Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-37480 State: PUBLISHED Published: 2023-07-18T18:19:17.956Z Last Updated: 2024-10-18T17:22:39.902Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: ethyca Products: fides Problem Types: CWE-400 Description: Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver. This vulnerability affects Fides versions `2.1
haustion and service unavailability for all users of the Fides webserver. This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading. If an attack occurs, the impact can be mitigated by manually or automatically restarting the affected container. Additional Analyst Notes: - CVE Program Co
be mitigated by manually or automatically restarting the affected container. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-g95c-2jgm-hqc6 - https://github.com/ethyca/fides/commit/5aea738463960d81821c11ae7ade1d627a46bf32
CVE ID: CVE-2023-37481 State: PUBLISHED Published: 2023-07-18T18:19:15.946Z Last Updated: 2024-10-18T17:24:17.416Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: ethyca Products: fides Problem Types: CWE-400 Description: Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page
ng resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (`datastore-connection/new`). This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
te this vulnerability without upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-3rw2-wfc8-wmj5 - https://github.com/ethyca/fides/commit/8beaace082b325e693dc7682029a3cb7e6c2b69d
CVE ID: CVE-2023-37482 State: PUBLISHED Published: 2025-02-11T10:26:27.720Z Last Updated: 2025-04-08T08:19:41.567Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Siemens Products: SIMATIC Drive Controller CPU 1504D TF, SIMATIC Drive Controller CPU 1507D TF, SIMATIC ET 200SP CPU 1510SP F-1 PN, SIMATIC ET 200SP CPU 1510SP-1 PN, SIMATIC ET 200SP CPU 1512SP F-1 PN, SIMATIC ET 200SP CPU 1512SP-1 PN, SIMATIC ET 200SP CPU 1514SP F-2 PN, SIMATIC ET 200SP CPU 1514SP-2 PN, SIMATIC ET 200SP CPU 1514SPT F-2 PN, SIMATIC ET 200SP CPU 1514SPT-2 PN, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU 1211C AC/DC/Rly, SIMATIC S7-1200
IC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU 1211C AC/DC/Rly, SIMATIC S7-1200 CPU 1211C DC/DC/DC, SIMATIC S7-1200 CPU 1211C DC/DC/Rly, SIMATIC S7-1200 CPU 1212C AC/DC/Rly, SIMATIC S7-1200 CPU 1212C DC/DC/DC, SIMATIC S7-1200 CPU 1212C DC/DC/Rly, SIMATIC S7-1200 CPU 1212FC DC/DC/DC, SIMATIC S7-1200 CPU 1212FC DC/DC/Rly, SIMATIC S7-1200 CPU 1214C AC/DC/Rly, SIMATIC S7-1200 CPU 1214C DC/DC/DC, SIMATIC S7-1200 CPU 1214C DC/DC/Rly, SIMATIC S7-1200 CPU 1214FC DC/DC/DC, SIMATIC S7-1200 CPU 1214FC DC/DC/Rly, SIMATIC S7-1200 CPU 1215C AC/DC/Rly, SIMATIC S7-1200 CPU 1215C DC/DC/DC, SIMATIC S7-1200 CPU 1215C DC/DC/Rly, SIMATIC S7-1200 CPU 1215FC DC/DC/DC, SIMAT
Rly, SIMATIC S7-1200 CPU 1215C DC/DC/DC, SIMATIC S7-1200 CPU 1215C DC/DC/Rly, SIMATIC S7-1200 CPU 1215FC DC/DC/DC, SIMATIC S7-1200 CPU 1215FC DC/DC/Rly, SIMATIC S7-1200 CPU 1217C DC/DC/DC, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511C-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1511T-1 PN, SIMATIC S7-1500 CPU 1511TF-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1513pro F-2 PN, SIMATIC S7-1500 CPU 1513pro-2 PN, SIMATIC S7-1500 CPU 1513R-1 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515R-2 PN, SIMATIC S7-1500 CPU 1515T-2 PN, SIMATIC S7-1500 CPU 1515TF-
ATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515R-2 PN, SIMATIC S7-1500 CPU 1515T-2 PN, SIMATIC S7-1500 CPU 1515TF-2 PN, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-1500 CPU 1516pro F-2 PN, SIMATIC S7-1500 CPU 1516pro-2 PN, SIMATIC S7-1500 CPU 1516T-3 PN/DP, SIMATIC S7-1500 CPU 1516TF-3 PN/DP, SIMATIC S7-1500 CPU 1517-3 PN/DP, SIMATIC S7-1500 CPU 1517F-3 PN/DP, SIMATIC S7-1500 CPU 1517H-3 PN, SIMATIC S7-1500 CPU 1517T-3 PN/DP, SIMATIC S7-1500 CPU 1517TF-3 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518HF-4 PN, SIMATIC S7-15
SIMATIC S7-1500 CPU 1518F-4 PN/DP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518HF-4 PN, SIMATIC S7-1500 CPU 1518T-4 PN/DP, SIMATIC S7-1500 CPU 1518TF-4 PN/DP, SIMATIC S7-1500 Software Controller CPU 1507S F V3, SIMATIC S7-1500 Software Controller CPU 1507S V3, SIMATIC S7-1500 Software Controller CPU 1508S F V3, SIMATIC S7-1500 Software Controller CPU 1508S T V3, SIMATIC S7-1500 Software Controller CPU 1508S TF V3, SIMATIC S7-1500 Software Controller CPU 1508S V3, SIMATIC S7-1500 Software Controller Linux V3, SIMATIC S7-PLCSIM Advanced, SIPLUS S7-1200 CPU 1212 AC/DC/RLY, SIPLUS S7-1200 CPU 1212 DC/DC/RLY, SIPLUS S7-1200 CPU 1212C DC/DC/DC, SIPLUS S7-1200 CPU 1212C DC/DC/DC
