Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-22611 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-02-05T20:06:52.179Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) Problem Types: CWE-200 Description: A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are sent to the server over the database server TCP port. Affected Products: EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) (Versions prior to October 2022) Additional Analyst Notes: - CVE
CADA Expert 2019 - 2021 (formerly known as ClearSCADA) (Versions prior to October 2022) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf
CVE ID: CVE-2023-22612 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T17:18:14.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. A malicious host OS can invoke an Insyde SMI handler with malformed arguments, resulting in memory corruption in SMM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ - https://www.insyde.com/security-pledge/SA-2023019
CVE ID: CVE-2023-22613 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T20:07:03.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. It is possible to write to an attacker-controlled address. An attacker could invoke an SMI handler with a malformed pointer in RCX that overlaps SMRAM, resulting in SMM memory corruption. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ - https://www.insyde.com/security-pledge/
tps://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ - https://www.insyde.com/security-pledge/SA-2023023
CVE ID: CVE-2023-22614 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T20:09:44.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There is insufficient input validation in BIOS Guard updates. An attacker can induce memory corruption in SMM by supplying malformed inputs to the BIOS Guard SMI handler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023020 - https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/
CVE ID: CVE-2023-22615 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-11T20:11:22.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI subfunction execution may corrupt SMRAM. An attacker can pass an address in the RCX save state register that overlaps SMRAM, thereby coercing an IHISI subfunction handler to overwrite private SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023021
CVE ID: CVE-2023-22616 State: PUBLISHED Published: 2023-04-12T00:00:00.000Z Last Updated: 2025-02-10T16:27:20.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ - https://www.insyde.com/security-pledg
https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ - https://www.insyde.com/security-pledge/SA-2023022
CVE ID: CVE-2023-22617 State: PUBLISHED Published: 2023-01-21T00:00:00.000Z Last Updated: 2025-04-03T14:38:29.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, because QName minimization is used in QM fallback mode. This is fixed in 4.8.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.powerdns.com/recursor/security-advisories/ - http://www.openwall.com/lists/oss-security/2023/01/20/1 - https://docs.powerdns.com/recursor/changelog/4.8.html#change-4.8.1
CVE ID: CVE-2023-22618 State: PUBLISHED Published: 2023-10-04T00:00:00 Last Updated: 2024-09-20T13:55:55.837Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, WaveLite Metro 200 OPS and Fans, WaveLite Metro 200 and F2B fans, WaveLite Metro 200 OPS and F2B fans, WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans. Additional Analyst Notes: - CVE Program
WaveLite Metro 200 NE and F2B fans, and WaveLite Metro 200 NE OPS and F2B fans. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nokia.com - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-22618/
CVE ID: CVE-2023-22620 State: PUBLISHED Published: 2023-04-12T00:00:00.000Z Last Updated: 2025-02-13T16:43:54.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rcesecurity.com - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22620.txt - http://seclists.org/fulldisclosure/2023/
https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22620.txt - http://seclists.org/fulldisclosure/2023/Apr/7 - http://packetstormsecurity.com/files/171924/SecurePoint-UTM-12.x-Session-ID-Leak.html
CVE ID: CVE-2023-22621 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-11-07T17:06:39.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/strapi/strapi/releases - https://www.ghostccamm.com/blog/mult
- CISA ADP Vulnrichment: References: - https://github.com/strapi/strapi/releases - https://www.ghostccamm.com/blog/multi_strapi_vulns/ - https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
CVE ID: CVE-2023-22622 State: PUBLISHED Published: 2023-01-05T00:00:00.000Z Last Updated: 2025-04-07T18:38:53.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
tions with very few visits. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40thecpanelguy/the-nightmare-that-is-wpcron-php-ae31c1d3ae30 - https://www.tenable.com/plugins/was/113449 - https://github.com/WordPress/WordPress/blob/dca7b5204b5fea54e6d1774689777b359a9222ab/wp-cron.php#L5-L8 - https://developer.wordpress.org/plugins/cron/ - https://wordpress.org/about/security/ - https://wordpress.org/support/article/how-to-install-wordpress/ - https://patchstack.com/articles/solving-unpredictable-wp-cron-problems-addressing-cve-2023-22622/
CVE ID: CVE-2023-22624 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-04T17:40:54.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2023-22624.html
CVE ID: CVE-2023-22626 State: PUBLISHED Published: 2023-01-05T00:00:00.000Z Last Updated: 2025-04-07T18:13:40.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ankane/pghero/issues/439
CVE ID: CVE-2023-22629 State: PUBLISHED Published: 2023-02-14T00:00:00.000Z Last Updated: 2025-03-20T20:22:52.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf - https://titanftp.com - https://f20.be/cves/titan-ftp-vulnerabilities - http://packetstormsecurity.com/files/171737/Titan-F
tps://titanftp.com - https://f20.be/cves/titan-ftp-vulnerabilities - http://packetstormsecurity.com/files/171737/Titan-FTP-Path-Traversal.html
CVE ID: CVE-2023-22630 State: PUBLISHED Published: 2023-01-23T00:00:00.000Z Last Updated: 2025-04-02T15:40:24.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: IzyBat Orange casiers before 20221102_1 allows SQL Injection via a getCasier.php?taille= URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/orangecertcc/security-research/security/advisories/GHSA-j94f-5cg6-6j9j
CVE ID: CVE-2023-22633 State: PUBLISHED Published: 2023-06-13T08:41:44.268Z Last Updated: 2024-10-23T14:26:31.560Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:X/RL:X/RC:R) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-264 Description: An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions 8.7.0 all versions may allow an unauthenticated attacker to perform a DoS attack on the device via client-secure renegotiation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-521
CVE ID: CVE-2023-22635 State: PUBLISHED Published: 2023-04-11T16:05:35.785Z Last Updated: 2024-10-23T14:30:57.422Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiClientMac Problem Types: CWE-494 Description: A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions, 5.6 all versions, 5.4 all versions, 5.2 all versions, 5.0 all versions and 4.0 all versions may allow a local attacker to escalate their privileges via modifying the installer upon upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP
their privileges via modifying the installer upon upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-481
CVE ID: CVE-2023-22636 State: PUBLISHED Published: 2023-02-27T08:55:03.706Z Last Updated: 2024-10-23T14:32:01.030Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-285 Description: An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker to access confidential configuration files via a crafted http request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-460
CVE ID: CVE-2023-22637 State: PUBLISHED Published: 2023-05-03T21:27:03.507Z Last Updated: 2024-10-23T14:27:38.847Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-79 Description: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
to trigger remote code execution via crafted licenses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-013
CVE ID: CVE-2023-22638 State: PUBLISHED Published: 2023-02-16T18:07:06.780Z Last Updated: 2024-10-23T14:32:18.357Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-79 Description: Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and below, 8.3.7 and below may allow an authenticated attacker to perform several XSS attacks via crafted HTTP GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
via crafted HTTP GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-260
CVE ID: CVE-2023-22639 State: PUBLISHED Published: 2023-06-13T08:41:44.785Z Last Updated: 2024-10-23T14:26:22.679Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-787 Description: A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows attacker to e
versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows attacker to escalation of privilege via specifically crafted commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-494
CVE ID: CVE-2023-22640 State: PUBLISHED Published: 2023-05-03T21:26:29.469Z Last Updated: 2024-10-23T14:28:13.885Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-787 Description: A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS version 6.2.0 through 6.2.13, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an
Proxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-475
CVE ID: CVE-2023-22641 State: PUBLISHED Published: 2023-04-11T16:06:13.309Z Last Updated: 2024-10-22T20:47:37.434Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N/E:H/RL:U/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-601 Description: A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all v
0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specially crafted requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-479
CVE ID: CVE-2023-22642 State: PUBLISHED Published: 2023-04-11T16:07:12.104Z Last Updated: 2024-10-23T14:28:22.085Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: CWE-295 Description: An improper certificate validation vulnerability [CWE-295] in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the remote FortiGuard server hosting outbreakalert ressources. Additional Analyst Notes: - CVE Program Container
ice and the remote FortiGuard server hosting outbreakalert ressources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-502
CVE ID: CVE-2023-22643 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T14:31:19.350Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Server for SAP 15-SP3, openSUSE Leap 15.4 Problem Types: CWE-78 Description: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise Server for SAP 15-SP3; openSUSE Leap 15.4 allows attackers that can trick users to use specially crafted REPO_ALIAS, REPO_TYPE or REPO_METADATA_PATH settings to execute code as root. This issue affects: SUSE Linux Enterp
fted REPO_ALIAS, REPO_TYPE or REPO_METADATA_PATH settings to execute code as root. This issue affects: SUSE Linux Enterprise Server for SAP 15-SP3 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426. openSUSE Leap 15.4 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1206836
CVE ID: CVE-2023-22644 State: PUBLISHED Published: 2023-09-20T08:12:34.130Z Last Updated: 2025-04-07T17:19:01.804Z Vendors: SUSE Products: neuvector Problem Types: CWE-1270 Description: A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32188 - https://github.com/neuvector/neuvector/security/advisories/GHSA-622h-h2p8-743x
CVE ID: CVE-2023-22645 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T16:43:52.282Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: kubewarden Problem Types: CWE-269 Description: An Improper Privilege Management vulnerability in SUSE kubewarden allows attackers to read arbitrary secrets if they get access to the ServiceAccount kubewarden-controller This issue affects: SUSE kubewarden kubewarden-controller versions prior to 1.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1210218
CVE ID: CVE-2023-22647 State: PUBLISHED Published: 2023-06-01T12:52:49.035Z Last Updated: 2025-01-09T17:00:41.345Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-267 Description: An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in
other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster. This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rancher/rancher/security/advisories/GHSA-p976-h52c-26p6 - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22647
CVE ID: CVE-2023-22648 State: PUBLISHED Published: 2023-06-01T12:49:35.238Z Last Updated: 2024-10-09T08:32:01.217Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-271 Description: A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: fr