Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
of permission document verification used by some DDS vendors. Specifically, an improper use of the OpenSSL PKCS7_verify function used to validate S/MIME signatures. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros2/sros2/issues/282 - https://gist.github.com/vmayoral/235c02d0b0ef85a29812eff6980ff80d
CVE ID: CVE-2023-24012 State: PUBLISHED Published: 2025-01-09T14:36:15.692Z Last Updated: 2025-01-09T20:05:44.907012Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: OpenDDS Products: DDS Problem Types: CWE-200 Description: An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s validation. This is caused by a non-compliant implementation of permission document verification used by some DDS vendors. Specifically, an improper use of the OpenSSL PKCS7_verify fun
CVE ID: CVE-2023-24014 State: PUBLISHED Published: 2023-06-07T20:50:29.115Z Last Updated: 2025-01-06T21:02:16.776Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: CNCSoft-B DOPSoft Problem Types: CWE-122 Description: Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-01
CVE ID: CVE-2023-24015 State: PUBLISHED Published: 2023-08-09T09:05:16.765Z Last Updated: 2024-09-20T12:07:25.358Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-1286 Description: A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. The reports section will be partially unavailable for all later attempts to use it, with the report list seemingly stuck on loading. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.nozominetworks
dditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.nozominetworks.com/NN-2023:6-01
CVE ID: CVE-2023-24016 State: PUBLISHED Published: 2023-08-11T02:36:58.450Z Last Updated: 2024-08-02T10:49:08.824Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Quartus(R) Prime Pro and Standard edition software for linux Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path element in some Intel(R) Quartus(R) Prime Pro and Standard edition software for linux may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00800.html
CVE ID: CVE-2023-24018 State: PUBLISHED Published: 2023-07-06T14:53:27.818Z Last Updated: 2024-08-02T10:49:09.071Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Milesight Products: UR32L Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 security_decrypt_password functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to a buffer overflow. An authenticated attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-202
Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1715
CVE ID: CVE-2023-24019 State: PUBLISHED Published: 2023-07-06T14:53:22.537Z Last Updated: 2025-03-05T18:54:45.856Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Milesight Products: UR32L Problem Types: CWE-120 Description: A stack-based buffer overflow vulnerability exists in the urvpn_client http_connection_readcb functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1718
CVE ID: CVE-2023-24020 State: PUBLISHED Published: 2023-01-30T21:54:49.887Z Last Updated: 2025-01-16T21:58:48.037Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Snap One Products: Wattbox WB-300-IP-3 Problem Types: CWE-307 Description: Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-03
CVE ID: CVE-2023-24021 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-02T16:18:27.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.7 - https://github.com/SpiderLabs/ModSecurity/pull/2857 - https://github.com/SpiderLabs/ModSecurity/pull/2857/commits/4324f0ac59f822
github.com/SpiderLabs/ModSecurity/pull/2857 - https://github.com/SpiderLabs/ModSecurity/pull/2857/commits/4324f0ac59f8225aa44bc5034df60dbeccd1d334 - https://lists.debian.org/debian-lts-announce/2023/01/msg00023.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCH6JM4I4MD4YABYFHSBDDOUFDGIFJKL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/52TGCZCOHYBDCVWJYNN2PS4QLOHCXWTQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYRTXTOQQI6SB2TLI5QXU76DURSLS4XI/
CVE ID: CVE-2023-24022 State: PUBLISHED Published: 2023-01-24T15:51:17.731Z Last Updated: 2025-04-02T13:35:30.752Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: Baicells Products: Nova 227, Nova 233, Nova 243 Problem Types: CWE-284 Description: Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://baicells.zendesk.com/h
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://baicells.zendesk.com/hc/en-us/articles/6188324645780-2023-1-17-Hard-Coded-Credential-Crypt-Vulnerability - https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6.IMG.IMG - https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6_Changelog.PDF.pdf
CVE ID: CVE-2023-24023 State: PUBLISHED Published: 2023-11-28T00:00:00 Last Updated: 2024-08-02T10:49:09.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/bluffs-vulnerability/ - https://dl.acm.org/doi/10.1145/3576915.3623066
CVE ID: CVE-2023-24025 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-02T16:16:44.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forgeries of digital signatures via a template side-channel attack because of intermediate data leakage of one vector. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PQClean/PQClean/tree/d03da3053491e767ef842deaef43fc5bdb6bc911 - https://csrc.nist.gov/Projects/post-quantum-cryptography/selected-algorithms-2022 - https://eprint.iacr.org/2023/050
CVE ID: CVE-2023-24026 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-02T16:13:10.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/commit/a46f794a136001101cbec84fccf3cc824e983493
CVE ID: CVE-2023-24027 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-02T16:11:51.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/commit/72c5424034c378583d128fc1e769aae33fb1c8b9
CVE ID: CVE-2023-24028 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T14:39:32.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/commit/93bf15d3bd703a32ebfe86cb6c1c9b735cf23e30
CVE ID: CVE-2023-24029 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T18:45:09.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user modification workflows. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-January-2023?popup=true
CVE ID: CVE-2023-24030 State: PUBLISHED Published: 2023-06-15T00:00:00 Last Updated: 2024-12-18T16:27:59.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any URL if url sanitisation is bypassed in incoming requests. NOTE: this is similar, but not identical, to CVE-2021-34807. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zi
VE-2021-34807. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center
CVE ID: CVE-2023-24031 State: PUBLISHED Published: 2023-06-15T00:00:00 Last Updated: 2024-12-18T16:26:53.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center
CVE ID: CVE-2023-24032 State: PUBLISHED Published: 2023-06-15T00:00:00 Last Updated: 2024-12-18T16:25:25.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to local privilege escalation (LPE). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center
CVE ID: CVE-2023-24033 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-03-03T20:24:55.993Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly check format types specified by the Session Description Protocol (SDP) module, which can lead to a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/processor/modem/ - https://semiconductor.samsung.com/support/quality-support/
ences: - https://semiconductor.samsung.com/processor/modem/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - http://packetstormsecurity.com/files/172137/Shannon-Baseband-accept-type-SDP-Attribute-Memory-Corruption.html
CVE ID: CVE-2023-24038 State: PUBLISHED Published: 2023-01-21T00:00:00.000Z Last Updated: 2025-04-02T15:58:39.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking for HTML content with certain style attributes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/clintongormley/perl-html-stripscripts/issues/3 - https://lists.debian.org/debian-lts-announce/2023/01/msg00036.html - https://www.debian.org/security/2023/dsa-5339 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject
debian.org/security/2023/dsa-5339 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ASDRHN2MLGL2HGBUNDZG4YLUWW6NSUKD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4MYD5PFRUUB4VVY52I5KA3RQ7SQOD7YM/
CVE ID: CVE-2023-24039 State: PUBLISHED Published: 2023-01-21T00:00:00.000Z Last Updated: 2025-04-02T15:55:36.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in ParseColors in libXm in Common Desktop Environment 1.6 can be exploited by local low-privileged users via the dtprintinfo setuid binary to escalate their privileges to root on Solaris 10 systems. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hnsecurity/vulns/blob/main/HNS-2022-01-dtprintinfo.txt - https://github.com/0xdea/exploits/bl
nces: - https://github.com/hnsecurity/vulns/blob/main/HNS-2022-01-dtprintinfo.txt - https://github.com/0xdea/exploits/blob/master/solaris/raptor_dtprintlibXmas.c - https://security.humanativaspa.it/nothing-new-under-the-sun/ - http://seclists.org/fulldisclosure/2023/Jan/24
CVE ID: CVE-2023-24040 State: PUBLISHED Published: 2023-01-21T00:00:00 Last Updated: 2024-08-02T10:49:08.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of available printers. This allows low-privileged local users to inject arbitrary printer names via the $HOME/.printers file. This injection allows those users to manipulate the control flow and disclose memory contents on Solaris 10 systems. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CV
affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/hnsecurity/vulns/blob/main/HNS-2022-01-dtprintinfo.txt - https://security.humanativaspa.it/nothing-new-under-the-sun/ - http://seclists.org/fulldisclosure/2023/Jan/24
CVE ID: CVE-2023-24042 State: PUBLISHED Published: 2023-01-21T00:00:00.000Z Last Updated: 2025-04-02T15:53:19.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: A race condition in LightFTP through 2.2 allows an attacker to achieve path traversal via a malformed FTP request. A handler thread can use an overwritten context->FileName. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hfiref0x/LightFTP/issues/25
CVE ID: CVE-2023-24044 State: PUBLISHED Published: 2023-01-22T00:00:00.000Z Last Updated: 2025-04-02T15:49:05.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/TJetnipat/02b3854543b7ec95d54a8de811f2e8ae - https://medium.com/%40jetnipat.tho/cve-2023-24044-10e48ab940d8 - https://support.p
at/02b3854543b7ec95d54a8de811f2e8ae - https://medium.com/%40jetnipat.tho/cve-2023-24044-10e48ab940d8 - https://support.plesk.com/hc/en-us/articles/10254625170322-Vulnerability-CVE-2023-24044
CVE ID: CVE-2023-24045 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-10T18:57:53.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dataiku.com - https://gist.github.com/alert3/04e2d0a934001180104f846cfa00552b
CVE ID: CVE-2023-24046 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T10:49:08.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to run arbitrary commands via use of a crafted string in the ping utility. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/
CVE ID: CVE-2023-24047 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T10:49:08.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Credential Management issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via use of weak hashing algorithm. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/
CVE ID: CVE-2023-24048 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T10:49:08.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via crafted GET request to /man_password.htm. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/
CVE ID: CVE-2023-24049 State: PUBLISHED Published: 2023-12-04T00:00:00.000Z Last Updated: 2025-05-29T14:16:04.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the device via poor credential management. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/
CVE ID: CVE-2023-24050 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-27T18:23:30.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to run arbitrary code via crafted string when setting the Wi-Fi password in the admin panel. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/
CVE ID: CVE-2023-24051 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T10:49:08.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: A client side rate limit issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via brute force style attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/
CVE ID: CVE-2023-24052 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-08-02T10:49:08.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via the change password functionality as it does not prompt for the current password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/
CVE ID: CVE-2023-24054 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2023-24055 State: PUBLISHED Published: 2023-01-22T00:00:00 Last Updated: 2024-08-02T10:49:08.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has that level of access to the local PC. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/ - https://sourceforge.net/p/keepa