Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-29101 State: PUBLISHED Published: 2023-05-10T08:06:10.901Z Last Updated: 2025-01-13T16:50:13.473Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Muffingroup Products: Betheme Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Muffingroup Betheme theme <= 26.7.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/betheme/wordpress-betheme-theme-26-7-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29102 State: PUBLISHED Published: 2023-12-20T19:09:58.146Z Last Updated: 2024-09-03T15:40:06.151Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Olive Themes Products: Olive One Click Demo Import Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Olive Themes Olive One Click Demo Import.This issue affects Olive One Click Demo Import: from n/a through 1.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/olive-one-click-demo-import/wordpress-olive-one-click-demo-import-plugin-1-0-9-arbitrary-file-upload
abase/vulnerability/olive-one-click-demo-import/wordpress-olive-one-click-demo-import-plugin-1-0-9-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-29103 State: PUBLISHED Published: 2023-05-09T11:51:29.860Z Last Updated: 2025-01-28T18:41:36.064Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC Cloud Connect 7 CC712, SIMATIC Cloud Connect 7 CC716 Problem Types: CWE-259 Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions < V2.1). The affected device uses a hard-coded password to protect the diagnostic files. This could allow an authent
ons < V2.1). The affected device uses a hard-coded password to protect the diagnostic files. This could allow an authenticated attacker to access protected data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE ID: CVE-2023-29104 State: PUBLISHED Published: 2023-05-09T11:51:30.950Z Last Updated: 2025-01-28T18:41:04.237Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC Cloud Connect 7 CC712, SIMATIC Cloud Connect 7 CC716 Problem Types: CWE-22 Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to overwrite any fi
ible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to overwrite any file the Linux user `ccuser` has write access to, or to download any file the Linux user `ccuser` has read-only access to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE ID: CVE-2023-29105 State: PUBLISHED Published: 2023-05-09T11:51:32.057Z Last Updated: 2025-01-28T18:40:19.563Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC Cloud Connect 7 CC712, SIMATIC Cloud Connect 7 CC716 Problem Types: CWE-544 Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions < V2.1). The affected device is vulnerable to a denial of service while parsing a random (non-JSON) MQTT payload. Th
ons < V2.1). The affected device is vulnerable to a denial of service while parsing a random (non-JSON) MQTT payload. This could allow an attacker who can manipulate the communication between the MQTT broker and the affected device to cause a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE ID: CVE-2023-29106 State: PUBLISHED Published: 2023-05-09T11:51:33.140Z Last Updated: 2025-01-28T18:38:53.788Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC Cloud Connect 7 CC712, SIMATIC Cloud Connect 7 CC716 Problem Types: CWE-200 Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download the files available via the endpoint. Additional Analyst Notes: - CVE Program
authenticated remote attacker to download the files available via the endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE ID: CVE-2023-29107 State: PUBLISHED Published: 2023-05-09T11:51:34.269Z Last Updated: 2025-01-28T18:37:13.123Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC Cloud Connect 7 CC712, SIMATIC Cloud Connect 7 CC716 Problem Types: CWE-552 Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources. Additional Analyst Notes: - CVE Program Container: - C
mote attacker to gain access to additional information resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE ID: CVE-2023-29108 State: PUBLISHED Published: 2023-04-11T02:56:58.666Z Last Updated: 2025-02-12T19:24:16.822Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP Products: ABAP Platform and SAP Web Dispatcher Problem Types: CWE-923 Description: The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3315312 - https://www.sap.com/documents/2022/02/fa865e
richment: References: - https://launchpad.support.sap.com/#/notes/3315312 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-29109 State: PUBLISHED Published: 2023-04-11T02:58:49.648Z Last Updated: 2025-02-07T16:52:14.949Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP Products: Application Interface Framework (Message Dashboard) Problem Types: CWE-1236 Description: The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result
of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3115598 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-29110 State: PUBLISHED Published: 2023-04-11T03:00:17.210Z Last Updated: 2025-02-07T17:13:23.603Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP Products: Application Interface Framework (Message Dashboard) Problem Types: CWE-80 Description: The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limit
then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3113349 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-29111 State: PUBLISHED Published: 2023-04-11T03:01:14.297Z Last Updated: 2025-02-07T17:13:03.654Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP Products: Application Interface Framework (ODATA service) Problem Types: CWE-200 Description: The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confidentiality of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.co
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3117978 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-29112 State: PUBLISHED Published: 2023-04-11T03:03:09.047Z Last Updated: 2025-02-07T17:12:46.693Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP Products: Application Interface Framework (Message Monitoring) Problem Types: CWE-80 Description: The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program
an cause limited impact on the confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3114489 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-29113 State: PUBLISHED Published: 2025-06-28T15:33:26.500Z Last Updated: 2025-06-30T16:04:36.932Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-284 Description: The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mechanism, leaving attackers with presence in the system an ability to undermine access control restrictions implemented at the operating system level. The vulnerability was originally discovered in Skoda Superb I
ol restrictions implemented at the operating system level. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-29114 State: PUBLISHED Published: 2024-11-05T15:01:08.666Z Last Updated: 2024-11-05T17:00:26.636Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-200 Description: System logs could be accessed through web management application due to a lack of access control. An attacker can obtain the following sensitive information: • Wi-Fi access point credentials to which the EV charger can connect. • APN web address and credentials. • IPSEC credentials. • Web interface access credentials for user and admin accounts. • JuiceBox system components (software installed, model, firmware versi
access credentials for user and admin accounts. • JuiceBox system components (software installed, model, firmware version, etc.). • C2G configuration details. • Internal IP addresses. • OTA firmware update configurations (DNS servers). All the credentials are stored in logs in an unencrypted plaintext format. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29115 State: PUBLISHED Published: 2024-11-05T15:04:04.570Z Last Updated: 2024-11-05T17:00:50.619Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-284 Description: In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29116 State: PUBLISHED Published: 2024-11-05T15:08:28.147Z Last Updated: 2024-11-05T19:10:35.357Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-200 Description: Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configuration details could be obtained. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29117 State: PUBLISHED Published: 2024-11-05T15:14:23.990Z Last Updated: 2024-11-05T19:09:05.365Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-287 Description: Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29118 State: PUBLISHED Published: 2024-11-05T15:18:04.751Z Last Updated: 2024-11-05T19:13:42.854Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-89 Description: Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29119 State: PUBLISHED Published: 2024-11-05T15:20:56.644Z Last Updated: 2024-11-05T19:03:26.897Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-89 Description: Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29120 State: PUBLISHED Published: 2024-11-05T15:22:22.178Z Last Updated: 2024-11-05T19:00:55.293Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-78 Description: Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29121 State: PUBLISHED Published: 2024-11-05T15:23:41.624Z Last Updated: 2024-11-05T17:11:16.250Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-284 Description: Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29122 State: PUBLISHED Published: 2024-11-05T15:24:43.416Z Last Updated: 2024-11-05T18:58:24.529Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-708 Description: Under certain conditions, access to service libraries is granted to account they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29125 State: PUBLISHED Published: 2024-11-05T15:27:22.764Z Last Updated: 2024-11-05T17:09:21.562Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-122 Description: A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29126 State: PUBLISHED Published: 2024-11-05T15:28:53.542Z Last Updated: 2024-11-05T17:06:44.167Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Enel X Products: JuiceBox Pro 3.0 22kW Cellular Problem Types: CWE-1287 Description: The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypass authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE ID: CVE-2023-29128 State: PUBLISHED Published: 2023-05-09T11:51:35.346Z Last Updated: 2025-01-28T18:36:17.506Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC Cloud Connect 7 CC712, SIMATIC Cloud Connect 7 CC716 Problem Types: CWE-22 Description: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to write any file wi
ble to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to write any file with the extension `.db`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf
CVE ID: CVE-2023-29129 State: PUBLISHED Published: 2023-06-13T08:17:09.102Z Last Updated: 2025-01-03T01:45:08.421Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: Mendix SAML (Mendix 7 compatible), Mendix SAML (Mendix 8 compatible), Mendix SAML (Mendix 9 latest compatible, New Track), Mendix SAML (Mendix 9 latest compatible, Upgrade Track), Mendix SAML (Mendix 9.12/9.18 compatible, New Track), Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track), Mendix SAML (Mendix 9.6 compatible, New Track), Mendix SAML (Mendix 9.6 compatible, Upgrade Track) Problem Types: CWE-303 Description: A vulnerability has been identified in Men
ML (Mendix 9.6 compatible, Upgrade Track) Problem Types: CWE-303 Description: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.4.0), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.3.1 < V3.6.1), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.1.9 < V3.3.1), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.3.0 < V3.6.0), Mendix SAML (Mendix 9 latest compatibl
ML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.3.0 < V3.6.0), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.1.8 < V3.3.0), Mendix SAML (Mendix 9.12/9.18 compatible, New Track) (All versions >= V3.3.1 < V3.3.15), Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.14), Mendix SAML (Mendix 9.6 compatible, New Track) (All versions >= V3.1.9 < V3.2.7), Mendix SAML (Mendix 9.6 compatible, Upgrade Track) (All versions >= V3.1.8 < V3.2.6). The affected versions of the module insufficiently verify the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the a
the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application. This CVE entry describes the incomplete fix for CVE-2023-25957 in a specific non default configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-851884.pdf