Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0317 State: PUBLISHED Published: 2023-04-19T11:57:46.409Z Last Updated: 2025-02-05T15:03:03.498Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Secomea Products: GateManager Problem Types: CWE-420 Description: Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.secomea.com/support/cybersecurity-advisory/
CVE ID: CVE-2023-0319 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-11T16:09:27.128Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1, allowing to read environment names supposed to be restricted to project memebers only. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/388
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/388096 - https://hackerone.com/reports/1817586 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0319.json
CVE ID: CVE-2023-0320 State: PUBLISHED Published: 2023-03-20T12:18:36.073Z Last Updated: 2025-02-26T19:19:37.096Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Izmir Katip Celebi University Products: UBYS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Izmir Katip Celebi University UBYS allows Stored XSS.This issue affects UBYS: before 23.03.16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0159
CVE ID: CVE-2023-0321 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-03-27T20:09:03.149Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Campbell Scientific Products: CR6, CR300, CR800, CR1000, CR3000 Problem Types: CWE-200 Description: Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may al
with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/disclosure-sensitive-information-campbell-scientific-products - https://www.hackplayers.com/2023/01/cve-2023-0321-info-sensible-campbell.html
CVE ID: CVE-2023-0322 State: PUBLISHED Published: 2023-03-15T11:15:23.895Z Last Updated: 2025-02-27T14:17:16.554Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Talent Software Products: UNIS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS.This issue affects UNIS: before 28376. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0147
CVE ID: CVE-2023-0323 State: PUBLISHED Published: 2023-01-16T00:00:00.000Z Last Updated: 2025-04-07T15:08:14.295Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/129d6a4b-0504-4de1-a72c-3f12c4552343 - https://github.com/pimcore/pimcore/commit/746fac1a342841624f63ab13edcd340358e1bc04
CVE ID: CVE-2023-0324 State: PUBLISHED Published: 2023-01-16T14:58:03.549Z Last Updated: 2024-08-02T05:10:55.128Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/page-login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-218426 is the identifier assigned to this vulnerabilit
The exploit has been disclosed to the public and may be used. VDB-218426 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218426 - https://vuldb.com/?ctiid.218426 - https://github.com/linmoren/online-tours-travels-management-system/blob/main/adminpage-login-email.md
CVE ID: CVE-2023-0325 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T16:22:05.191Z Vendors: n/a Products: Uvdesk Problem Types: Stored cross-site scripting (XSS) Description: Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/labrinth/ - https://github.com/uvdesk/community-skeleton/
CVE ID: CVE-2023-0326 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T19:31:29.580Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab DAST API scanner Problem Types: Information exposure in GitLab DAST API scanner Description: An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization headers was leaked in vulnerability report evidence. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/388132 - https://hackerone.com/reports/1826896 - https://gitlab.c
ences: - https://gitlab.com/gitlab-org/gitlab/-/issues/388132 - https://hackerone.com/reports/1826896 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0326.json
CVE ID: CVE-2023-0327 State: PUBLISHED Published: 2023-01-16T18:50:23.372Z Last Updated: 2024-08-02T05:10:55.201Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: saemorris Products: TheRadSystem Problem Types: CWE-79 Description: A vulnerability was found in saemorris TheRadSystem. It has been classified as problematic. Affected is an unknown function of the file users.php. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. VDB-218454 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218454 - https://vuldb.com/?ctiid.218454 - https://g
Notes: - CVE Program Container: References: - https://vuldb.com/?id.218454 - https://vuldb.com/?ctiid.218454 - https://github.com/saemorris/TheRadSystem/commit/bfba26bd34af31648a11af35a0bb66f1948752a6
CVE ID: CVE-2023-0328 State: PUBLISHED Published: 2023-03-06T13:33:58.773Z Last Updated: 2025-03-06T15:14:23.559Z Vendors: Unknown Products: WPCode Problem Types: CWE-863 Incorrect Authorization Description: The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3c4318a9-a3c5-409b-a52e-edd8583c3c43
CVE ID: CVE-2023-0329 State: PUBLISHED Published: 2023-05-30T07:49:13.896Z Last Updated: 2025-04-23T16:21:31.797Z Vendors: Unknown Products: Elementor Website Builder Problem Types: CWE-89 SQL Injection Description: The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a875836d-77f4-4306-b275-2b60efff1493 - http://packetstormsecurity.com/files/175639/Elementor-Website-Bu
om/vulnerability/a875836d-77f4-4306-b275-2b60efff1493 - http://packetstormsecurity.com/files/175639/Elementor-Website-Builder-SQL-Injection.html
CVE ID: CVE-2023-0330 State: PUBLISHED Published: 2023-03-06T00:00:00 Last Updated: 2024-08-02T05:10:55.143Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H) Problem Types: CWE-121 Description: A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-0330 - https://bugzilla.redhat.com/show_bug.cgi?id=2160151 - https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html - https://lists.nongnu.org/archive/
.cgi?id=2160151 - https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html - https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html
CVE ID: CVE-2023-0331 State: PUBLISHED Published: 2023-02-27T15:24:42.395Z Last Updated: 2025-03-10T18:17:19.090Z Vendors: Unknown Products: Correos Oficial Problem Types: CWE-552 Files or Directories Accessible to External Parties Description: The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1b4dbaf3-1364-4103-9a7b-b5a1355c685b
CVE ID: CVE-2023-0332 State: PUBLISHED Published: 2023-01-17T07:29:05.823Z Last Updated: 2024-08-02T05:10:55.139Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Food Ordering System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file admin/manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218472. Additional Analyst Notes: - CVE Progr
to the public and may be used. The identifier of this vulnerability is VDB-218472. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218472 - https://vuldb.com/?ctiid.218472 - https://github.com/qyhmsys/cve-list/blob/master/Online%20Food%20Ordering%20System%20manage_user.php%20has%20SQLinject.md
CVE ID: CVE-2023-0333 State: PUBLISHED Published: 2023-02-13T14:32:14.358Z Last Updated: 2025-03-21T16:14:13.520Z Vendors: Unknown Products: TemplatesNext ToolKit Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e86ff4d5-d549-4c71-b80e-6a9b3bfddbfc
CVE ID: CVE-2023-0334 State: PUBLISHED Published: 2023-02-27T15:24:25.925Z Last Updated: 2025-03-10T18:06:31.947Z Vendors: Unknown Products: ShortPixel Adaptive Images Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b027a8db-0fd6-444d-b14a-0ae58f04f931
CVE ID: CVE-2023-0335 State: PUBLISHED Published: 2023-03-27T15:37:21.384Z Last Updated: 2025-02-19T20:19:09.595Z Vendors: Unknown Products: WP Shamsi Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f7a20bea-c3d5-431b-bdcf-e189c81a561a
CVE ID: CVE-2023-0336 State: PUBLISHED Published: 2023-03-27T15:37:38.218Z Last Updated: 2025-02-19T19:27:21.170Z Vendors: Unknown Products: OoohBoi Steroids for Elementor Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ac74df9a-6fbf-4411-a501-97eba1ad1895
CVE ID: CVE-2023-0337 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-04T18:47:55.904Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: lirantal Products: lirantal/daloradius Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lirantal/daloradius/commit/e77a769c7503e63a2e3c05262cb5f8f81a4a7bbe - https://huntr.dev/bounties/1c50a5a5-3f55-4b6f-b861-4d5cdb6eb81b
CVE ID: CVE-2023-0338 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-04T18:38:52.275Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: lirantal Products: lirantal/daloradius Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/fcae1b67-db37-4d24-9137-8dda95573e77 - https://github.com/lirantal/daloradius/commit/e77a769c7503e63a2e3c05262cb5f8f81a4a7bbe
CVE ID: CVE-2023-0339 State: PUBLISHED Published: 2023-02-28T16:21:03.540Z Last Updated: 2025-04-14T17:03:53.781Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ForgeRock Products: Access Management Web Policy Agent Problem Types: CWE-23 Description: Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects Access Management Web Policy Agent: all versions up to 5.10.1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://backstage.forgerock.com/downloads/browse/am/featured/web-agents - https://backstage.forgerock.com/knowledge/kb/articl
://backstage.forgerock.com/downloads/browse/am/featured/web-agents - https://backstage.forgerock.com/knowledge/kb/article/a21576868
CVE ID: CVE-2023-0340 State: PUBLISHED Published: 2023-03-20T15:52:22.788Z Last Updated: 2025-02-26T18:49:48.752Z Vendors: Unknown Products: Custom Content Shortcode Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via t
could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/71956598-90aa-4557-947a-c4716674543d
CVE ID: CVE-2023-0341 State: PUBLISHED Published: 2023-01-31T23:22:53.634Z Last Updated: 2025-11-03T21:46:50.070Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: EditorConfig Products: EditorConfig C Core Problem Types: CWE-121 Description: A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/edi
buffer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e - https://litios.github.io/2023/01/14/CVE-2023-0341.html - https://ubuntu.com/security/notices/USN-5842-1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/
CVE ID: CVE-2023-0342 State: PUBLISHED Published: 2023-06-09T00:00:00 Last Updated: 2025-01-06T19:25:32.663Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: MongoDB Inc. Products: MongoDB Ops Manager Problem Types: CWE-497 Description: MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-serv
ADP Vulnrichment: References: - https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-6-0-12 - https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-5-0-21
CVE ID: CVE-2023-0343 State: PUBLISHED Published: 2023-03-31T15:42:22.858Z Last Updated: 2025-01-16T21:37:18.422Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Akuvox Products: E11 Problem Types: CWE-329 Generation of Predictable IV with CBC Description: Akuvox E11 contains a function that encrypts messages which are then forwarded. The IV vector and the key are static, and this may allow an attacker to decrypt messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE ID: CVE-2023-0344 State: PUBLISHED Published: 2023-03-31T15:43:23.608Z Last Updated: 2025-01-16T21:37:07.032Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Akuvox Products: E11 Problem Types: CWE-912 Hidden Functionality Description: Akuvox E11 appears to be using a custom version of dropbear SSH server. This server allows an insecure option that by default is not in the official dropbear SSH server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE ID: CVE-2023-0345 State: PUBLISHED Published: 2023-03-13T20:29:30.386Z Last Updated: 2025-01-16T21:43:21.499Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Akuvox Products: E11 Problem Types: CWE-798 Use of Hard-coded Credentials Description: The Akuvox E11 secure shell (SSH) server is enabled by default and can be accessed by the root user. This password cannot be changed by the user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE ID: CVE-2023-0346 State: PUBLISHED Published: 2023-03-13T20:28:00.701Z Last Updated: 2025-01-16T21:44:55.742Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Akuvox Products: E11 Problem Types: CWE-287 Improper Authentication Description: Akuvox E11 cloud login is performed through an unencrypted HTTP connection. An attacker could gain access to the Akuvox cloud and device if the MAC address of a device if known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE ID: CVE-2023-0347 State: PUBLISHED Published: 2023-03-13T20:27:02.285Z Last Updated: 2025-01-16T21:54:29.031Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Akuvox Products: E11 Problem Types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Description: The Akuvox E11 Media Access Control (MAC) address, a primary identifier, combined with the Akuvox E11 IP address, could allow an attacker to identify the device on the Akuvox cloud. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE ID: CVE-2023-0348 State: PUBLISHED Published: 2023-03-13T20:24:11.414Z Last Updated: 2025-01-16T21:54:37.252Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Akuvox Products: E11 Problem Types: CWE-284 Improper Access Control Description: Akuvox E11 allows direct SIP calls. No access control is enforced by the SIP servers, which could allow an attacker to contact any device within Akuvox to call any other device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE ID: CVE-2023-0349 State: PUBLISHED Published: 2023-03-13T20:23:34.393Z Last Updated: 2025-01-16T21:54:44.197Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Akuvox Products: E11 Problem Types: CWE-862 Missing Authorization Description: The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video. This could allow an attacker to view and record image and video from the camera. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01