Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ly compromise confidentiality, integrity and availability of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3305369 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27498 State: PUBLISHED Published: 2023-03-14T05:04:32.685Z Last Updated: 2025-02-27T18:03:07.307Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: SAP Products: Host Agent (SAPOSCOL) Problem Types: CWE-121 Description: SAP Host Agent (SAPOSCOL) - version 7.22, allows an unauthenticated attacker with network access to a server port assigned to the SAP Start Service to submit a crafted request which results in a memory corruption error. This error can be used to reveal but not modify any technical information about the server. It can also make a particular service temporarily unavailable Additional Analyst Notes: - CVE Program Container: - CISA A
t can also make a particular service temporarily unavailable Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3275727 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27499 State: PUBLISHED Published: 2023-04-11T02:48:52.677Z Last Updated: 2025-02-07T19:32:04.550Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: GUI for HTML Problem Types: CWE-79 Description: SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web
k, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3275458 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27500 State: PUBLISHED Published: 2023-03-14T05:05:20.861Z Last Updated: 2024-08-02T12:16:35.333Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: SAP Products: NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program) Problem Types: CWE-22 Description: An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no data can be read but potentially critical OS files can be over-written making the system unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/33
lyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3302162 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27501 State: PUBLISHED Published: 2023-03-14T05:06:17.678Z Last Updated: 2025-02-27T18:02:25.893Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: SAP Products: NetWeaver AS for ABAP and ABAP Platform Problem Types: CWE-22 Description: SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unav
ystem files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3294954 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27502 State: PUBLISHED Published: 2024-03-14T16:45:49.763Z Last Updated: 2024-08-02T12:16:35.443Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) Local Manageability Service software Problem Types: information disclosure, CWE-532 Description: Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2316.5.1.2 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-
richment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00923.html
CVE ID: CVE-2023-27504 State: PUBLISHED Published: 2024-05-16T20:47:48.296Z Last Updated: 2024-08-02T12:16:36.604Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: n/a Products: Intel(R) BIOS Guard firmware Problem Types: escalation of privilege, CWE-92 Description: Improper conditions check in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00814.html
CVE ID: CVE-2023-27505 State: PUBLISHED Published: 2023-08-11T02:37:10.914Z Last Updated: 2024-10-10T15:14:17.018Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Advanced Link Analyzer Standard Edition software installers Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installers before version 22.1 .1 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/secu
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00848.html
CVE ID: CVE-2023-27506 State: PUBLISHED Published: 2023-08-11T02:37:08.711Z Last Updated: 2024-10-02T13:38:01.152Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L) Vendors: n/a Products: Intel(R) Optimization for Tensorflow software Problem Types: escalation of privilege, CWE-92 Description: Improper buffer restrictions in the Intel(R) Optimization for Tensorflow software before version 2.12 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00840.html
CVE ID: CVE-2023-27507 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T13:56:10.356Z Vendors: MicroEngine Inc. Products: MicroEngine Mailform Problem Types: Path traversal Description: MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://microengine.jp/information/security_2023_05.html - https://jvn.jp/en/jp/JVN31701509/
CVE ID: CVE-2023-27509 State: PUBLISHED Published: 2023-08-11T02:37:11.479Z Last Updated: 2024-10-02T13:32:11.287Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: n/a Products: Intel(R) ISPC software installers Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel(R) ISPC software installers before version 1.19.0 may allow an authenticated user to potentially enable escalation of privileges via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00849.html
CVE ID: CVE-2023-27510 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-28T14:22:17.537Z Vendors: Jubei Inc. Products: JB Inquiry form Problem Types: Exposure of private personal information to an unauthorized actor Description: JB Inquiry form contains an exposure of private personal information to an unauthorized actor vulnerability, which may allow a remote unauthenticated attacker to obtain information entered from forms created using the affected product. The affected products and versions are as follows: JB Inquiry form versions 0.6.1 and 0.6.0, JB Inquiry form versions 0.5.2, 0.5.1 and 0.5.0, and JB Inquiry form version 0.40. Additional Analyst Notes: - CVE P
.0, JB Inquiry form versions 0.5.2, 0.5.1 and 0.5.0, and JB Inquiry form version 0.40. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jubei.co.jp/formmail/info20230414.html - https://jvn.jp/en/jp/JVN36340790/
CVE ID: CVE-2023-27512 State: PUBLISHED Published: 2023-05-23T00:00:00 Last Updated: 2025-01-17T17:53:35.746Z Vendors: Contec Co., Ltd. Products: SolarView Compact Problem Types: Use of hard-coded credentials Description: Use of hard-coded credentials exists in SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10, and SV-CPT-MC310F versions prior to Ver.8.10, which may allow a remote authenticated attacker to login the affected product with an administrative privilege and perform an unintended operation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#f
nrichment: References: - https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware - https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_solarview_230508.pdf - https://jvn.jp/en/vu/JVNVU92106300/
CVE ID: CVE-2023-27513 State: PUBLISHED Published: 2023-11-14T19:05:11.201Z Last Updated: 2025-06-11T14:21:54.639Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server Information Retrieval Utility software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path element in some Intel(R) Server Information Retrieval Utility software before version 16.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/inte
Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00894.html
CVE ID: CVE-2023-27514 State: PUBLISHED Published: 2023-05-23T00:00:00 Last Updated: 2025-01-16T19:52:43.737Z Vendors: Contec Co., Ltd. Products: SolarView Compact Problem Types: OS Command Injection Description: OS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8.10 allows a remote authenticated attacker to execute an arbitrary OS command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware - https://www.contec.com/jp/api/downloadlogger?download=/
oad-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware - https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_solarview_230508.pdf - https://jvn.jp/en/vu/JVNVU92106300/
CVE ID: CVE-2023-27515 State: PUBLISHED Published: 2023-08-11T02:37:16.376Z Last Updated: 2024-10-09T20:35:21.926Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) DSA software Problem Types: escalation of privilege, CWE-79 Description: Cross-site scripting (XSS) for the Intel(R) DSA software before version 23.1.9 may allow unauthenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00878.html
CVE ID: CVE-2023-27516 State: PUBLISHED Published: 2023-10-12T15:27:52.223Z Last Updated: 2024-08-02T12:16:36.884Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: SoftEther VPN Products: SoftEther VPN Problem Types: CWE-453 Description: An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754 - htt
tainer: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754 - https://www.softether.org/9-about/News/904-SEVPN202301
CVE ID: CVE-2023-27517 State: PUBLISHED Published: 2024-02-14T13:38:00.967Z Last Updated: 2024-08-16T15:51:16.583Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: n/a Products: Intel(R) Optane(TM) PMem software Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel(R) Optane(TM) PMem software before versions 01.00.00.3547, 02.00.00.3915, 03.00.00.0483 may allow an athenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00948.htm
CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00948.html
CVE ID: CVE-2023-27518 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T14:50:44.826Z Vendors: Contec Co., Ltd. Products: SolarView Compact Problem Types: Buffer Overflow Description: Buffer overflow vulnerability in the multiple setting pages of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8.10 allows a remote authenticated attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware - https://www.contec.com/jp/api/downloadlogger?download=/-/med
ist/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware - https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_solarview_230508.pdf - https://jvn.jp/en/vu/JVNVU92106300/
CVE ID: CVE-2023-27519 State: PUBLISHED Published: 2023-11-14T19:04:55.720Z Last Updated: 2025-06-11T14:22:41.353Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L) Vendors: n/a Products: Intel(R) Optane(TM) SSD products Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00758.html
CVE ID: CVE-2023-27520 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-10T21:27:09.702Z Vendors: SEIKO EPSON CORPORATION Products: SEIKO EPSON printers/network interface Web Config Problem Types: Cross-site request forgery Description: Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authentication and perform unintended operations by having a logged-in user view a malicious page. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON
he status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.epson.jp/support/misc_t/230308_oshirase.htm - https://jvn.jp/en/jp/JVN82424996/
CVE ID: CVE-2023-27521 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T13:56:36.865Z Vendors: Contec Co., Ltd. Products: SolarView Compact Problem Types: OS Command Injection Description: OS command injection vulnerability in the mail setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8.10 allows remote authenticated attackers to execute an arbitrary OS command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware - https://www.contec.com/jp/api/downloadlogger?do
ad/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware - https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_solarview_230508.pdf - https://jvn.jp/en/vu/JVNVU92106300/
CVE ID: CVE-2023-27522 State: PUBLISHED Published: 2023-03-07T15:09:30.122Z Last Updated: 2025-02-13T16:45:26.302Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-444 Description: HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html - https://sec
.org/security/vulnerabilities_24.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html - https://security.gentoo.org/glsa/202309-01
CVE ID: CVE-2023-27523 State: PUBLISHED Published: 2023-09-06T12:55:31.286Z Last Updated: 2024-09-26T15:24:13.311Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-863 Description: Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h
CVE ID: CVE-2023-27524 State: PUBLISHED Published: 2023-04-24T15:28:16.573Z Last Updated: 2025-10-21T23:05:48.552Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-1188 Description: Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a u
dministrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk - https://www.openwall.com/lists/oss-security/2023/04/24/2 - https://packetstormsecu
ad/n0ftx60sllf527j7g11kmt24wvof8xyk - https://www.openwall.com/lists/oss-security/2023/04/24/2 - https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html - https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html
CVE ID: CVE-2023-27525 State: PUBLISHED Published: 2023-04-17T16:28:00.286Z Last Updated: 2024-10-15T16:04:34.641Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-863 Description: An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/wpv7b17zjg2pmvpfkdd6nn8sco8y2q77
CVE ID: CVE-2023-27526 State: PUBLISHED Published: 2023-09-06T12:44:45.161Z Last Updated: 2024-09-26T15:29:27.835Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-863 Description: A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/ndww89yl2jd98lvn23n9cj722lfdg8dv
CVE ID: CVE-2023-27527 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-28T14:19:39.693Z Vendors: The Ministry of Justice Products: Shinseiyo Sogo Soft Problem Types: Improper restriction of XML external entity reference (XXE) Description: Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.touki-kyoutaku-online.moj.go.jp/ - https://jvn.jp/en/jp/JVN73178249/
CVE ID: CVE-2023-27529 State: PUBLISHED Published: 2023-05-25T00:00:00 Last Updated: 2025-01-16T15:19:56.150Z Vendors: Wacom Products: Wacom Tablet Driver installer Problem Types: Improper link resolution before file access ('Link Following') Description: Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vulnerability. When a user is tricked to execute a small malicious script before executing the affected version of the installer, arbitrary code may be executed with the root privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wacom.com/en-us/support/product-support/d