Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-1112 State: PUBLISHED Published: 2023-03-01T09:54:38.579Z Last Updated: 2025-03-05T19:25:22.912Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: Drag and Drop Multiple File Upload Contact Form 7 Problem Types: CWE-23 Description: A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VD
ttack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222072 - https://vuldb.com/?ctiid.222072 - https://github.com/Nickguitar/Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal
CVE ID: CVE-2023-1113 State: PUBLISHED Published: 2023-03-01T09:57:48.233Z Last Updated: 2025-03-07T18:50:01.138Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Simple Payroll System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Simple Payroll System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file admin/?page=admin of the component POST Parameter Handler. The manipulation of the argument fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222073 was ass
an be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222073 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222073 - https://vuldb.com/?ctiid.222073 - https://github.com/lcg-22266/bug_report/blob/main/vendors/oretnom23/Simple%20Payroll%20System/XSS-1.md
CVE ID: CVE-2023-1114 State: PUBLISHED Published: 2023-03-01T11:50:52.988Z Last Updated: 2024-08-02T05:32:46.393Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Eskom Products: e-Belediye Problem Types: CWE-862 Description: Missing Authorization vulnerability in Eskom e-Belediye allows Information Elicitation.This issue affects e-Belediye: from 1.0.0.95 before 1.0.0.100. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0113-2
CVE ID: CVE-2023-1115 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-11T14:15:32.285Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/cfa80332-e4cf-4d64-b3e5-e10298628d17 - https://github.com/pimcore/pimcore/commit/c6368b7cc69a3ebf2c83de7586f492ca1f404dd3
CVE ID: CVE-2023-1116 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-07T18:33:04.217Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3245ff99-9adf-4db9-af94-f995747e09d1 - https://github.com/pimcore/pimcore/commit/f6d322efa207a737eedd8726b7c92e957a83341e
CVE ID: CVE-2023-1117 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-07T18:32:31.478Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e8c0044d-a31b-4347-b2d5-59fbf492da39 - https://github.com/pimcore/pimcore/commit/b9ba69f66d6a9986fb36f239661b98cd33a89853
CVE ID: CVE-2023-1118 State: PUBLISHED Published: 2023-03-02T00:00:00.000Z Last Updated: 2025-04-23T16:23:43.760Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/29b0589a865b6f66d141d79b2dd1373e4e50fe17 - https://security.netapp.com/advisory/ntap-20230413-0003/ - https://lists.debian.org/debian-lts-annou
b2dd1373e4e50fe17 - https://security.netapp.com/advisory/ntap-20230413-0003/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE ID: CVE-2023-1119 State: PUBLISHED Published: 2023-07-10T12:40:23.149Z Last Updated: 2025-01-06T17:06:12.185Z Vendors: Unknown Products: WP-Optimize, SrbTransLatin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2e78735a-a7fc-41fe-8284-45bf451eff06
CVE ID: CVE-2023-1120 State: PUBLISHED Published: 2023-04-10T13:18:00.817Z Last Updated: 2025-02-11T21:21:11.936Z Vendors: Unknown Products: Simple Giveaways Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c2defd30-7e4c-4a28-8a68-282429061f3f
CVE ID: CVE-2023-1121 State: PUBLISHED Published: 2023-04-10T13:18:04.716Z Last Updated: 2025-02-11T21:10:57.205Z Vendors: Unknown Products: Simple Giveaways Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7ead9fb9-d81f-47c6-a1b4-21f29183cc15
CVE ID: CVE-2023-1122 State: PUBLISHED Published: 2023-04-10T13:17:53.053Z Last Updated: 2025-02-11T15:16:04.690Z Vendors: Unknown Products: Simple Giveaways Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/71f5d630-2726-48c7-b9e5-7bebc786b561
CVE ID: CVE-2023-1124 State: PUBLISHED Published: 2023-04-03T14:38:26.671Z Last Updated: 2025-02-14T16:58:56.413Z Vendors: Unknown Products: Shopping Cart & eCommerce Store Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/229b93cd-544b-4877-8d9f-e6debda9511c
CVE ID: CVE-2023-1125 State: PUBLISHED Published: 2023-05-02T07:04:52.700Z Last Updated: 2025-01-30T14:51:08.700Z Vendors: Unknown Products: Ruby Help Desk Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e8a4b6ab-47f8-495d-a22c-dcf914dfb58c
CVE ID: CVE-2023-1126 State: PUBLISHED Published: 2023-04-24T18:30:55.522Z Last Updated: 2025-02-04T17:23:13.197Z Vendors: Unknown Products: WP FEvents Book Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP FEvents Book WordPress plugin through 0.46 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/87ce3c59-b234-47bf-abca-e690b53bbe82
CVE ID: CVE-2023-1127 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-07T16:39:25.382Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-369 Description: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2d4d309e-4c96-415f-9070-36d0815f1beb - https://github.com/vim/vim/commit/e0f869196930ef5f25a0ac41c9215b09c9ce2d3c - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDVN5HSWPNVP4QXBPCEGZDLZKURLJWTE/ - https://lists.fedor
archives/list/package-announce%40lists.fedoraproject.org/message/PDVN5HSWPNVP4QXBPCEGZDLZKURLJWTE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ6TMKKBXHGVUHWFGM4X46VIJO7ZAG2W/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6/
CVE ID: CVE-2023-1129 State: PUBLISHED Published: 2023-04-24T18:30:52.240Z Last Updated: 2025-02-04T18:38:47.208Z Vendors: Unknown Products: WP FEvents Book Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d40479de-fb04-41b8-9fb0-41b9eefbd8af
CVE ID: CVE-2023-1130 State: PUBLISHED Published: 2023-03-01T19:34:48.882Z Last Updated: 2024-08-02T05:32:46.381Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Computer Parts Sales and Inventory System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file processlogin. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222105 was assigned to this vulnerability. Addition
has been disclosed to the public and may be used. The identifier VDB-222105 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222105 - https://vuldb.com/?ctiid.222105 - https://github.com/WhiteA1so/Cvetest/blob/main/Sql1.pdf
CVE ID: CVE-2023-1131 State: PUBLISHED Published: 2023-03-01T19:36:23.778Z Last Updated: 2025-03-06T19:08:04.238Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Computer Parts Sales and Inventory System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Computer Parts Sales and Inventory System 1.0 and classified as problematic. This vulnerability affects unknown code of the file customer.php. The manipulation of the argument FIRST_NAME/LAST_NAME/PHONE_NUMBER leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222106 is the identifier assign
be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222106 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222106 - https://vuldb.com/?ctiid.222106 - https://github.com/WhiteA1so/Cvetest/blob/main/1.pdf
CVE ID: CVE-2023-1132 State: PUBLISHED Published: 2023-05-18T18:44:04.702Z Last Updated: 2025-01-22T14:01:39.139Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: silabs.com Products: Gecko Platform Problem Types: CWE-14 Description: Compiler removal of buffer clearing in sli_se_driver_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk - https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE ID: CVE-2023-1133 State: PUBLISHED Published: 2023-03-27T14:33:18.921Z Last Updated: 2025-02-13T16:39:15.943Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-502 Deserialization of Untrusted Data Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow an unauthenticated attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CI
an unauthenticated attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02 - http://packetstormsecurity.com/files/172799/Delta-Electronics-InfraSuite-Device-Master-Deserialization.html
CVE ID: CVE-2023-1134 State: PUBLISHED Published: 2023-03-27T14:47:43.501Z Last Updated: 2025-01-16T21:39:42.531Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a path traversal vulnerability, which could allow an attacker to read local files, disclose plaintext credentials, and escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-
es. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1135 State: PUBLISHED Published: 2023-03-27T14:59:57.462Z Last Updated: 2025-01-16T21:38:57.559Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-732 Description: In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which could result in local privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1136 State: PUBLISHED Published: 2023-03-27T14:50:18.966Z Last Updated: 2025-01-16T21:39:27.485Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-287 Improper Authentication Description: In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authentication bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1137 State: PUBLISHED Published: 2023-03-27T14:44:40.332Z Last Updated: 2025-01-16T21:40:39.590Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-284 Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1138 State: PUBLISHED Published: 2023-03-27T14:41:48.610Z Last Updated: 2025-01-16T21:41:09.760Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-284 Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain an improper access control vulnerability, which could allow an attacker to retrieve Gateway configuration files to obtain plaintext credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1139 State: PUBLISHED Published: 2023-03-27T14:36:28.810Z Last Updated: 2025-01-16T21:41:21.901Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-502 Deserialization of Untrusted Data Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which could allow deserialization of requests prior to authentication, resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1140 State: PUBLISHED Published: 2023-03-27T14:54:53.192Z Last Updated: 2025-01-16T21:39:13.175Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-306 Missing Authentication for Critical Function Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauthenticated remote code execution in the context of an administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1141 State: PUBLISHED Published: 2023-03-27T14:51:43.547Z Last Updated: 2025-01-16T21:39:20.180Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a command injection vulnerability that could allow an attacker to inject arbitrary commands, which could result in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-event
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1142 State: PUBLISHED Published: 2023-03-27T14:48:55.406Z Last Updated: 2025-01-16T21:39:34.845Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-adviso
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1143 State: PUBLISHED Published: 2023-03-27T14:46:20.000Z Last Updated: 2025-01-16T21:39:49.421Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-749 Description: In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1144 State: PUBLISHED Published: 2023-03-27T14:43:11.987Z Last Updated: 2025-01-16T21:40:57.021Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-284 Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE ID: CVE-2023-1145 State: PUBLISHED Published: 2023-03-27T14:56:30.287Z Last Updated: 2025-01-16T21:39:05.219Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-502 Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02