Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-37908 State: PUBLISHED Published: 2023-10-25T16:53:25.679Z Last Updated: 2024-09-17T13:38:24.028Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-rendering Problem Types: CWE-83 Description: XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid attribute names. This can be exploited, e.g., via the link syntax in any content that supports XWiki syntax like comments in XWiki. When a user moves
xploited, e.g., via the link syntax in any content that supports XWiki syntax like comments in XWiki. When a user moves the mouse over a malicious link, the malicious JavaScript code is executed in the context of the user session. When this user is a privileged user who has programming rights, this allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. While this attribute was correctly recognized as not allowed, the attribute was still printed with a prefix `data-xwiki-translated-attribute-` without further cleaning or validation. This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by removing chara
-` without further cleaning or validation. This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by removing characters not allowed in data attributes and then validating the cleaned attribute again. There are no known workarounds apart from upgrading to a version including the fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-663w-2xp3-5739 - https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp - https://github.com/xwiki/xwiki-rendering/commit/f4d5acac451dccaf276e69f0b49b72221eef5d2f - https://jira.xwiki.org/browse/XRENDERING-697
CVE ID: CVE-2023-37909 State: PUBLISHED Published: 2023-10-25T17:09:59.187Z Last Updated: 2024-09-17T13:37:52.375Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.8 an
e execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.8 and 15.3-rc-1 by adding proper escaping. As a workaround, the patch can be manually applied to the document `Menu.UIExtensionSheet`; only three lines need to be changed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v2rr-xw95-wcjx - https://github.com/xwiki/xwiki-platform/commit/9e8f080094333dec63a8583229a3799208d773be - https://jira.xwiki.org/browse/XWIKI-20746
CVE ID: CVE-2023-37910 State: PUBLISHED Published: 2023-10-25T17:17:23.795Z Last Updated: 2024-09-17T13:37:20.995Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-862 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any document (can be the user profile which is editable by default) can move any attachment of any other document to this attacker-controlled document. This allows the
ditable by default) can move any attachment of any other document to this attacker-controlled document. This allows the attacker to access and possibly publish any attachment of which the name is known, regardless if the attacker has view or edit rights on the source document of this attachment. Further, the attachment is deleted from the source document. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1. There is no workaround apart from upgrading to a fixed version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rwwx-6572-mp29 - https://github.com/xwiki/xwiki
nces: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rwwx-6572-mp29 - https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325 - https://jira.xwiki.org/browse/XWIKI-20334
CVE ID: CVE-2023-37911 State: PUBLISHED Published: 2023-10-25T17:19:46.416Z Last Updated: 2024-09-17T13:36:53.642Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-668 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 9.4-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, when a document has been deleted and re-created, it is possible for users with view right on the re-created document but not on the deleted document to view the contents of the deleted document. Such a situation might arise when rights were added to the del
ed document to view the contents of the deleted document. Such a situation might arise when rights were added to the deleted document. This can be exploited through the diff feature and, partially, through the REST API by using versions such as `deleted:1` (where the number counts the deletions in the wiki and is thus guessable). Given sufficient rights, the attacker can also re-create the deleted document, thus extending the scope to any deleted document as long as the attacker has edit right in the location of the deleted document. This vulnerability has been patched in XWiki 14.10.8 and 15.3 RC1 by properly checking rights when deleted revisions of a document are accessed. The only workar
