Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-50581 State: PUBLISHED Published: 2025-10-22T13:23:33.421Z Last Updated: 2025-10-22T13:23:33.421Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hfs: fix OOB Read in __hfs_brec_find Syzbot reported a OOB read bug: ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 Read of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11 CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.1.0-rc6-syzkaller-00308-g644e9524388a #0 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump
9524388a #0 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 __hfs_brec_find+0x213/0x5c0 fs/hfs/bfind.c:75 hfs_brec_find+0x276/0x520 fs/hfs/bfind.c:138 hfs_write_inode+0x34c/0xb40 fs/hfs/inode.c:462 write_inode fs/fs-writeback.c:1440 [inline] If the input inode of hfs_write_inode() is incorrect: struct inode struct hfs_inode_info struct hfs_cat_key struct hfs_name u8 len # len is greater than HFS_NAM
is incorrect: struct inode struct hfs_inode_info struct hfs_cat_key struct hfs_name u8 len # len is greater than HFS_NAMELEN(31) which is the maximum length of an HFS filename OOB read occurred: hfs_write_inode() hfs_brec_find() __hfs_brec_find() hfs_cat_keycmp() hfs_strcmp() # OOB read occurred due to len is too large Fix this by adding a Check on len in hfs_write_inode() before calling hfs_brec_find(). References: - https://git.kernel.org/stable/c/8c40f2dbae603ef0bd21e87c63f54ec59fd88256 - https://git.kernel.org/stable/c/c886c10a6eddb99923b315f42bf63f448883ef9a - https://git.kernel.org/stable/c/2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30 - https://git.kernel.org/stable/c/90103ccb6e60aa4efe489
git.kernel.org/stable/c/2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30 - https://git.kernel.org/stable/c/90103ccb6e60aa4efe48993d23d6a528472f2233 - https://git.kernel.org/stable/c/4fd3a11804c8877ff11fec59c5c53f1635331e3e - https://git.kernel.org/stable/c/367296925c7625c3969d2a78d7a3e1dee161beb5 - https://git.kernel.org/stable/c/e9e692917c6e10a7066c7a6d092dcdc3d4e329f3 - https://git.kernel.org/stable/c/bfc9d8f27f89717431a6aecce42ae230b437433f - https://git.kernel.org/stable/c/8d824e69d9f3fa3121b2dda25053bae71e2460d2
CVE ID: CVE-2022-50582 State: PUBLISHED Published: 2025-10-22T13:23:34.037Z Last Updated: 2025-10-22T13:23:34.037Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: regulator: core: Prevent integer underflow By using a ratio of delay to poll_enabled_time that is not integer time_remaining underflows and does not exit the loop as expected. As delay could be derived from DT and poll_enabled_time is defined in the driver this can easily happen. Use a signed iterator to make sure that the loop exits once the remaining time is negative. References: - https://git.kernel.org/stable/c/b051d9bf98bd9cea312b228e264eb6542a9beb67 - https://git
g time is negative. References: - https://git.kernel.org/stable/c/b051d9bf98bd9cea312b228e264eb6542a9beb67 - https://git.kernel.org/stable/c/e33da263e9658bfe870ea7836fbbd72f246d7dbd - https://git.kernel.org/stable/c/9f2395316e4845466cb9b5b9b15a171a2c91913c - https://git.kernel.org/stable/c/bfe602d9a349360e60e9051c9cafb9fef204524d - https://git.kernel.org/stable/c/8d8e16592022c9650df8aedfe6552ed478d7135b
CVE ID: CVE-2022-50584 State: PUBLISHED Published: 2025-10-30T21:36:08.674Z Last Updated: 2025-11-17T18:21:44.197Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.6 / Nagios XI 5.8.8 contains a cross-site scripting (XSS) vulnerability via the search and deletion interfaces. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-search-and-d
- https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-search-and-deletion-flows
CVE ID: CVE-2022-50585 State: PUBLISHED Published: 2025-10-30T21:34:05.777Z Last Updated: 2025-11-17T18:21:44.381Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.7 / Nagios XI 5.8.9 contains a cross-site scripting (XSS) vulnerability via the Audit Log page search input. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-audit-log-page-
https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-audit-log-page-search-input
CVE ID: CVE-2022-50586 State: PUBLISHED Published: 2025-10-30T21:45:53.493Z Last Updated: 2025-11-17T18:21:44.541Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the BPI component via the info URL field. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-stored-xss-via-bpi-info-url
CVE ID: CVE-2022-50587 State: PUBLISHED Published: 2025-10-30T21:46:15.817Z Last Updated: 2025-11-17T18:21:44.766Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) via the Apply Configuration error text. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-stored-xss-via-command-names-in-apply-config-error-text
