Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
and also deleting, viewing, changing, copying, renaming, duplicating, or printing previously locked Omnis classes. This violates the expected behavior of an "irreversible operation." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-006.txt - http://seclists.org/fulldisclosure/2023/Jul/42 - http://packetstormsecurity.com/files/173696/Omnis-Studio-10.22.00-Library-Unlock.html - http://seclists.org/fulldisclosure/2023/Jul/43
CVE ID: CVE-2023-38335 State: PUBLISHED Published: 2023-07-20T00:00:00 Last Updated: 2024-10-24T20:28:58.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversible operation. However, due to implementation issues, "always private" Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an "irreversible operation". Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Adv
CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-005.txt - http://seclists.org/fulldisclosure/2023/Jul/41 - http://packetstormsecurity.com/files/173695/Omnis-Studio-10.22.00-Library-Setting-Bypass.html - http://seclists.org/fulldisclosure/2023/Jul/43
CVE ID: CVE-2023-38336 State: PUBLISHED Published: 2023-07-14T00:00:00 Last Updated: 2024-10-30T15:56:09.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039689
CVE ID: CVE-2023-38337 State: PUBLISHED Published: 2023-07-14T00:00:00 Last Updated: 2024-10-31T16:04:57.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rswag/rswag/issues/653 - https://github.com/rswag/rswag/compare/2.9.0...2.10.1
CVE ID: CVE-2023-38343 State: PUBLISHED Published: 2023-09-21T00:00:00 Last Updated: 2024-09-24T16:59:33.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ivanti.com/releases - https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928
CVE ID: CVE-2023-38344 State: PUBLISHED Published: 2023-09-21T00:00:00 Last Updated: 2024-09-24T16:55:31.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an authenticated attacker to read arbitrary files from a remote system, including the private key used to authenticate to agents for remote access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
to agents for remote access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ivanti.com/releases - https://gist.github.com/bhyahoo/76533e91840200a1d9f3fb1eb87eb0f1
CVE ID: CVE-2023-38346 State: PUBLISHED Published: 2023-09-22T00:00:00 Last Updated: 2024-09-25T15:13:20.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Wind River VxWorks 6.9 and 7. The function ``tarExtract`` implements TAR file extraction and thereby also processes files within an archive that have relative or absolute file paths. A developer using the "tarExtract" function may expect that the function will strip leading slashes from absolute paths or stop processing when encountering relative paths that are outside of the extraction path, unless otherwise forced. This could lead to unexpected and undocumented behavior, which in general could res
ction path, unless otherwise forced. This could lead to unexpected and undocumented behavior, which in general could result in a directory traversal, and associated unexpected behavior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support2.windriver.com/index.php?page=security-notices - https://www.pentagrid.ch/en/blog/wind-river-vxworks-tarextract-directory-traversal-vulnerability/ - https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2023-38346
CVE ID: CVE-2023-38347 State: PUBLISHED Published: 2023-08-09T00:00:00 Last Updated: 2024-10-10T18:35:35.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LWsystems Benno MailArchiv 2.10.1. Attackers can cause XSS via JavaScript content to a mailbox. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.benno-mailarchiv.de/doku.php - https://blog.sebastianschmitt.eu/security/xss-in-benno-mailarchiv-web-app-benno-rest-lib-cve-2023-38347/
CVE ID: CVE-2023-38348 State: PUBLISHED Published: 2023-08-09T00:00:00 Last Updated: 2024-10-10T18:34:44.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.benno-mailarchiv.de/doku.php - https://blog.sebastianschmitt.eu/security/xsrf-in-benno-mailarchiv-web-app-benno-web-2-10-2-cve-2023-38348/
CVE ID: CVE-2023-38349 State: PUBLISHED Published: 2023-07-15T00:00:00 Last Updated: 2024-10-30T15:35:56.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pnp4nagios/pnp4nagios/pull/17
CVE ID: CVE-2023-38350 State: PUBLISHED Published: 2023-07-15T00:00:00 Last Updated: 2024-10-30T15:34:16.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pnp4nagios/pnp4nagios/pull/16
CVE ID: CVE-2023-38351 State: PUBLISHED Published: 2023-09-19T00:00:00 Last Updated: 2024-09-25T17:19:08.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers to achieve remote code execution through a man in the middle attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://0dr3f.github.io/cve/
CVE ID: CVE-2023-38352 State: PUBLISHED Published: 2023-09-19T00:00:00 Last Updated: 2024-09-25T17:18:18.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in the middle attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://0dr3f.github.io/cve/
CVE ID: CVE-2023-38353 State: PUBLISHED Published: 2023-09-19T00:00:00 Last Updated: 2024-09-25T17:17:55.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniTool Power Data Recovery version 11.6 and before contains an insecure in-app payment system that allows attackers to steal highly sensitive information through a man in the middle attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://0dr3f.github.io/cve/
CVE ID: CVE-2023-38354 State: PUBLISHED Published: 2023-09-19T00:00:00 Last Updated: 2024-09-25T17:17:30.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniTool Shadow Maker version 4.1 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://0dr3f.github.io/cve/
CVE ID: CVE-2023-38355 State: PUBLISHED Published: 2023-09-19T00:00:00 Last Updated: 2024-09-25T17:17:05.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniTool Movie Maker 7.0 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://0dr3f.github.io/cve/
CVE ID: CVE-2023-38356 State: PUBLISHED Published: 2023-09-19T00:00:00 Last Updated: 2024-09-25T15:55:23.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniTool Power Data Recovery 11.6 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://0dr3f.github.io/cve/
CVE ID: CVE-2023-38357 State: PUBLISHED Published: 2023-08-01T00:00:00 Last Updated: 2024-10-17T19:03:47.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://seclists.org/fulldisclosure/2023/Jul/30 - http://packetstormsecurity.com/files/173609/RWS-WorldServer-11.7.3-Session-Token-Enumeration.html - https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-001/-session-token-enumeration-in-rws-worldserver
CVE ID: CVE-2023-38359 State: PUBLISHED Published: 2024-02-24T15:27:07.898Z Last Updated: 2025-02-13T17:01:50.366Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-79 Description: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260744. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/712
nalyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7123154 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260744 - https://security.netapp.com/advisory/ntap-20240405-0003/ - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2023-38360 State: PUBLISHED Published: 2024-03-04T18:05:16.269Z Last Updated: 2024-08-02T17:39:12.907Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: CICS TX Advanced Problem Types: CWE-79 Description: IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260769. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7066435 - https://exchang
DP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7066435 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260769
CVE ID: CVE-2023-38361 State: PUBLISHED Published: 2023-11-18T17:24:26.075Z Last Updated: 2024-08-02T17:39:13.079Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: CICS TX Advanced Problem Types: CWE-327 Description: IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 260770. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7066431 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260770
CVE ID: CVE-2023-38362 State: PUBLISHED Published: 2024-03-04T15:56:12.254Z Last Updated: 2024-08-02T17:39:12.994Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: CICS TX Advanced Problem Types: CWE-204 Description: IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://https://www.ibm.com/support/pages/node/7066430 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260814
CVE ID: CVE-2023-38363 State: PUBLISHED Published: 2023-11-13T01:24:46.619Z Last Updated: 2024-08-30T19:27:12.135Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: IBM Products: CICS TX Advanced Problem Types: 614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute Description: IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 260
sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 260818. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7067987 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260818
CVE ID: CVE-2023-38364 State: PUBLISHED Published: 2023-11-13T01:47:44.043Z Last Updated: 2024-08-30T19:26:40.646Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: CICS TX Advanced Problem Types: CWE-79 Description: IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260821. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7066429 - https://exchang
ogram Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7066429 - https://exchange.xforce.ibmcloud.com/vulnerabilities/260821
CVE ID: CVE-2023-38366 State: PUBLISHED Published: 2024-03-01T02:26:54.534Z Last Updated: 2024-08-02T17:39:12.868Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Filenet Content Manager Problem Types: CWE-22 Description: IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 261115. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/703978
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7039783 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261115
CVE ID: CVE-2023-38367 State: PUBLISHED Published: 2024-02-29T02:13:16.103Z Last Updated: 2025-03-27T14:58:22.035Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Cloud Pak for Automation Problem Types: CVE-287 Improper Authentication Description: IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) allows CRUD Operations with an invalid token. This could allow an unauthenticated attacker to view, update, delete or create an IdP configuration. IBM X-Force ID: 261130. Additional Analyst Note
ticated attacker to view, update, delete or create an IdP configuration. IBM X-Force ID: 261130. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7015271 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261130
CVE ID: CVE-2023-38368 State: PUBLISHED Published: 2024-06-27T18:25:39.896Z Last Updated: 2025-11-03T21:48:57.966Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Access Manager Docker Problem Types: CWE-863 Description: IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Force ID: 261195. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158790 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261195
CVE ID: CVE-2023-38369 State: PUBLISHED Published: 2024-02-07T16:15:04.324Z Last Updated: 2025-11-03T21:48:59.938Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Access Appliance, Security Verify Access Docker Problem Types: CWE-521 Description: IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7106586 - https://exchange.xfo
Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7106586 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261196
CVE ID: CVE-2023-38370 State: PUBLISHED Published: 2024-06-27T18:27:20.082Z Last Updated: 2025-11-03T21:49:01.395Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Access Manager Docker Problem Types: CWE-276 Description: IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. IBM X-Force ID: 261197. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158790 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261197
CVE ID: CVE-2023-38371 State: PUBLISHED Published: 2024-06-27T18:14:20.985Z Last Updated: 2025-11-03T21:49:04.440Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Access Manager Docker Problem Types: CWE-327 Description: IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 261198. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158790 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261198
CVE ID: CVE-2023-38372 State: PUBLISHED Published: 2024-02-29T00:23:56.355Z Last Updated: 2024-08-02T17:39:12.969Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Watson IoT Platform Problem Types: CWE-287 Description: An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user. IBM X-Force ID: 261201. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7020635 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261201
CVE ID: CVE-2023-38378 State: PUBLISHED Published: 2023-07-16T00:00:00 Last Updated: 2024-10-30T16:13:25.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tortel.li/post/insecure-scope/ - https://news.ycombinator.com/item?id=36745664
CVE ID: CVE-2023-38379 State: PUBLISHED Published: 2023-07-16T00:00:00 Last Updated: 2024-10-30T18:10:54.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin password via a zero-length pass0 to the webcontrol changepwd.cgi application, i.e., the entered password only needs to match the first zero characters of the saved password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tortel.li/post/insecure-scope/ - https://news.ycombinator.com/item?id=36745664
CVE ID: CVE-2023-38380 State: PUBLISHED Published: 2023-12-12T11:26:36.173Z Last Updated: 2024-08-02T17:39:13.213Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CP 1242-7 V2 (incl. SIPLUS variants), SIMATIC CP 1243-1 (incl. SIPLUS variants), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants), SIMATIC CP 1243-7 LTE, SIMATIC CP 1243-8 IRC, SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543-1, SIMATIC CP 1543SP-1, SINAMICS S210 (6SL5...), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, SIPLUS ET 200SP CP 1543SP-1 ISEC, SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL, SIPLUS NET CP 1
0SP CP 1542SP-1 IRC TX RAIL, SIPLUS ET 200SP CP 1543SP-1 ISEC, SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL, SIPLUS NET CP 1543-1 Problem Types: CWE-401 Description: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE (All versions < V3.4.29), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0)
< V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) (All versions < V3.0.37), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SINAMICS S210 (6SL5...) (All versions >= V6.1 < V6.1 HF2), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) (All versions < V3.0.37). The webserver implementation of the affected products