Wiki 14.10.8 and 15.3 RC1 by properly checking rights when deleted revisions of a document are accessed. The only workaround is to regularly clean deleted documents to minimize the potential exposure. Extra care should be taken when deleting sensitive documents that are protected individually (and not, e.g., by being placed in a protected space) or deleting a protected space as a whole. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gh64-qxh5-4m33 - https://github.com/xwiki/xwiki-platform/commit/f471f2a392aeeb9e51d59fdfe1d76fccf532523f - https://extensions.xwiki.org/xwiki/bin/view/Exte
/xwiki/xwiki-platform/commit/f471f2a392aeeb9e51d59fdfe1d76fccf532523f - https://extensions.xwiki.org/xwiki/bin/view/Extension/Index%20Application#HPermanentlydeleteallpages - https://jira.xwiki.org/browse/XWIKI-20684 - https://jira.xwiki.org/browse/XWIKI-20685 - https://jira.xwiki.org/browse/XWIKI-20817
CVE ID: CVE-2023-37912 State: PUBLISHED Published: 2023-10-25T17:33:54.756Z Last Updated: 2024-09-12T20:47:45.452Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-rendering Problem Types: CWE-270 Description: XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platform:xwiki-core-rendering-macro-footnotes` and `org.xwiki.platform:xwiki-rendering-macro-footnotes` and prior to version 15.1-rc-1 of `org.xwiki.platform:xwiki-rendering-macro-footnotes`, the footnote macro executed its content in a potentially different context than the one in
i-rendering-macro-footnotes`, the footnote macro executed its content in a potentially different context than the one in which it was defined. In particular in combination with the include macro, this allows privilege escalation from a simple user account in XWiki to programming rights and thus remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.6 and 15.1-rc-1. There is no workaround apart from upgrading to a fixed version of the footnote macro. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-rendering/secur
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-35j5-m29r-xfq5 - https://github.com/xwiki/xwiki-rendering/commit/5f558b8fac8b716d19999225f38cb8ed0814116e - https://jira.xwiki.org/browse/XRENDERING-688
CVE ID: CVE-2023-37913 State: PUBLISHED Published: 2023-10-25T17:59:46.290Z Last Updated: 2024-09-12T20:46:58.102Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-23, CWE-22 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versions 14.10.8 and 15.3-rc-1, triggering the office converter with a specially crafted file name allows writing the attachment's content to an attacker-controlled location on the server as long as the Java process has write access to that location. In particular in the co
controlled location on the server as long as the Java process has write access to that location. In particular in the combination with attachment moving, a feature introduced in XWiki 14.0, this is easy to reproduce but it also possible to reproduce in versions as old as XWiki 3.5 by uploading the attachment through the REST API which doesn't remove `/` or `\` from the filename. As the mime type of the attachment doesn't matter for the exploitation, this could e.g., be used to replace the `jar`-file of an extension which would allow executing arbitrary Java code and thus impact the confidentiality, integrity and availability of the XWiki installation. This vulnerability has been patched in X
pact the confidentiality, integrity and availability of the XWiki installation. This vulnerability has been patched in XWiki 14.10.8 and 15.3RC1. There are no known workarounds apart from disabling the office converter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vcvr-v426-3m3m - https://github.com/xwiki/xwiki-platform/commit/45d182a4141ff22f3ff289cf71e4669bdc714544 - https://jira.xwiki.org/browse/XWIKI-20715
CVE ID: CVE-2023-37914 State: PUBLISHED Published: 2023-08-17T17:21:23.571Z Last Updated: 2024-10-08T16:22:04.023Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-94 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.WebHome` can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6. Users are advised to upgrade. Users una
ts. This vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6. Users are advised to upgrade. Users unable to upgrade may manually apply the patch on `Invitation.InvitationCommon` and `Invitation.InvitationConfig`, but there are otherwise no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7954-6m9q-gpvf - https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591 - https://jira.xwiki.org/browse/XWIKI-20421
CVE ID: CVE-2023-37915 State: PUBLISHED Published: 2023-07-21T20:02:07.734Z Last Updated: 2024-10-10T18:56:19.862Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenDDS Products: OpenDDS Problem Types: CWE-20 Description: OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS crashes while parsing a malformed `PID_PROPERTY_LIST` in a DATA submessage during participant discovery. Attackers can remotely crash OpenDDS processes by sending a DATA submessage containing the malformed parameter to the known multicast port. This issue has been addressed in version 3.25. Users are advised to upgrade.
rmed parameter to the known multicast port. This issue has been addressed in version 3.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-v5pp-7prc-5xq9 - https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.25
CVE ID: CVE-2023-37916 State: PUBLISHED Published: 2023-07-21T20:15:12.050Z Last Updated: 2024-10-10T18:36:15.480Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: 1Panel-dev Products: KubePi Problem Types: CWE-200 Description: KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA AD
ade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h
CVE ID: CVE-2023-37917 State: PUBLISHED Published: 2023-07-21T20:13:22.401Z Last Updated: 2024-10-10T18:37:38.475Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) Vendors: 1Panel-dev Products: KubePi Problem Types: CWE-269 Description: KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-757p-vx43-fp9r
CVE ID: CVE-2023-37918 State: PUBLISHED Published: 2023-07-21T20:08:00.768Z Last Updated: 2024-10-10T18:40:09.738Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: dapr Products: dapr Problem Types: CWE-287 Description: Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users w
API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj - https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a - https://docs.dapr.io/operations
qm-vqgj - https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a - https://docs.dapr.io/operations/security/api-token/
CVE ID: CVE-2023-37919 State: PUBLISHED Published: 2023-07-25T20:42:28.825Z Last Updated: 2024-10-16T19:45:12.080Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: calcom Products: cal.com Problem Types: CWE-613 Description: Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist. Additional Analyst
rify the account owner's identity. As of time of publication, no known patches or workarounds exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/calcom/cal.com/security/advisories/GHSA-cpf2-q635-xrwx
CVE ID: CVE-2023-37920 State: PUBLISHED Published: 2023-07-25T20:45:35.286Z Last Updated: 2025-03-05T18:47:15.819Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: certifi Products: python-certifi Problem Types: CWE-345 Description: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. Addition
urity issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7 - https://github.com/certifi/python-certifi/commit/8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909 - https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EX6NG7WUFNUKGFHLM35KHHU3GAKXRTG/
CVE ID: CVE-2023-37921 State: PUBLISHED Published: 2024-01-08T14:47:50.434Z Last Updated: 2025-11-04T18:15:48.278Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-118 Description: Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2vzt conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
vcd2vzt conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1807 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-37922 State: PUBLISHED Published: 2024-01-08T14:47:50.523Z Last Updated: 2025-11-04T18:15:49.518Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-118 Description: Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt2 conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
vcd2lxt2 conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1807 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-37923 State: PUBLISHED Published: 2024-01-08T14:47:50.618Z Last Updated: 2025-11-04T18:15:50.688Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-118 Description: Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
vcd2lxt conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1807 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-37924 State: PUBLISHED Published: 2023-11-22T09:19:23.372Z Last Updated: 2024-08-02T17:23:27.763Z Vendors: Apache Software Foundation Products: Apache Submarine Problem Types: CWE-89 Description: Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fixed this issue and now user must have the correct login to access workbench. This issue affects Apache Submarine: from 0.7.0 before 0.8.0. We recommend that all submarine users with 0.7.0 upgrade to 0.8.0, which not only fixes the issue, supports the oidc authentication mode, but also removes the case of unauthenticated logins
ich not only fixes the issue, supports the oidc authentication mode, but also removes the case of unauthenticated logins. If using the version lower than 0.8.0 and not want to upgrade, you can try cherry-pick PR https://github.com/apache/submarine/pull/1037 https://github.com/apache/submarine/pull/1054 and rebuild the submarine-server image to fix this. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/SUBMARINE-1361 - https://github.com/apache/submarine/pull/1037 - https://lists.apache.org/thread/g99h773vd49n1wyghdq1llv2f83w1b3r
CVE ID: CVE-2023-37925 State: PUBLISHED Published: 2023-11-28T01:30:55.186Z Last Updated: 2024-08-02T17:23:27.715Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware, VPN series firmware, NWA50AX firmware, WAC500 firmware, WAX300H firmware, WBE660S firmware Problem Types: CWE-269 Description: An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(