Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-31428 State: PUBLISHED Published: 2023-08-01T23:41:41.990Z Last Updated: 2025-02-13T16:50:10.579Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Brocade Products: Fabric OS Problem Types: CWE-434 Description: Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user's home directory using grep. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22380 - https://security.netapp.com/advisory/ntap-20230908-0007/
CVE ID: CVE-2023-31429 State: PUBLISHED Published: 2023-08-01T20:20:52.128Z Last Updated: 2024-10-15T14:12:35.099Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Brocade Products: Fabric OS Problem Types: CWE-209 Description: Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”, errmoduleshow, errfilterset, hassiscfgperrthreshold, supportshowcfgdisable and supportshowcfgenable commands that can cause the content of shell interpreted variables to be printed in the terminal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
iables to be printed in the terminal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22408 - https://security.netapp.com/advisory/ntap-20230908-0007/
CVE ID: CVE-2023-31430 State: PUBLISHED Published: 2023-08-01T23:31:00.376Z Last Updated: 2025-02-13T16:50:11.199Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Brocade Products: Brocade Fabric OS Problem Types: CWE-120 Description: A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated privileged user to crash the Brocade Fabric OS switch leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22381 - https://security.netapp.com/advisory/ntap-20230908
://support.broadcom.com/external/content/SecurityAdvisories/0/22381 - https://security.netapp.com/advisory/ntap-20230908-0007/
CVE ID: CVE-2023-31431 State: PUBLISHED Published: 2023-08-01T23:23:18.522Z Last Updated: 2025-02-13T16:50:11.782Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Brocade Products: Fabric OS Problem Types: CWE-120 Description: A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crash the Brocade Fabric OS switch leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22384 - https://security.netapp.com/advisory/ntap-20230908-0007/
CVE ID: CVE-2023-31432 State: PUBLISHED Published: 2023-08-01T23:58:59.015Z Last Updated: 2025-02-13T16:50:12.408Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Brocade Products: Fabric OS Problem Types: CWE-269 Description: Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22385 - https://security.netapp.com/a
: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/22385 - https://security.netapp.com/advisory/ntap-20230908-0007/
CVE ID: CVE-2023-31433 State: PUBLISHED Published: 2023-05-02T00:00:00.000Z Last Updated: 2025-01-30T16:21:13.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated attackers to execute SQL statements via the welche parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cves.at/posts/cve-2023-31433/writeup/
CVE ID: CVE-2023-31434 State: PUBLISHED Published: 2023-05-02T00:00:00.000Z Last Updated: 2025-01-30T16:18:18.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 do not validate input, which allows authenticated attackers to inject HTML Code and XSS payloads in multiple locations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cves.at/posts/cve-2023-31434/writeup/
CVE ID: CVE-2023-31435 State: PUBLISHED Published: 2023-05-02T00:00:00.000Z Last Updated: 2025-01-30T15:09:27.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews) in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allow authenticated attackers to read and write to unauthorized data by accessing functions directly. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cves.at/posts/cve-2023-31435/writeup/
CVE ID: CVE-2023-31436 State: PUBLISHED Published: 2023-04-28T00:00:00 Last Updated: 2024-10-21T16:01:13.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/3037933448f60f9acb705997eae62013ecb81e0d - https://www.spinics.net/lists/stable-commits/msg294885.html - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.13 - https://www.debian.org/security/2023/dsa-5402 - https://lists.debian.org/debian-lts-annou
kernel/v6.x/ChangeLog-6.2.13 - https://www.debian.org/security/2023/dsa-5402 - https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html - https://security.netapp.com/advisory/ntap-20230609-0001/ - http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html - http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html - http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
CVE ID: CVE-2023-31437 State: PUBLISHED Published: 2023-06-13T00:00:00 Last Updated: 2025-01-03T19:31:56.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/systemd/systemd/releases - https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf - https://github.com/kastel-security/Journald
CVE ID: CVE-2023-31438 State: PUBLISHED Published: 2023-06-13T00:00:00 Last Updated: 2024-08-02T14:53:30.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/systemd/systemd/releases - https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf - https://github.com/kastel-security/Journald - https
ub.com/kastel-security/Journald/blob/main/journald-publication.pdf - https://github.com/kastel-security/Journald - https://github.com/systemd/systemd/pull/28886
CVE ID: CVE-2023-31439 State: PUBLISHED Published: 2023-06-13T00:00:00 Last Updated: 2024-08-02T14:53:31.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/systemd/systemd/releases - https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf - https://github.com/kastel
md/releases - https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf - https://github.com/kastel-security/Journald - https://github.com/systemd/systemd/pull/28885
CVE ID: CVE-2023-31441 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T18:31:59.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NATO Communications and Information Agency anet (aka Advisor Network) through 3.3.0, an attacker can provide a crafted JSON file to sanitizeJson and cause an exception. This is related to the U+FFFD Unicode replacement character. A for loop does not consider that a data structure is being modified during loop execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/NCI-Agency/anet/blob/0662b99dfdec1ce07439eb7bed02d90320acc721/src/main/java/mil/dds/anet/utils/Ut
: - https://github.com/NCI-Agency/anet/blob/0662b99dfdec1ce07439eb7bed02d90320acc721/src/main/java/mil/dds/anet/utils/Utils.java - https://github.com/NCI-Agency/anet/issues/4408
CVE ID: CVE-2023-31442 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-01-27T16:46:43.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Lightbend Akka before 2.8.1, the async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not validate (e.g., via TLS) the authenticity of the discovered service, this may result in exfiltration of application data (e.g., persistence events may be published to an unintended Kafka broker). If such validation is performed,
ication data (e.g., persistence events may be published to an unintended Kafka broker). If such validation is performed, then the poisoning constitutes a denial of access to the intended service. This affects Akka 2.5.14 through 2.8.0, and Akka Discovery through 2.8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lightbend.com - https://akka.io/security/akka-async-dns-2023-31442.html
CVE ID: CVE-2023-31444 State: PUBLISHED Published: 2023-04-28T00:00:00.000Z Last Updated: 2025-01-31T16:00:14.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. This allows for remote access to the JVM via the Jolokia JMX-HTTP bridge. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talend.com - https://www.talend.com/security/incident-response/#CVE-2023-31444
CVE ID: CVE-2023-31445 State: PUBLISHED Published: 2023-05-11T00:00:00 Last Updated: 2024-08-02T14:53:30.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnerability that allows read-only users have the ability to enumerate all other users and discover e-mail addresses, phone numbers, and privileges of all other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.cassianetworks.com - https://github.com/Dodge-MPTC/CVE-2023-31445-Unprivileged-Information-Disclosure - https://blog.kscsc.online/cves/202331445/md.html
CVE ID: CVE-2023-31446 State: PUBLISHED Published: 2024-01-10T00:00:00.000Z Last Updated: 2025-06-20T15:36:04.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cassianetworks.com - https://github.com/Dodge-MPTC/CVE-2023-31446-Remote-Code-Execution - https://blog.kscsc.online/cves/202331446/md.html
CVE ID: CVE-2023-31447 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-07T17:19:37.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted payload to modify the content of the code segment, insert shellcode, and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://draytek.com - https://gist.github.com/rrrrrrri/013c9eef64b265af4163478bfcf29ff4
CVE ID: CVE-2023-31448 State: PUBLISHED Published: 2023-08-09T00:00:00.000Z Last Updated: 2025-02-13T16:50:13.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the HL7 sensor into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Additional Analyst Notes: - CVE
ility is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.paessler.com/prtg/history/stable - https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
CVE ID: CVE-2023-31449 State: PUBLISHED Published: 2023-08-09T00:00:00.000Z Last Updated: 2025-02-13T16:50:13.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability was identified in the WMI Custom sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the WMI Custom sensor into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Additional Analys
this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.paessler.com/prtg/history/stable - https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
CVE ID: CVE-2023-31450 State: PUBLISHED Published: 2023-08-09T00:00:00.000Z Last Updated: 2025-02-13T16:50:14.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability was identified in the SQL v2 sensors in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the SQL v2 sensors into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Additional Analyst Note
vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.paessler.com/prtg/history/stable - https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
CVE ID: CVE-2023-31452 State: PUBLISHED Published: 2023-08-09T00:00:00 Last Updated: 2024-10-10T16:17:07.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request. This could force PRTG to execute different actions, such as creating new users. The severity of this vulnerability is high and received a score of 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Additional Analyst Notes: - CVE Program Contai
and received a score of 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.paessler.com/prtg/history/stable - https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 - https://www.paessler.com/prtg/history/prtg-23#23.3.86.1520
CVE ID: CVE-2023-31453 State: PUBLISHED Published: 2023-05-22T13:25:47.820Z Last Updated: 2024-10-11T13:46:50.433Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/7949 https://github.com/apache/inlong/pull/7949 Additional Analyst Notes: - CVE Pr
https://github.com/apache/inlong/pull/7949 https://github.com/apache/inlong/pull/7949 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/9nz8o2skgc5230w276h4w92j0zstnl06
CVE ID: CVE-2023-31454 State: PUBLISHED Published: 2023-05-22T13:23:17.332Z Last Updated: 2024-10-09T17:14:26.742Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.[1] https://github.com/apache/inlong/pull/7947 https://github.com/apache/inlong/pull/7947 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
l/7947 https://github.com/apache/inlong/pull/7947 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/nqt1tr6pbq8q4b033d7sg5gltx5pmjgl
CVE ID: CVE-2023-31455 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T14:53:31.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort. Additional Analyst Notes: - CVE Program Container: References: - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2023-31456 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-11-07T11:00:38.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an SSRF vulnerability in the Fluid Topics platform that affects versions prior to 4.3, where the server can be forced to make arbitrary requests to internal and external resources by an authenticated user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://antidot.net/blog/ - https://doc.fluidtopics.com/r/Fluid-Topics-Release-Notes/June-10th-2024
CVE ID: CVE-2023-31457 State: PUBLISHED Published: 2023-05-24T00:00:00.000Z Last Updated: 2025-01-31T14:06:12.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0004
CVE ID: CVE-2023-31458 State: PUBLISHED Published: 2023-05-24T00:00:00.000Z Last Updated: 2025-01-31T14:05:06.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com
ommands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0005
CVE ID: CVE-2023-31459 State: PUBLISHED Published: 2023-05-24T00:00:00.000Z Last Updated: 2025-01-31T14:07:13.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel
ry commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0006
CVE ID: CVE-2023-31460 State: PUBLISHED Published: 2023-05-24T00:00:00.000Z Last Updated: 2025-01-31T14:07:44.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0007