Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-22900 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-03-27T14:38:46.023Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Thinking Software Technology Co., Ltd. Products: Efence Problem Types: CWE-89 Description: Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6885-d679e-1.html
CVE ID: CVE-2023-22901 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-30T21:14:20.095Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ChangingTec Products: MOTP Problem Types: CWE-22 Description: ChangingTec MOTP system has a path traversal vulnerability. A remote attacker with administrator’s privilege can exploit this vulnerability to access arbitrary system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7022-2cbe0-1.html
CVE ID: CVE-2023-22902 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T16:28:31.236Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Openfind Products: Mail2000 Problem Types: CWE-79 Description: Openfind Mail2000 file uploading function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject JavaScript, conducting an XSS attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6953-79236-1.html
CVE ID: CVE-2023-22903 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-07T18:37:16.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: api/views/user.py in LibrePhotos before e19e539 has incorrect access control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LibrePhotos/librephotos/commit/e19e539356df77f6f59e7d1eea22d452b268e120 - https://raw.githubusercontent.com/go-compile/security-advisories/master/CVE-2023-22903.pdf
CVE ID: CVE-2023-22906 State: PUBLISHED Published: 2023-07-03T00:00:00 Last Updated: 2024-11-25T18:15:29.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://twitter.com/ayyappan162010/status/1610764707753000960 - https://github.com/nonamecoder/CVE-2023-22906
CVE ID: CVE-2023-22909 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-07T18:36:40.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. SpecialMobileHistory allows remote attackers to cause a denial of service because database queries are slow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T320987 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AP65YEN762IBNQPOYGUVLTQIDLM5XD2A/
CVE ID: CVE-2023-22910 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T15:15:05.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via wikibase-time-precision-* fields. This allows JavaScript execution by staff/admin users who do not intentionally have the editsitejs capability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T323592
CVE ID: CVE-2023-22911 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-07T18:36:08.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T149488 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/
ikimedia.org/T149488 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AP65YEN762IBNQPOYGUVLTQIDLM5XD2A/
CVE ID: CVE-2023-22912 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T15:13:11.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated (aka re-used) nonce, allowing an adversary to decrypt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T315123
CVE ID: CVE-2023-22913 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-12T16:21:34.031Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Zyxel Products: USG FLEX series firmware, VPN series firmware Problem Types: CWE-77 Description: A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data, resulting in denial-of-service (DoS) conditions on an affected device. Additional Analyst Notes: - CVE Program
on data, resulting in denial-of-service (DoS) conditions on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps
CVE ID: CVE-2023-22914 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-12T16:22:16.191Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: USG FLEX series firmware, VPN series firmware Problem Types: CWE-22 Description: A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS commands in the “tmp” directory by uploading a crafted file if the hotspot function were enabled. Additional Analyst
OS commands in the “tmp” directory by uploading a crafted file if the hotspot function were enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps
CVE ID: CVE-2023-22915 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-12T16:22:50.289Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: USG FLEX series firmware, USG FLEX 50(W) firmware, USG20(W)-VPN firmware, VPN series firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote unauthenticated attacker to cause DoS condit
VPN series firmware versions 4.30 through 5.35, which could allow a remote unauthenticated attacker to cause DoS conditions by sending a crafted HTTP request if the Facebook WiFi function were enabled on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps
CVE ID: CVE-2023-22916 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-12T16:42:02.320Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) firmware, USG20(W)-VPN firmware, VPN series firmware Problem Types: CWE-20 Description: The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails to properly sanitize user input. A rem
.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails to properly sanitize user input. A remote unauthenticated attacker could leverage the vulnerability to modify device configuration data, resulting in DoS conditions on an affected device if the attacker could trick an authorized administrator to switch the management mode to the cloud mode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps
CVE ID: CVE-2023-22917 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-12T16:02:01.734Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) firmware, USG20(W)-VPN firmware, VPN series firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35, which coul
h 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35, which could allow a remote unauthenticated attacker to cause a core dump with a request error message on a vulnerable device by uploading a crafted configuration file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps
CVE ID: CVE-2023-22918 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-12T16:01:35.920Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) firmware, USG20(W)-VPN firmware, VPN series firmware, NWA110AX firmware, WAC500 firmware, WAX510D firmware Problem Types: CWE-359 Description: A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through
ions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewall
s://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps
CVE ID: CVE-2023-22919 State: PUBLISHED Published: 2023-05-01T00:00:00.000Z Last Updated: 2025-01-30T16:53:59.371Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NBG6604 firmware Problem Types: CWE-78 Description: The post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-v
/www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nbg6604-home-router
CVE ID: CVE-2023-22920 State: PUBLISHED Published: 2023-02-21T00:00:00.000Z Last Updated: 2025-03-12T14:35:22.085Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: LTE3316-M604 Problem Types: CWE-284 Description: A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended for testing purposes. A remote attacker could leverage this vulnerability to access an affected device using Telnet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-secu
Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-security-misconfiguration-vulnerability-of-4g-lte-indoor-routers
CVE ID: CVE-2023-22921 State: PUBLISHED Published: 2023-05-01T00:00:00.000Z Last Updated: 2025-01-30T16:49:28.838Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H) Vendors: Zyxel Products: NBG-418N v2 firmware Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker with administrator privileges to store malicious scripts using a web management interface parameter, resulting in denial-of-service (DoS) conditions on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyx
fected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nbg-418n-v2-home-router
CVE ID: CVE-2023-22922 State: PUBLISHED Published: 2023-05-01T00:00:00.000Z Last Updated: 2025-01-30T16:48:40.953Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: NBG-418N v2 firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote unauthenticated attacker to cause DoS conditions by sending crafted packets if Telnet is enabled on a vulnerable device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vu
hment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nbg-418n-v2-home-router
CVE ID: CVE-2023-22923 State: PUBLISHED Published: 2023-05-01T00:00:00.000Z Last Updated: 2025-01-30T16:48:14.609Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: NBG-418N v2 firmware Problem Types: CWE-134 Description: A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker to cause denial-of-service (DoS) conditions on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nb
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nbg-418n-v2-home-router
CVE ID: CVE-2023-22924 State: PUBLISHED Published: 2023-05-01T00:00:00.000Z Last Updated: 2025-01-30T16:47:11.159Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: NBG-418N v2 firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker with administrator privileges to cause denial-of-service (DoS) conditions by executing crafted CLI commands on a vulnerable device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyx
rogram Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nbg-418n-v2-home-router
CVE ID: CVE-2023-22931 State: PUBLISHED Published: 2023-02-14T17:22:36.712Z Last Updated: 2025-02-28T11:03:46.340Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-285 Description: In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0201 - https://research.splunk.com/appl
Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0201 - https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/
CVE ID: CVE-2023-22932 State: PUBLISHED Published: 2023-02-14T17:22:38.739Z Last Updated: 2025-02-28T11:03:57.639Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-79 Description: In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0202 - https://research.splunk.com/ap
E Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0202 - https://research.splunk.com/application/ce6e1268-e01c-4df2-a617-0f034ed49a43/
CVE ID: CVE-2023-22933 State: PUBLISHED Published: 2023-02-14T17:22:40.081Z Last Updated: 2025-02-28T11:03:44.416Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-79 Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extensible mark-up language (XML) View through the ‘layoutPanel’ attribute in the ‘module’ tag’. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0203 - https://research.splunk.com/application/9ac2bfea-a234-4a18-9d37-6d747e85c2e4
CVE ID: CVE-2023-22934 State: PUBLISHED Published: 2023-02-14T17:22:35.427Z Last Updated: 2025-02-28T11:03:58.707Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-20 Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a saved search job. The vulnerability requires an authenticated user to craft the saved job and a higher privileged user to initiate a request within their browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
user to initiate a request within their browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0204 - https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd
CVE ID: CVE-2023-22935 State: PUBLISHED Published: 2023-02-14T17:22:36.093Z Last Updated: 2025-03-20T13:55:35.952Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-20 Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
ts instances with Splunk Web enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2023-0205 - https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd
CVE ID: CVE-2023-22936 State: PUBLISHED Published: 2023-02-14T17:22:38.050Z Last Updated: 2025-02-28T11:03:49.899Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-918 Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within the environment. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/
ty within the environment. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0206 - https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd
CVE ID: CVE-2023-22937 State: PUBLISHED Published: 2023-02-14T17:24:45.588Z Last Updated: 2025-02-28T11:03:41.352Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-20 Description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now be one of the following only: .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gzl. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0207 - https://re
Analyst Notes: - CVE Program Container: References: - https://advisory.splunk.com/advisories/SVD-2023-0207 - https://research.splunk.com/application/b7d1293f-e78f-415e-b5f6-443df3480082/