CVE ID: CVE-2022-50588 State: PUBLISHED Published: 2025-10-30T21:45:33.708Z Last Updated: 2025-11-17T18:21:44.935Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the update checking feature. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-stored-xss-in-update-checking
CVE ID: CVE-2022-50589 State: PUBLISHED Published: 2025-11-06T19:59:12.520Z Last Updated: 2025-11-06T20:27:20.421Z Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6 - https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/ - https://www.vulncheck.com/a
odusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/ - https://www.vulncheck.com/advisories/suitecrm-sqli-via-export-functionality
CVE ID: CVE-2022-50590 State: PUBLISHED Published: 2025-11-06T19:59:36.078Z Last Updated: 2025-11-06T20:26:09.006Z Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-843 Description: SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6 - https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-deleteattac
.suitecrm.com/admin/releases/7.12.x/#_7_12_6 - https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-deleteattachment-type-confusion-vulnerability/ - https://www.vulncheck.com/advisories/suitecrm-type-confusion-via-deleteattachment-functionality
CVE ID: CVE-2022-50591 State: PUBLISHED Published: 2025-11-06T19:58:06.223Z Last Updated: 2025-11-15T23:58:29.068Z Vendors: Advantech Products: iView Problem Types: CWE-89, CWE-306 Description: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_config_id’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for the exfiltration of user data, included clear text passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advantech.tw/support/details/firmware?id=1-HIPU
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advantech.tw/support/details/firmware?id=1-HIPU-183 - https://blog.exodusintel.com/2022/03/01/advantech-iview-ztp_config_id-parameter-sql-injection-information-disclosure-vulnerability/ - https://www.vulncheck.com/advisories/advantech-iview-ztpconfigid-parameter-sqli-information-disclosure
CVE ID: CVE-2022-50592 State: PUBLISHED Published: 2025-11-06T19:57:20.528Z Last Updated: 2025-11-15T23:58:49.386Z Vendors: Advantech Products: iView Problem Types: CWE-89, CWE-306 Description: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘getInventoryReportData’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advantech.tw/support/details/firmware?id=1-HIPU
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advantech.tw/support/details/firmware?id=1-HIPU-183 - https://blog.exodusintel.com/2022/03/01/advantech-iview-getinventoryreportdata-parameter-sql-injection-information-disclosure/ - https://www.vulncheck.com/advisories/advantech-iview-getinventoryreportdata-parameter-sqli-rce
CVE ID: CVE-2022-50593 State: PUBLISHED Published: 2025-11-06T19:57:44.271Z Last Updated: 2025-11-15T23:59:11.781Z Vendors: Advantech Products: iView Problem Types: CWE-89, CWE-306 Description: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘search_term’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advantech.tw/support/details/firmware?id=1-HIPU-183 - http
yst Notes: - CISA ADP Vulnrichment: References: - https://www.advantech.tw/support/details/firmware?id=1-HIPU-183 - https://blog.exodusintel.com/2022/03/01/advantech-iview-search_term-parameter-sql-injection-remote-code-execution-vulnerability/ - https://www.vulncheck.com/advisories/advantech-iview-searchterm-parameter-sqli-rce
CVE ID: CVE-2022-50594 State: PUBLISHED Published: 2025-11-06T19:57:00.425Z Last Updated: 2025-11-15T23:59:29.701Z Vendors: Advantech Products: iView Problem Types: CWE-89, CWE-306 Description: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘data’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for the exfiltration of user data, included clear text passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advantech.tw/support/details/firmware?id=1-HIPU-183 - ht
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.advantech.tw/support/details/firmware?id=1-HIPU-183 - https://blog.exodusintel.com/2022/03/01/advantech-iview-page_action_service-parameter-sql-injection-remote-code-execution-vulnerability/ - https://www.vulncheck.com/advisories/advantech-iview-data-parameter-sqli-information-disclosure
CVE ID: CVE-2022-50595 State: PUBLISHED Published: 2025-11-06T19:58:23.068Z Last Updated: 2025-11-15T23:59:59.400Z Vendors: Advantech Products: iView Problem Types: CWE-89, CWE-306 Description: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_search_value’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advantech.tw/support/details/firmware?id=1-HIPU-183 -
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advantech.tw/support/details/firmware?id=1-HIPU-183 - https://blog.exodusintel.com/2022/03/01/advantech-iview-ztp_search_value-parameter-sql-injection-remote-code-execution-vulnerability/ - https://www.vulncheck.com/advisories/advantech-iview-ztpsearchvalue-parameter-sqli-rce
CVE ID: CVE-2022-50596 State: PUBLISHED Published: 2025-11-06T19:58:51.704Z Last Updated: 2025-11-21T16:08:43.728Z Vendors: D-Link Products: DIR-1260 Problem Types: CWE-78 Description: D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to execute arbitrary commands on the device with root privileges. The flaw specifically exists within the SetDest/Dest/Target arguments to the GetDeviceSettings form. The management interface is accessible over HTTP and HTTPS on the local and Wi-Fi networks and optionally from the Internet. Additional Analyst Notes: -
ssible over HTTP and HTTPS on the local and Wi-Fi networks and optionally from the Internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10298 - https://blog.exodusintel.com/2022/05/11/d-link-dir-1260-getdevicesettings-pre-auth-command-injection-vulnerability/ - https://www.vulncheck.com/advisories/dlink-dir1260-getdevicesettings-unauthenticated-command-injection
CVE ID: CVE-2023-0001 State: PUBLISHED Published: 2023-02-08T17:20:20.774Z Last Updated: 2024-08-02T04:54:32.569Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) Vendors: Palo Alto Networks Products: Cortex XDR agent Problem Types: CWE-319 Description: An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2023-0001
CVE ID: CVE-2023-0002 State: PUBLISHED Published: 2023-02-08T17:21:47.711Z Last Updated: 2025-03-25T13:57:01.294Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: Cortex XDR agent Problem Types: CWE-693 Description: A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-0002
CVE ID: CVE-2023-0003 State: PUBLISHED Published: 2023-02-08T17:22:07.660Z Last Updated: 2025-02-13T16:38:40.524Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Palo Alto Networks Products: Cortex XSOAR Problem Types: CWE-73 Description: A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-0003 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V
rks.com/CVE-2023-0003 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ - https://lists.fedorap
archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr
essage/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
CVE ID: CVE-2023-0004 State: PUBLISHED Published: 2023-04-12T16:41:02.556Z Last Updated: 2025-02-13T16:38:41.195Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-703 Description: A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that impact the integrity and availability of PAN-OS software. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-20
software. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2023-0004 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ - https://lists.fedoraproject.org/archives/list/
ounce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
CVE ID: CVE-2023-0005 State: PUBLISHED Published: 2023-04-12T16:41:21.342Z Last Updated: 2025-02-10T21:56:53.314Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-497 Description: A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-0005
CVE ID: CVE-2023-0006 State: PUBLISHED Published: 2023-04-12T16:41:39.573Z Last Updated: 2025-02-07T15:49:33.777Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Palo Alto Networks Products: GlobalProtect app Problem Types: CWE-367 Description: A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with elevated privileges through a race condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-0006
CVE ID: CVE-2023-0007 State: PUBLISHED Published: 2023-05-10T16:30:47.049Z Last Updated: 2025-01-24T18:07:08.091Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-80 Description: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetwo
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-0007
CVE ID: CVE-2023-0008 State: PUBLISHED Published: 2023-05-10T16:34:18.429Z Last Updated: 2025-02-10T21:56:14.996Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access, Cloud NGFW Problem Types: CWE-73 Description: A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-0008
CVE ID: CVE-2023-0009 State: PUBLISHED Published: 2023-06-14T16:31:58.622Z Last Updated: 2024-12-30T15:24:31.911Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: GlobalProtect App Problem Types: CWE-807 Description: A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2023-0009