updated: 2025-03-11T14:07:56.369Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute
crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE ID: CVE-2023-22754 State: PUBLISHED Published: 2023-02-28T16:34:48.324Z Last Updated: 2025-03-07T18:11:24.957Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute
CVE ID: CVE-2023-22755 State: PUBLISHED Published: 2023-02-28T16:35:24.079Z Last Updated: 2025-03-07T18:10:42.680Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute
CVE ID: CVE-2023-22756 State: PUBLISHED Published: 2023-02-28T16:36:32.538Z Last Updated: 2025-03-07T18:10:01.599Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute
CVE ID: CVE-2023-22757 State: PUBLISHED Published: 2023-02-28T16:36:54.386Z Last Updated: 2025-03-07T18:09:19.826Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute
CVE ID: CVE-2023-22758 State: PUBLISHED Published: 2023-02-28T16:40:37.916Z Last Updated: 2025-03-07T18:07:58.897Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker
ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
CVE ID: CVE-2023-22759 State: PUBLISHED Published: 2023-02-28T16:41:28.980Z Last Updated: 2025-03-07T18:06:32.178Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker
CVE ID: CVE-2023-22760 State: PUBLISHED Published: 2023-02-28T16:42:04.666Z Last Updated: 2025-03-12T16:21:55.798Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker
CVE ID: CVE-2023-22761 State: PUBLISHED Published: 2023-02-28T16:42:41.162Z Last Updated: 2025-03-07T18:05:12.964Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Problem Types: n/a Description: Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker