Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-22527 State: PUBLISHED Published: 2024-01-16T05:00:00.692Z Last Updated: 2025-10-21T23:05:28.527Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Atlassian Products: Confluence Data Center, Confluence Server Problem Types: RCE (Remote Code Execution) Description: A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular ve
onfluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615 - https://jira.atlassian.com/browse/CONFSERVER-93833 - http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html
CVE ID: CVE-2023-22551 State: PUBLISHED Published: 2023-01-01T00:00:00.000Z Last Updated: 2025-04-07T18:12:57.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FTP (aka "Implementation of a simple FTP client and server") project through 96c1a35 allows remote attackers to cause a denial of service (memory consumption) by engaging in client activity, such as establishing and then terminating a connection. This occurs because malloc is used but free is not. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rovinbhandari/FTP/issues/8
CVE ID: CVE-2023-22572 State: PUBLISHED Published: 2023-02-01T12:54:27.379Z Last Updated: 2025-03-26T18:42:15.561Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-532 Description: Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A low privilege local attacker could potentially exploit this vulnerability, leading to system takeover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-sec
References: - https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security
CVE ID: CVE-2023-22573 State: PUBLISHED Published: 2023-02-01T13:10:52.633Z Last Updated: 2025-03-26T18:03:40.929Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-532 Description: Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. A low privileged local attacker could potentially exploit this vulnerability, leading to sensitive information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-mult
chment: References: - https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security
CVE ID: CVE-2023-22574 State: PUBLISHED Published: 2023-02-01T13:06:27.833Z Last Updated: 2025-03-26T20:00:09.981Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-532 Description: Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI module. A low-privileged user with permission to read logs on the cluster could potentially exploit this vulnerability, leading to Information disclosure and denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbd
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security
CVE ID: CVE-2023-22575 State: PUBLISHED Published: 2023-02-01T13:16:56.674Z Last Updated: 2025-03-26T18:03:21.307Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-532 Description: Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. A low privileges user could potentially exploit this vulnerability, leading to information disclosure and escalation of privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-f
Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security
CVE ID: CVE-2023-22576 State: PUBLISHED Published: 2024-08-21T09:44:37.806Z Last Updated: 2024-08-21T16:44:31.158Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Repository Manager (DRM) Problem Types: CWE-269 Description: Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low privileged attacker may potentially exploit this vulnerability leading to the execution of arbitrary executable on the operating system with high privileges using the existing vulnerability in operating system. Exploitation may lead to unavailability of the service. Additional Analyst No
xisting vulnerability in operating system. Exploitation may lead to unavailability of the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000207513/dsa-2023-017-dell-emc-repository-manager-drm-security-update-for-an-improper-privilege-management-vulnerability
CVE ID: CVE-2023-22577 State: PUBLISHED Published: 2023-04-24T08:14:53.265Z Last Updated: 2025-03-11T13:39:13.172Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CERN Products: White Rabbit Switch Problem Types: CWE-200 Description: Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2023-22577/ - https://csirt.divd.nl/DIVD-2022-00068/
CVE ID: CVE-2023-22578 State: PUBLISHED Published: 2023-02-16T14:11:36.631Z Last Updated: 2025-04-01T04:48:17.055Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Feathers-Sequalize Products: Sequelize.js Problem Types: CWE-790 Description: Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2023-22578 - https://csirt.divd.nl/DIVD-2022-00020/
CVE ID: CVE-2023-22579 State: PUBLISHED Published: 2023-02-16T14:11:37.235Z Last Updated: 2025-04-01T04:48:14.582Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Feathers-Sequalize Products: Sequelize.js Problem Types: CWE-843 Description: Due to improper parameter filtering in the sequalize js library, can a attacker peform injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2023-22579 - https://csirt.divd.nl/DIVD-2022-00020/
CVE ID: CVE-2023-22580 State: PUBLISHED Published: 2023-02-16T14:11:35.881Z Last Updated: 2025-04-01T04:48:15.605Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Feathers-Sequalize Products: Sequelize.js Problem Types: CWE-200 Description: Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2023-22580 - https://csirt.divd.nl/DIVD-2022-00020/
CVE ID: CVE-2023-22581 State: PUBLISHED Published: 2023-04-24T08:14:53.037Z Last Updated: 2025-03-11T13:39:11.794Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CERN Products: White Rabbit Switch Problem Types: CWE-20 Description: White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application (the default installation makes the webserver run as the root user). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2023-22581/ - https://csirt.divd.nl/DIVD-2022-00068/
CVE ID: CVE-2023-22582 State: PUBLISHED Published: 2023-06-11T13:17:02.415Z Last Updated: 2025-01-09T07:56:41.506Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Danfoss Products: AK-EM100 Problem Types: CWE-79 Description: The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2023-22582/ - https://csirt.divd.nl/DIVD-2023-00021/
CVE ID: CVE-2023-22583 State: PUBLISHED Published: 2023-06-11T13:17:02.674Z Last Updated: 2025-01-09T07:56:41.855Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Danfoss Products: AK-EM100 Problem Types: CWE-89 Description: The Danfoss AK-EM100 web forms allow for SQL injection in the login forms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2023-22583/ - https://csirt.divd.nl/DIVD-2023-00021/
CVE ID: CVE-2023-22584 State: PUBLISHED Published: 2023-06-11T13:17:01.948Z Last Updated: 2025-01-09T07:56:42.422Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Danfoss Products: AK-EM100 Problem Types: CWE-312 Description: The Danfoss AK-EM100 stores login credentials in cleartext. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2023-22584/ - https://csirt.divd.nl/DIVD-2023-00021/
CVE ID: CVE-2023-22585 State: PUBLISHED Published: 2023-06-11T13:17:01.771Z Last Updated: 2025-01-09T07:56:42.249Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Danfoss Products: AK-EM100 Problem Types: CWE-79 Description: The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2023-22585/ - https://csirt.divd.nl/DIVD-2023-00021/
CVE ID: CVE-2023-22586 State: PUBLISHED Published: 2023-06-11T13:17:01.615Z Last Updated: 2025-01-09T07:56:41.684Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Danfoss Products: AK-EM100 Problem Types: CWE-200 Description: The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2023-22586/ - https://csirt.divd.nl/DIVD-2023-00021/
CVE ID: CVE-2023-22591 State: PUBLISHED Published: 2023-03-15T20:07:22.586Z Last Updated: 2025-02-26T20:14:42.469Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Robotic Process Automation Problem Types: CWE-613 Description: IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for not being invalidated after a password reset. IBM X-Force ID: 243710. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6962175 - https://exchange.xforce.ibmcloud.com/vulnerabilities/243710
CVE ID: CVE-2023-22592 State: PUBLISHED Published: 2023-01-18T18:33:47.025Z Last Updated: 2025-04-03T13:00:15.573Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Robotic Process Automation for Cloud Pak Problem Types: 280 Improper Handling of Insufficient Permissions or Privileges Description: IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6855839 - https://exchange.xforce.ibmclo
: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6855839 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244073
CVE ID: CVE-2023-22593 State: PUBLISHED Published: 2023-06-27T18:00:38.347Z Last Updated: 2024-11-06T18:55:14.648Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Robotic Process Automation for Cloud Pak Problem Types: 16 Configuration Description: IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to security misconfiguration of the Redis container which may provide elevated privileges. IBM X-Force ID: 244074. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7006001 - https://exchange.xforce.ibmcloud.com/vulne
Vulnrichment: References: - https://www.ibm.com/support/pages/node/7006001 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244074
CVE ID: CVE-2023-22594 State: PUBLISHED Published: 2023-01-18T18:41:26.417Z Last Updated: 2025-04-03T19:49:39.676Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: IBM Products: Robotic Process Automation for Cloud Pak Problem Types: CWE-79 Description: IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244075. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ession. IBM X-Force ID: 244075. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6855835 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244075
CVE ID: CVE-2023-22595 State: PUBLISHED Published: 2023-07-31T01:13:36.790Z Last Updated: 2024-10-11T19:11:05.490Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: B2B Advanced Communications, Multi-Enterprise Integration Gateway Problem Types: CWE-79 Description: IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244076. Additional Analyst Notes: - CVE Progr
eading to credentials disclosure within a trusted session. IBM X-Force ID: 244076. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7014929 - https://www.ibm.com/support/pages/node/7014929
CVE ID: CVE-2023-22597 State: PUBLISHED Published: 2023-01-12T22:27:53.790Z Last Updated: 2025-01-16T22:02:41.714Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: InHand Networks Products: InRouter 302, InRouter 615 Problem Types: CWE-319 Description: InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQ
horized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
CVE ID: CVE-2023-22598 State: PUBLISHED Published: 2023-01-12T22:30:33.090Z Last Updated: 2025-01-16T22:02:35.851Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: InHand Networks Products: InRouter 302, InRouter 615 Problem Types: CWE-78 Description: InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). An unauthorized user with privileged access to the local web interface or the cloud account managing the affected devices could push a specially crafted configuration upd
local web interface or the cloud account managing the affected devices could push a specially crafted configuration update file to gain root access. This could lead to remote code execution with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
CVE ID: CVE-2023-22599 State: PUBLISHED Published: 2023-01-12T22:31:55.394Z Last Updated: 2025-01-16T22:02:28.222Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: InHand Networks Products: InRouter 302, InRouter 615 Problem Types: CWE-760 Description: InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They send MQTT credentials in response to HTTP/HTTPS requests from the cloud platform. These credentials are encoded using a hardcoded string into an MD5 hash. This string could be easily calculated by an unauthoriz
edentials are encoded using a hardcoded string into an MD5 hash. This string could be easily calculated by an unauthorized user who spoofed sending an HTTP/HTTPS request to the devices. This could result in the affected devices being temporarily disconnected from the cloud platform and allow the user to receive MQTT commands with potentially sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
CVE ID: CVE-2023-22600 State: PUBLISHED Published: 2023-01-12T22:33:16.337Z Last Updated: 2025-01-16T22:02:20.939Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: InHand Networks Products: InRouter 302, InRouter 615 Problem Types: CWE-284 Description: InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Improper Access Control. They allow unauthenticated devices to subscribe to MQTT topics on the same network as the device manager. An unauthorized user who knows of an existing topic name could send and receive messages to and from that topic. This includes
uthorized user who knows of an existing topic name could send and receive messages to and from that topic. This includes the ability to send GET/SET configuration commands, reboot commands, and push firmware updates. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
CVE ID: CVE-2023-22601 State: PUBLISHED Published: 2023-01-12T22:34:14.532Z Last Updated: 2025-01-16T22:02:14.602Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: InHand Networks Products: InRouter 302, InRouter 615 Problem Types: CWE-330 Description: InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unauthorized user could calculate this parameter and use it to gather additional information about other InHand devices managed on the same cloud platform. Addi
arameter and use it to gather additional information about other InHand devices managed on the same cloud platform. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
CVE ID: CVE-2023-22602 State: PUBLISHED Published: 2023-01-14T09:33:39.775Z Last Updated: 2024-08-02T10:13:49.411Z Vendors: Apache Software Foundation Products: Apache Shiro Problem Types: CWE-436 Description: When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher` Additional An
the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl
CVE ID: CVE-2023-22603 State: REJECTED Published: N/A Last Updated: 2023-02-09T00:00:00 Description: No description available.
CVE ID: CVE-2023-22604 State: REJECTED Published: N/A Last Updated: 2023-02-09T00:00:00 Description: No description available.
CVE ID: CVE-2023-22605 State: REJECTED Published: N/A Last Updated: 2023-02-09T00:00:00 Description: No description available.
CVE ID: CVE-2023-22606 State: REJECTED Published: N/A Last Updated: 2023-02-09T00:00:00 Description: No description available.
CVE ID: CVE-2023-22607 State: REJECTED Published: N/A Last Updated: 2023-02-09T00:00:00 Description: No description available.
CVE ID: CVE-2023-22608 State: REJECTED Published: N/A Last Updated: 2023-03-27T00:00:00 Description: No description available.
CVE ID: CVE-2023-22609 State: REJECTED Published: N/A Last Updated: 2023-02-09T00:00:00 Description: No description available.
CVE ID: CVE-2023-22610 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-02-05T20:06:58.944Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) Problem Types: CWE-863 Description: A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the server over the database server TCP port. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&
tainer: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf