Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-31365 State: PUBLISHED Published: 2025-09-06T17:04:01.002Z Last Updated: 2025-09-08T14:42:21.656Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L) Vendors: AMD Products: AMD Radeon™ RX 7000 Series Graphics Products, AMD Radeon™ PRO W7000 Series Graphics Products, AMD Radeon™ PRO V710 Graphics Products Problem Types: CWE-190 Description: An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area resulting in loss of integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE ID: CVE-2023-31366 State: PUBLISHED Published: 2024-08-13T16:57:40.561Z Last Updated: 2024-08-14T16:20:15.071Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: AMD Products: μProf Tool Problem Types: CWE-20 Description: Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-9001
CVE ID: CVE-2023-31403 State: PUBLISHED Published: 2023-11-14T00:59:07.320Z Last Updated: 2025-06-11T14:26:30.146Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Business One Problem Types: CWE-863 Description: SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be executed or be used by the installation process leading to considerable impact on confidentiality, integrity and availability. Additional Analyst Notes: - CVE Program Container
to considerable impact on confidentiality, integrity and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3355658 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-31404 State: PUBLISHED Published: 2023-05-09T01:37:04.867Z Last Updated: 2025-01-28T19:08:39.306Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform (Central Management Service) Problem Types: CWE-200 Description: Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could let them access data sources which would otherwise be restricted. Additio
access to credentials of other users. It could let them access data sources which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3038911 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-31405 State: PUBLISHED Published: 2023-07-11T02:23:26.873Z Last Updated: 2024-11-08T18:19:45.651Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver AS for Java (Log Viewer) Problem Types: CWE-117 Description: SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
any effect on availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3324732 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-31406 State: PUBLISHED Published: 2023-05-09T01:37:32.237Z Last Updated: 2025-01-28T19:07:47.857Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-79 Description: Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Contai
ing a limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3319400 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-31407 State: PUBLISHED Published: 2023-05-09T01:37:53.404Z Last Updated: 2025-01-28T19:06:57.065Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Business Planning and Consolidation Problem Types: CWE-79 Description: SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.co
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3312892 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-31408 State: PUBLISHED Published: 2023-05-15T10:55:39.301Z Last Updated: 2025-01-23T17:33:18.976Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SICK AG Products: SICK FTMG-ESD15AXX AIR FLOW SENSOR, SICK FTMG-ESD20AXX AIR FLOW SENSOR, SICK FTMG-ESD25AXX AIR FLOW SENSOR, SICK FTMG-ESN40SXX AIR FLOW SENSOR, SICK FTMG-ESN50SXX AIR FLOW SENSOR, SICK FTMG-ESR40SXX AIR FLOW SENSOR, SICK FTMG-ESR50SXX AIR FLOW SENSOR Problem Types: CWE-312 Description: Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to potentially steal u
artnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to potentially steal user credentials that are stored in the user’s browsers local storage via cross-site-scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json
CVE ID: CVE-2023-31409 State: PUBLISHED Published: 2023-05-15T10:55:57.836Z Last Updated: 2025-01-23T17:32:30.188Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SICK AG Products: SICK FTMG-ESD15AXX AIR FLOW SENSOR, SICK FTMG-ESD20AXX AIR FLOW SENSOR, SICK FTMG-ESD25AXX AIR FLOW SENSOR, SICK FTMG-ESN40SXX AIR FLOW SENSOR, SICK FTMG-ESN50SXX AIR FLOW SENSOR, SICK FTMG-ESR40SXX AIR FLOW SENSOR, SICK FTMG-ESR50SXX AIR FLOW SENSOR Problem Types: CWE-400 Description: Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability
s 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability of the webserver by invocing a Slowloris style attack via HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json
CVE ID: CVE-2023-31410 State: PUBLISHED Published: 2023-06-19T14:57:52.413Z Last Updated: 2024-12-11T20:31:59.734Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SICK AG Products: EventCam App Problem Types: Cleartext Transmission of Sensitive Information, Improper Authorization Description: A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK EventCam App. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on the communication between
d disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on the communication between the EventCam App and the Client, and potentially manipulate the data being transmitted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.json
CVE ID: CVE-2023-31411 State: PUBLISHED Published: 2023-06-19T14:59:30.206Z Last Updated: 2024-12-09T21:07:24.192Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SICK AG Products: EventCam App Problem Types: Improper Authorization Description: A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/202
m Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0005.json
CVE ID: CVE-2023-31412 State: PUBLISHED Published: 2023-08-24T18:15:53.835Z Last Updated: 2024-12-09T14:12:04.011Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SICK AG Products: LMS5xx Problem Types: Use of Weak Hash Description: The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. If an attacker manages to retrieve the hash, it could lead to collision attacks and the potential retrieval of the password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.pdf - https://sick.com/.well-known/csaf/white
ick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.json
CVE ID: CVE-2023-31413 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T19:01:29.610Z Vendors: Elastic Products: Filebeat Problem Types: CWE-200 Description: Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logging is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-8-7-0-7-17-10-security-updates/332327
CVE ID: CVE-2023-31414 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T19:00:11.248Z Vendors: Elastic Products: Kibana Problem Types: CWE-94 Description: Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/kibana-8-7-1-
ADP Vulnrichment: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330
CVE ID: CVE-2023-31415 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T18:00:20.942Z Vendors: Elastic Products: Kibana Problem Types: CWE-94 Description: Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/kibana-8-7-1-security-updates/332330
CVE ID: CVE-2023-31416 State: PUBLISHED Published: 2023-10-26T18:46:21.531Z Last Updated: 2024-09-09T16:16:37.729Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Elastic Products: Elastic Cloud on Kubernetes Problem Types: CWE-200 Description: Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854 - https://www.elastic.co/community/sec
//discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854 - https://www.elastic.co/community/security
CVE ID: CVE-2023-31417 State: PUBLISHED Published: 2023-10-26T17:47:37.065Z Last Updated: 2025-02-13T16:50:06.368Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Elastic Products: Elasticsearch Problem Types: CWE-532 Description: Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be expli
e printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479 - https://www.elastic.co/community/security - https://security.netapp.com/advisory/ntap-20231130-0006/
CVE ID: CVE-2023-31418 State: PUBLISHED Published: 2023-10-26T17:36:42.723Z Last Updated: 2025-02-13T16:50:07.033Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Elastic Products: Elasticsearch Problem Types: CWE-400 Description: An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild. Additional Analyst Notes: - CVE Program Container:
on that the issue is known or that it is being exploited in the wild. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616 - https://www.elastic.co/community/security - https://security.netapp.com/advisory/ntap-20231130-0005/
CVE ID: CVE-2023-31419 State: PUBLISHED Published: 2023-10-26T17:06:14.305Z Last Updated: 2025-02-13T16:50:07.612Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Elastic Products: Elasticsearch Problem Types: CWE-121 Description: A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297 - https://www.elastic.co/community/security - https://security.netapp.com/advisory/ntap-20231116-0010/
CVE ID: CVE-2023-31421 State: PUBLISHED Published: 2023-10-26T03:10:52.684Z Last Updated: 2024-08-02T14:53:30.714Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Elastic Products: Beats, Elastic Agent, APM Server, Fleet Server Problem Types: CWE-295 Description: It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN va
s configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/beats-elastic-agent-apm-server-and-fleet-server-8-10-1-security-update-improper-certificate-validation-issue-esa-2023-16/343385 - https://www.elastic.co/community/security
CVE ID: CVE-2023-31422 State: PUBLISHED Published: 2023-10-26T01:43:54.868Z Last Updated: 2024-09-17T13:36:22.551Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-532 Description: An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has released Kibana 8.10.1 which resolves this issue. The error object recorded in the log contains request information, which can include sensitive data, such as authentic
. The error object recorded in the log contains request information, which can include sensitive data, such as authentication credentials, cookies, authorization headers, query params, request paths, and other metadata. Some examples of sensitive data which can be included in the logs are account credentials for kibana_system, kibana-metricbeat, or Kibana end-users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-10-1-security-update/343287 - https://www.elastic.co/community/security
CVE ID: CVE-2023-31423 State: PUBLISHED Published: 2023-08-31T00:43:39.805Z Last Updated: 2025-02-13T16:50:08.160Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Brocade Products: SANnav Problem Types: CWE-312 Description: Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav before v2.3.0 and 2.2.2a. Notes: To access the logs, the local attacker must have access to an already collected Brocade SANnav "supportsave" outputs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22508 - https://security.netapp.com/advisory/ntap-20240229-0003/
CVE ID: CVE-2023-31424 State: PUBLISHED Published: 2023-08-31T00:54:27.046Z Last Updated: 2025-02-13T16:50:08.711Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Brocade Products: SANnav Problem Types: CWE-290 Description: Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22507 - https://security.netapp.com/advisory/ntap-20240229-0004/
CVE ID: CVE-2023-31425 State: PUBLISHED Published: 2023-08-01T20:34:47.165Z Last Updated: 2025-02-13T16:50:09.356Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Brocade Products: Fabric OS Problem Types: Privilege escalation Description: A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticated user to perform privilege escalation to root by breaking the rbash shell. Starting with Fabric OS v9.1.0, “root” account access is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/extern
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22407 - https://security.netapp.com/advisory/ntap-20230908-0007/
CVE ID: CVE-2023-31426 State: PUBLISHED Published: 2023-08-01T21:18:55.037Z Last Updated: 2024-08-02T14:53:31.068Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Brocade Products: Brocade Fabric OS Problem Types: CWE-532 Description: The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords in supportsave. This could allow a remote authenticated attacker to access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/Se
Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22377 - https://security.netapp.com/advisory/ntap-20230908-0007/
CVE ID: CVE-2023-31427 State: PUBLISHED Published: 2023-08-01T22:46:17.756Z Last Updated: 2025-02-13T16:50:10.000Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Brocade Products: Fabric OS Problem Types: CWE-22 Description: Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0, “root” account access is disabled. Additional Analyst Notes: - CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22379 - https:
- CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22379 - https://security.netapp.com/advisory/ntap-20230908-0007/