Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-23828 State: PUBLISHED Published: 2023-08-10T12:22:15.735Z Last Updated: 2025-02-19T21:26:36.737Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Swashata Products: WP Category Post List Widget Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Swashata WP Category Post List Widget plugin <= 2.0.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-category-posts-list/wordpress-wp-category-post-list-widget-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23829 State: PUBLISHED Published: 2023-08-08T11:35:39.729Z Last Updated: 2024-09-25T16:45:31.794Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Pierre JEHAN Products: Owl Carousel Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pierre JEHAN Owl Carousel plugin <= 0.5.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/owl-carousel/wordpress-owl-carousel-plugin-0-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23830 State: PUBLISHED Published: 2023-05-03T15:15:27.266Z Last Updated: 2025-01-09T15:29:28.780Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ProfilePress Membership Team Products: ProfilePress Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-profilepress-plugin-4-5-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2023-23831 State: PUBLISHED Published: 2023-06-13T13:40:01.290Z Last Updated: 2024-08-02T13:40:21.187Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Rating-Widget Products: Rating-Widget: Star Review System Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rating-Widget Rating-Widget: Star Review System plugin <= 3.1.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/rating-widget/wordpress-rating-widget-star-review-system-plugin-3-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23832 State: PUBLISHED Published: 2023-04-23T10:06:46.207Z Last Updated: 2025-01-10T18:46:07.105Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: TC Products: Ultimate WP Query Search Filter Problem Types: CWE-79 Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in TC Ultimate WP Query Search Filter plugin <= 1.0.10 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ultimate-wp-query-search-filter/wordpress-ultimate-wp-query-search-filter-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23833 State: PUBLISHED Published: 2023-07-25T12:53:42.320Z Last Updated: 2024-09-25T16:59:46.954Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Steven Henty Products: Drop Shadow Boxes Problem Types: CWE-79 Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Steven Henty Drop Shadow Boxes plugin <= 1.7.10 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/drop-shadow-boxes/wordpress-drop-shadow-boxes-plugin-1-7-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23834 State: PUBLISHED Published: 2024-12-09T11:31:48.575Z Last Updated: 2024-12-09T18:41:09.299Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Brainstorm Force Products: Spectra Problem Types: CWE-862 Description: Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-broken-access-control-csrf-o
ddons-for-gutenberg/vulnerability/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-broken-access-control-csrf-on-activate-plugin-vulnerability?_s_id=cve
CVE ID: CVE-2023-23835 State: PUBLISHED Published: 2023-02-14T10:36:23.615Z Last Updated: 2025-03-20T16:25:54.732Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: Mendix Applications using Mendix 7, Mendix Applications using Mendix 8, Mendix Applications using Mendix 9, Mendix Applications using Mendix 9 (V9.12), Mendix Applications using Mendix 9 (V9.18), Mendix Applications using Mendix 9 (V9.6) Problem Types: CWE-284 Description: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Applications using Mendix 8 (All versions < V8.18.23), Mendix Applications using Mendix 9
l versions < V7.23.34), Mendix Applications using Mendix 8 (All versions < V8.18.23), Mendix Applications using Mendix 9 (All versions < V9.22.0), Mendix Applications using Mendix 9 (V9.12) (All versions < V9.12.10), Mendix Applications using Mendix 9 (V9.18) (All versions < V9.18.4), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.15). Some of the Mendix runtime API’s allow attackers to bypass XPath constraints and retrieve information using XPath queries that trigger errors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-252808.pdf
CVE ID: CVE-2023-23836 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-18T15:48:50.165Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-502 Description: SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to the SolarWinds Web Console to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_no
ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23836
CVE ID: CVE-2023-23837 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T16:32:40.705Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Database Performance Analyzer Problem Types: No Exception Handling Vulnerability: Database Performance Analyzer (DPA) 2023.1 Description: No exception handling vulnerability which revealed sensitive or excessive information to users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-2_release_notes.htm - https://www.solarwinds.com/trust-center/security
success_center/dpa/content/release_notes/dpa_2023-2_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2023-23837
CVE ID: CVE-2023-23838 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T16:28:51.855Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Database Performance Analyzer Problem Types: Directory traversal and file enumeration vulnerability: Database Performance Analyzer (DPA) 2023.1 Description: Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-2_release_notes.htm -
ences: - https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-2_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2023-23838
CVE ID: CVE-2023-23839 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T14:43:29.518Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-200 Description: The SolarWinds Platform was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users to access Orion.WebCommunityStrings SWIS schema object and obtain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_r
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23839
CVE ID: CVE-2023-23840 State: PUBLISHED Published: 2023-09-13T22:07:30.566Z Last Updated: 2025-02-27T20:52:47.742Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-697 Description: The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23840 - https://documentation.solarw
References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23840 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3-1_release_notes.htm
CVE ID: CVE-2023-23841 State: PUBLISHED Published: 2023-06-15T00:00:00 Last Updated: 2024-12-12T21:02:58.158Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: ServU Problem Types: CWE-319 Description: SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request. Part of the URL of the request discloses sensitive data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23841 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/serv-u_15-4_release
/CVE-2023-23841 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/serv-u_15-4_release_notes.htm
CVE ID: CVE-2023-23842 State: PUBLISHED Published: 2023-07-26T14:53:41.885Z Last Updated: 2024-10-23T15:35:05.297Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Network Configuration Manager Problem Types: CWE-22 Description: The SolarWinds Network Configuration Manager was susceptible to the Directory Traversal Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23842 - https://documentation.solarwinds.
rences: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23842 - https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-3_release_notes.htm
CVE ID: CVE-2023-23843 State: PUBLISHED Published: 2023-07-26T13:58:05.633Z Last Updated: 2024-10-23T15:37:10.823Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-697 Description: The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2023-23843 - https://documentation.solarwinds.com/en/success_center/orionpl
nds.com/trust-center/security-advisories/cve-2023-23843 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE ID: CVE-2023-23844 State: PUBLISHED Published: 2023-07-26T13:32:42.649Z Last Updated: 2024-10-23T15:39:29.904Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-184 Description: The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23844 - https://documentation.solarwinds.com/en
: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23844 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm
CVE ID: CVE-2023-23845 State: PUBLISHED Published: 2023-09-13T22:07:47.139Z Last Updated: 2025-02-27T20:52:39.866Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-697 Description: The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23845 - https://documentation.solarw
References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23845 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3-1_release_notes.htm
CVE ID: CVE-2023-23846 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T13:23:37.577Z Vendors: Open5GS Products: Open5GS Problem Types: CWE-770 Description: Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling protocol (GPTv1-U) messages, a protocol payload with any extension header length set to zero causes an infinite loop. The affected process becomes immediately unresponsive, resulting in denial of service and excessive resource consumption. CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C Additional Analyst Notes: - CVE Program Container: - CISA
ion. CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs-gtp-library/
CVE ID: CVE-2023-23847 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-19T15:59:24.338Z Vendors: Synopsys Products: Synopsys Jenkins Coverity Plugin Problem Types: CWE-352 Description: A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkins-Pl
es: - https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkins-Plugin - https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2793%20%282%29
CVE ID: CVE-2023-23848 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-18T19:33:50.288Z Vendors: Synopsys Products: Synopsys Jenkins Coverity Plugin Problem Types: CWE-862 Description: Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkin
rences: - https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkins-Plugin - https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2793%20%282%29
CVE ID: CVE-2023-23849 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-25T19:22:04.241Z Vendors: Synopsys Products: Coverity Problem Types: CWE-79 Description: Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious purposes. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/RL:O/RC:C Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-2023-2
- CISA ADP Vulnrichment: References: - https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-2023-23849-affecting-Coverity
CVE ID: CVE-2023-23850 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-18T19:28:15.384Z Vendors: Synopsys Products: Synopsys Jenkins Coverity Plugin Problem Types: CWE-862 Description: A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2793%20%281%29 - https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-Multiple-CVEs-affecting-Coverity-Jenkins-Plugin
CVE ID: CVE-2023-23851 State: PUBLISHED Published: 2023-02-14T03:11:51.221Z Last Updated: 2025-03-21T14:04:17.340Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP Products: Business Planning and Consolidation Problem Types: CWE-434 Description: SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the users without their consent impacting the confidentiality and integrity of the system. Additional Analyst Notes: - CVE P
users without their consent impacting the confidentiality and integrity of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3275841 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-23852 State: PUBLISHED Published: 2023-02-14T03:12:23.399Z Last Updated: 2025-03-20T18:49:56.194Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP Products: Solution Manager Problem Types: CWE-79 Description: SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3266751 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-23853 State: PUBLISHED Published: 2023-02-14T03:13:28.319Z Last Updated: 2025-03-20T18:49:33.080Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP Products: NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-601 Description: An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, can craft a link which when clicked by an unsuspecting user can be used to redirect a user to a malicious site which could read or modify some sensitive information or expose the victim to a phishing attack. Vulnerability has
site which could read or modify some sensitive information or expose the victim to a phishing attack. Vulnerability has no direct impact on availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3271227 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-23854 State: PUBLISHED Published: 2023-02-14T03:13:55.816Z Last Updated: 2025-03-19T15:30:40.260Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: SAP Products: NetWeaver AS ABAP and ABAP Platform Problem Types: CWE-862 Description: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3287291 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0
References: - https://launchpad.support.sap.com/#/notes/3287291 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-23855 State: PUBLISHED Published: 2023-02-14T03:14:29.486Z Last Updated: 2025-03-20T18:49:06.163Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: SAP Products: Solution Manager Problem Types: CWE-601 Description: SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful attack could lead an attacker to read or modify the information or expose the user to a phishing attack. As a result, it has a low impact to confidentiality, integrity and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
tegrity and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3270509 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html