Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug2.md
CVE ID: CVE-2023-45575 State: PUBLISHED Published: 2023-10-16T00:00:00 Last Updated: 2024-09-17T19:28:16.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the ip parameter of the ip_position.asp function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerber/bug
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug5.md
CVE ID: CVE-2023-45576 State: PUBLISHED Published: 2023-10-16T00:00:00 Last Updated: 2024-09-17T19:05:48.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the remove_ext_proto/remove_ext_port parameter of the upnp_ctrl.asp function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
he upnp_ctrl.asp function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug3.md
CVE ID: CVE-2023-45577 State: PUBLISHED Published: 2023-10-16T00:00:00 Last Updated: 2024-09-18T16:10:57.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the wanid parameter of the H5/speedlimit.data function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerb
on. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug9.md
CVE ID: CVE-2023-45578 State: PUBLISHED Published: 2023-10-16T00:00:00 Last Updated: 2024-09-18T14:16:25.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the pap_en/chap_en parameter of the pppoe_base.asp function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/A
function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug4.md
CVE ID: CVE-2023-45579 State: PUBLISHED Published: 2023-10-16T00:00:00 Last Updated: 2024-09-18T13:55:41.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the ip/type parameter of the jingx.asp function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerber/bug
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug8.md
CVE ID: CVE-2023-45580 State: PUBLISHED Published: 2023-10-16T00:00:00 Last Updated: 2024-10-16T15:01:53.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the wild/mx and other parameters of the ddns.asp function Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Arch
nction Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Archerber/bug_submit/blob/main/D-Link/DI-7xxxx/bug6.md
CVE ID: CVE-2023-45581 State: PUBLISHED Published: 2024-02-15T13:59:23.728Z Last Updated: 2024-08-02T20:21:16.534Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:U) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-269 Description: An improper privilege management vulnerability [CWE-269] in Fortinet FortiClientEMS version 7.2.0 through 7.2.2 and before 7.0.10 allows an Site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-357
CVE ID: CVE-2023-45582 State: PUBLISHED Published: 2023-11-14T18:05:34.247Z Last Updated: 2024-08-30T18:14:28.885Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiMail Problem Types: CWE-307 Description: An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to perform a brute force attack on the affected endpoints via repeated login attempts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-287
CVE ID: CVE-2023-45583 State: PUBLISHED Published: 2024-05-14T16:19:18.797Z Last Updated: 2024-08-02T20:21:16.756Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiProxy, FortiPAM, FortiSwitchManager, FortiOS Problem Types: CWE-134 Description: A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.5, 7.0.0 through 7.0.11, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 FortiPAM versions 1.1.0, 1.0.0 through 1.0.3 FortiOS versions 7.4.0, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15 FortiSwitchManager versions 7.2.0 through 7.2
gh 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15 FortiSwitchManager versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-137
CVE ID: CVE-2023-45584 State: PUBLISHED Published: 2025-08-12T18:59:35.883Z Last Updated: 2025-08-13T15:04:27.571Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiPAM, FortiProxy, FortiOS Problem Types: CWE-415 Description: A double free vulnerability [CWE-415] in Fortinet FortiOS version 7.4.0, version 7.2.0 through 7.2.5 and before 7.0.12, FortiProxy version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 and FortiPAM version 1.1.0 through 1.1.2 and before 1.0.3 allows a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests. Additional Analyst Notes: - CISA ADP Vulnrichme
attacker to execute code or commands via crafted HTTP or HTTPs requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-209
CVE ID: CVE-2023-45585 State: PUBLISHED Published: 2023-11-14T18:05:44.008Z Last Updated: 2024-08-30T18:12:40.795Z Severity: LOW (CVSS 2.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-532 Description: An insertion of sensitive information into log file vulnerability [CWE-532] in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below, version 6.5.1 and below, version 6.4.2 and below, version 6.3.3 and below, version 6.2.1 and below, version 6.1.2 and below, version 5.4.0, version 5.3.3 and below may allow an authenticated user to view an encrypted ElasticSearch password via debug log files generated whe
and below may allow an authenticated user to view an encrypted ElasticSearch password via debug log files generated when FortiSIEM is configured with ElasticSearch Event Storage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-392
CVE ID: CVE-2023-45586 State: PUBLISHED Published: 2024-05-14T16:19:09.998Z Last Updated: 2024-08-02T20:21:16.569Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-345 Description: An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted networ
13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-225
CVE ID: CVE-2023-45587 State: PUBLISHED Published: 2023-12-13T06:40:33.665Z Last Updated: 2024-08-28T13:45:02.305Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-79 Description: An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 allows attacker to execute unauthorized code or commands via crafted HTTP requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.
P requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-360
CVE ID: CVE-2023-45588 State: PUBLISHED Published: 2025-03-14T15:46:35.063Z Last Updated: 2025-03-14T17:40:22.223Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiClientMac Problem Types: CWE-73 Description: An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-345
CVE ID: CVE-2023-45589 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:05.925Z Description: No description available.
CVE ID: CVE-2023-45590 State: PUBLISHED Published: 2024-04-09T14:24:19.922Z Last Updated: 2024-08-12T17:46:37.654Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiClientLinux Problem Types: CWE-94 Description: An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows attacker to execute unauthorized code or commands via tricking a FortiClientLinux user into visiting a malicious website Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-087
CVE ID: CVE-2023-45591 State: PUBLISHED Published: 2024-03-05T11:19:46.198Z Last Updated: 2024-08-23T20:21:11.411Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-122 Description: A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “logger_generic” function of the “Ax_rtu” binary allows a remote authenticated attacker to trigger a memory corruption in the context of the binary. This may result in a Denial-of-Service (DoS) condition, possibly in the execution of arbitrary code with the same privileges of the process (root), or have other unspecified impacts on the device. This issue affects: AiLux imx6 bund
e privileges of the process (root), or have other unspecified impacts on the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45591
CVE ID: CVE-2023-45592 State: PUBLISHED Published: 2024-03-05T11:22:14.789Z Last Updated: 2024-08-12T17:29:47.646Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-250 Description: A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary being executed with the “--no-sandbox” option and with root privileges) exacerbates the impacts of successful attacks executed against the browser. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozomin
6_1.0.7-2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45592
CVE ID: CVE-2023-45593 State: PUBLISHED Published: 2024-03-05T11:27:46.837Z Last Updated: 2024-10-17T09:24:36.331Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-184 Description: A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than “ http://localhost” ) allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and have other unspecified impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle belo
ed impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45593
CVE ID: CVE-2023-45594 State: PUBLISHED Published: 2024-03-05T11:28:38.333Z Last Updated: 2024-08-12T17:31:54.836Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-552 Description: A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker to arbitrarily download/upload files to/from the file system, with unspecified impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
mx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45594
CVE ID: CVE-2023-45595 State: PUBLISHED Published: 2024-03-05T11:29:58.832Z Last Updated: 2024-08-22T18:33:06.637Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-434 Description: A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-a
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45595
CVE ID: CVE-2023-45596 State: PUBLISHED Published: 2024-03-05T11:31:08.100Z Last Updated: 2024-10-17T09:30:55.851Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-425 Description: A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “file_configuration” functionality of the web application allows a remote unauthenticated attacker to access confidential configuration files. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45
ichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45596
CVE ID: CVE-2023-45597 State: PUBLISHED Published: 2024-03-05T11:32:18.971Z Last Updated: 2024-08-28T16:25:51.316Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-1236 Description: A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web application (concerning the function “export_file”) allows a remote authenticated attacker to inject arbitrary formulas inside generated CSV files. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
undle below version imx6_1.0.7-2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45597
CVE ID: CVE-2023-45598 State: PUBLISHED Published: 2024-03-05T11:33:24.233Z Last Updated: 2024-10-17T09:32:54.237Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-425 Description: A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “measure” functionality of the web application allows a remote unauthenticated attacker to access confidential measure information. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45598
CVE ID: CVE-2023-45599 State: PUBLISHED Published: 2024-03-05T11:34:38.752Z Last Updated: 2024-08-02T20:21:16.689Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-646 Description: A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerabil
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45599
CVE ID: CVE-2023-45600 State: PUBLISHED Published: 2024-03-05T11:35:39.567Z Last Updated: 2024-08-12T17:30:54.064Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: AiLux Products: imx6 bundle Problem Types: CWE-613 Description: A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, facilitates session hijacking attacks against victims. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45600
CVE ID: CVE-2023-45601 State: PUBLISHED Published: 2023-10-10T10:21:47.253Z Last Updated: 2024-09-19T14:07:50.300Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Parasolid V35.0, Parasolid V35.1, Parasolid V36.0, Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-121 Description: A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.262), Parasolid V35.1 (All versions < V35.1.250), Parasolid V36.0 (All versions < V36.0.169), Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applica
n V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain a stack overflow vulnerability while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21290) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CVE ID: CVE-2023-45602 State: PUBLISHED Published: 2023-10-18T13:25:14.759Z Last Updated: 2024-09-12T18:10:29.815Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Shopfiles Ltd Products: Ebook Store Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.785 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ebook-store/wordpress-ebook-store-plugin-5-784-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45603 State: PUBLISHED Published: 2023-12-20T18:38:19.544Z Last Updated: 2024-08-02T20:21:16.836Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Jeff Starr Products: User Submitted Posts – Enable Users to Submit Posts from the Front End Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue affects User Submitted Posts – Enable Users to Submit Posts from the Front End: from n/a through 20230902. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability