Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
OS to bypass security restriction. Exploitation may lead to a system take over by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2023-48668 State: PUBLISHED Published: 2023-12-14T15:45:20.763Z Last Updated: 2024-08-02T21:37:54.276Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: PowerProtect DD Problem Types: CWE-78 Description: Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command injection vulnerability in an admin operation. A local high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the managed system application's underlying OS with the privileges of the vulnerable application. Exploitation may lead to a system take ove
pplication's underlying OS with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker on a managed system of DDMC. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2023-48670 State: PUBLISHED Published: 2023-12-22T15:57:51.883Z Last Updated: 2024-08-02T21:37:54.464Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: SupportAssist Client Consumer Problem Types: CWE-426 Description: Dell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the installer. A local low privileged authenticated attacker may potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/
d privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000220677/dsa-2023-468-security-update-for-dell-supportassist-for-home-pcs-installer-file-local-privilege-escalation-vulnerability
CVE ID: CVE-2023-48671 State: PUBLISHED Published: 2023-12-14T16:15:29.756Z Last Updated: 2024-08-02T21:37:54.246Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: vApp Manager Problem Types: CWE-200 Description: Dell vApp Manager, versions prior to 9.2.4.x contain an information disclosure vulnerability. A remote attacker could potentially exploit this vulnerability leading to obtain sensitive information that may aid in further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unisphere
rt/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-solutions-enabler-virtual-appliance-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2023-48674 State: PUBLISHED Published: 2024-03-01T12:35:56.866Z Last Updated: 2024-08-02T21:37:54.645Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-170 Description: Dell Platform BIOS contains an Improper Null Termination vulnerability. A high privilege user with network access to the system could potentially send malicious data to the device in order to cause some services to cease to function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000220410/dsa-2023-467
CVE ID: CVE-2023-48676 State: PUBLISHED Published: 2023-12-14T13:32:28.791Z Last Updated: 2024-08-02T21:37:54.280Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Acronis Products: Acronis Cyber Protect Cloud Agent Problem Types: CWE-862 Description: Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36943. Additional Analyst Notes: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-5905
CVE ID: CVE-2023-48677 State: PUBLISHED Published: 2023-12-12T08:33:17.191Z Last Updated: 2025-06-04T13:24:51.283Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Protect Home Office, Acronis Cyber Protect Cloud Agent, Acronis Cyber Protect 16 Problem Types: CWE-427 Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40901, Acronis Cyber Protect Cloud Agent (Windows) before build 39378, Acronis Cyber Protect 16 (Windows) before build 39938. Additional Analyst Notes: - CVE Program Container: References: - https://
Cyber Protect 16 (Windows) before build 39938. Additional Analyst Notes: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-5620
CVE ID: CVE-2023-48678 State: PUBLISHED Published: 2024-02-27T16:45:00.771Z Last Updated: 2024-08-16T19:22:09.595Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-276 Description: Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-2319
CVE ID: CVE-2023-48679 State: PUBLISHED Published: 2024-02-27T16:45:53.340Z Last Updated: 2024-08-02T21:37:54.289Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-3469
CVE ID: CVE-2023-48680 State: PUBLISHED Published: 2024-02-27T16:51:19.284Z Last Updated: 2024-09-10T15:47:42.813Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-359 Description: Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect 16 (macOS, Windows) before build 37391. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-5392
CVE ID: CVE-2023-48681 State: PUBLISHED Published: 2024-02-27T16:52:25.743Z Last Updated: 2024-08-02T21:37:54.618Z Severity: LOW (CVSS 1.9 CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-79 Description: Self cross-site scripting (XSS) vulnerability in storage nodes search field. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-5900
CVE ID: CVE-2023-48682 State: PUBLISHED Published: 2024-02-27T16:53:05.091Z Last Updated: 2024-08-02T21:37:54.485Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-5901
CVE ID: CVE-2023-48683 State: PUBLISHED Published: 2024-04-29T15:47:51.993Z Last Updated: 2025-01-02T15:24:40.944Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Acronis Products: Acronis Cyber Protect Cloud Agent, Acronis Cyber Protect 16 Problem Types: CWE-862 Description: Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 37758, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security-advisory.acronis.com
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-5899
CVE ID: CVE-2023-48684 State: PUBLISHED Published: 2024-04-29T15:48:03.752Z Last Updated: 2024-08-02T21:37:54.278Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Acronis Products: Acronis Cyber Protect Cloud Agent Problem Types: CWE-862 Description: Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 37758. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-6021
CVE ID: CVE-2023-48685 State: PUBLISHED Published: 2023-12-21T20:11:22.062Z Last Updated: 2024-08-02T21:37:54.375Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Railway Reservation System Problem Types: CWE-89 Description: Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'psd' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/barenboim/ - https://projectworlds.in/
CVE ID: CVE-2023-48686 State: REJECTED Published: 2023-12-21T20:40:48.798Z Last Updated: 2024-01-02T14:40:18.471Z Description: No description available.
CVE ID: CVE-2023-48687 State: PUBLISHED Published: 2023-12-21T20:42:58.832Z Last Updated: 2024-08-02T21:37:54.308Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Railway Reservation System Problem Types: CWE-89 Description: Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'from' parameter of the reservation.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/barenboim/ - https://projectworlds.in/
CVE ID: CVE-2023-48688 State: REJECTED Published: 2023-12-21T20:43:53.294Z Last Updated: 2024-01-02T14:40:53.810Z Description: No description available.
CVE ID: CVE-2023-48689 State: PUBLISHED Published: 2023-12-21T20:46:46.616Z Last Updated: 2025-04-23T16:21:51.502Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Railway Reservation System Problem Types: CWE-89 Description: Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'byname' parameter of the train.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/barenboim/ - https://projectworlds
Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/barenboim/ - https://projectworlds.in/
CVE ID: CVE-2023-48690 State: REJECTED Published: 2023-12-21T20:47:21.255Z Last Updated: 2024-01-02T14:41:11.622Z Description: No description available.
CVE ID: CVE-2023-48691 State: PUBLISHED Published: 2023-12-05T00:24:41.913Z Last Updated: 2024-08-02T21:37:54.592Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: azure-rtos Products: netxduo Problem Types: CWE-787 Description: Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause an out-of-bounds write in Azure RTOS NETX Duo, that could lead to remote code execution. The affected components include process related to IGMP protocol in RTOS v6.2.1 and below. The fix has been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for
. The fix has been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/azure-rtos/netxduo/security/advisories/GHSA-fwmg-rj6g-w99p
CVE ID: CVE-2023-48692 State: PUBLISHED Published: 2023-12-05T00:24:44.801Z Last Updated: 2024-08-02T21:37:54.428Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: azure-rtos Products: netxduo Problem Types: CWE-787, CWE-825 Description: Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to icmp, tcp, snmp, dhcp, nat and ftp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to
dhcp, nat and ftp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/azure-rtos/netxduo/security/advisories/GHSA-m2rx-243p-9w64
CVE ID: CVE-2023-48693 State: PUBLISHED Published: 2023-12-05T00:24:47.969Z Last Updated: 2024-08-02T21:37:54.427Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: azure-rtos Products: threadx Problem Types: CWE-20 Description: Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications. An attacker can cause arbitrary read and write due to vulnerability in parameter checking mechanism in Azure RTOS ThreadX, which may lead to privilege escalation. The affected components include RTOS ThreadX v6.2.1 and below. The fixes have been included in ThreadX release 6.3.0. Users are advised to upgrade. There
OS ThreadX v6.2.1 and below. The fixes have been included in ThreadX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/azure-rtos/threadx/security/advisories/GHSA-p7w6-62rq-vrf9
CVE ID: CVE-2023-48694 State: PUBLISHED Published: 2023-12-05T00:24:51.198Z Last Updated: 2024-10-15T17:38:11.982Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: azure-rtos Products: usbx Problem Types: CWE-825, CWE-843 Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference and type confusion vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host class, related to device linked classes, ASIX, Prolific, SWAR, audio, CDC ECM in RTOS v6.2.1 and b
n host stack and host class, related to device linked classes, ASIX, Prolific, SWAR, audio, CDC ECM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/azure-rtos/usbx/security/advisories/GHSA-qjw8-7w86-44qj
CVE ID: CVE-2023-48695 State: PUBLISHED Published: 2023-12-05T00:24:54.163Z Last Updated: 2025-05-29T13:35:42.752Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: azure-rtos Products: usbx Problem Types: CWE-787 Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to out of bounds write vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host and device classes, related to CDC ECM and RNDIS in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upg
CDC ECM and RNDIS in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/azure-rtos/usbx/security/advisories/GHSA-mwj9-rpph-v8wc
CVE ID: CVE-2023-48696 State: PUBLISHED Published: 2023-12-05T00:24:57.565Z Last Updated: 2024-08-02T21:37:53.616Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: azure-rtos Products: usbx Problem Types: CWE-825, CWE-754 Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include components in host class, related to CDC ACM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There a
ACM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/azure-rtos/usbx/security/advisories/GHSA-h733-98hq-f884
CVE ID: CVE-2023-48697 State: PUBLISHED Published: 2023-12-05T00:25:00.648Z Last Updated: 2024-08-28T17:30:57.593Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: azure-rtos Products: usbx Problem Types: CWE-476, CWE-825, CWE-787 Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to memory buffer and pointer vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in pictbridge and host class, related to PIMA, storage, CDC ACM, ECM, audio, hub in RTOS v6.2.1 and below. The fixes have been includ
and host class, related to PIMA, storage, CDC ACM, ECM, audio, hub in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/azure-rtos/usbx/security/advisories/GHSA-p2p9-wp2q-wjv4
CVE ID: CVE-2023-48698 State: PUBLISHED Published: 2023-12-05T00:25:03.983Z Last Updated: 2024-11-27T15:59:53.223Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: azure-rtos Products: usbx Problem Types: CWE-754, CWE-825 Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host classes, related to device linked classes, GSER and HID in RTOS v6.2.1 and below. The fixes have been included in USB
st classes, related to device linked classes, GSER and HID in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/azure-rtos/usbx/security/advisories/GHSA-grhp-f66q-x857
CVE ID: CVE-2023-48699 State: PUBLISHED Published: 2023-11-21T22:25:41.183Z Last Updated: 2024-08-02T21:37:53.483Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ubertidavide Products: fastbots Problem Types: CWE-95 Description: fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function `def __locator__(self, locator_name: str)` in `page.py`. In order to mitigate this issue, upgrade to fastbots version 0.
`def __locator__(self, locator_name: str)` in `page.py`. In order to mitigate this issue, upgrade to fastbots version 0.1.5 or above. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ubertidavide/fastbots/security/advisories/GHSA-vccg-f4gp-45x9 - https://github.com/ubertidavide/fastbots/pull/3#issue-2003080806 - https://github.com/ubertidavide/fastbots/commit/73eb03bd75365e112b39877e26ef52853f5e9f57
CVE ID: CVE-2023-48700 State: PUBLISHED Published: 2023-11-21T22:30:58.030Z Last Updated: 2024-08-02T21:37:54.443Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: nautobot Products: nautobot-plugin-device-onboarding Problem Types: CWE-256, CWE-312 Description: The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are visible via Job Results from an execution of an Onboarding Task. Version 3.0.0 fixes this issue; no known workar
ask are visible via Job Results from an execution of an Onboarding Task. Version 3.0.0 fixes this issue; no known workarounds are available. Mitigation recommendations include deleting all Job Results for any onboarding task to remove clear text credentials from database entries that were run while on v2.0.X, upgrading to v3.0.0, and rotating any exposed credentials. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nautobot/nautobot-plugin-device-onboarding/security/advisories/GHSA-qf3c-rw9f-jh7v
CVE ID: CVE-2023-48701 State: PUBLISHED Published: 2023-11-21T22:34:11.043Z Last Updated: 2024-08-02T21:37:53.540Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H) Vendors: statamic Products: cms Problem Types: CWE-79 Description: Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0. Additional Analyst Notes: - CVE Program Cont
requires authentication. This issue has been patched on 3.4.15 and 4.36.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv - https://github.com/statamic/cms/releases/tag/v3.4.15 - https://github.com/statamic/cms/releases/tag/v4.36.0