1212 AC/DC/RLY, SIPLUS S7-1200 CPU 1212 DC/DC/RLY, SIPLUS S7-1200 CPU 1212C DC/DC/DC, SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL, SIPLUS S7-1200 CPU 1214 AC/DC/RLY, SIPLUS S7-1200 CPU 1214 DC/DC/DC, SIPLUS S7-1200 CPU 1214 DC/DC/RLY, SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL, SIPLUS S7-1200 CPU 1214FC DC/DC/DC, SIPLUS S7-1200 CPU 1214FC DC/DC/RLY, SIPLUS S7-1200 CPU 1215 AC/DC/RLY, SIPLUS S7-1200 CPU 1215 DC/DC/DC, SIPLUS S7-1200 CPU 1215 DC/DC/RLY, SIPLUS S7-1200 CPU 1215C DC/DC/DC, SIPLUS S7-1200 CPU 1215FC DC/DC/DC, SIPLUS S7-1500 CPU 1517H-3 PN, SIPLUS S7-1500 CPU 1518-4 PN/DP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518F-4 PN/DP, SIPLUS S7-1500 CPU 1518HF-4 PN Problem Types: C
, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518F-4 PN/DP, SIPLUS S7-1500 CPU 1518HF-4 PN Problem Types: CWE-203 Description: The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-195895.html
CVE ID: CVE-2023-37483 State: PUBLISHED Published: 2023-08-08T00:39:33.487Z Last Updated: 2024-10-10T19:00:59.714Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP PowerDesigner Problem Types: CWE-306 Description: SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end database via Proxy. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3341460 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-37484 State: PUBLISHED Published: 2023-08-08T00:40:36.427Z Last Updated: 2024-10-10T19:28:52.145Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP PowerDesigner Problem Types: CWE-327 Description: SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3341460 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b
erences: - https://me.sap.com/notes/3341460 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-37486 State: PUBLISHED Published: 2023-08-08T00:56:51.511Z Last Updated: 2024-10-08T16:25:34.841Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP Commerce (OCC API) Problem Types: CWE-524 Description: Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://m
of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3341934 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-37487 State: PUBLISHED Published: 2023-08-08T00:42:16.140Z Last Updated: 2024-10-10T19:12:11.589Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP Business One (Service Layer) Problem Types: CWE-497 Description: SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unintended data over the network which could lead to high impact on confidentiality with no impact on integrity and availability of the application Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3333616 - https:
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3333616 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-37488 State: PUBLISHED Published: 2023-08-08T00:43:03.539Z Last Updated: 2024-10-10T18:55:55.677Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Process Integration Problem Types: CWE-79 Description: In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting (XSS) attack. On successful exploitation the attacker can cause limited impact on confidentiality and integrity of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap
of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3350494 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-37489 State: PUBLISHED Published: 2023-09-12T00:55:46.173Z Last Updated: 2024-09-26T14:46:51.880Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform (Version Management System) Problem Types: CWE-209 Description: Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidentiality and no impact on the application's availability or integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
mpact on the application's availability or integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3352453 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-37490 State: PUBLISHED Published: 2023-08-08T00:46:14.512Z Last Updated: 2024-08-02T17:16:30.325Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence (Installer) Problem Types: CWE-427 Description: SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a malicious file, an attacker can completely compromise the confidentiality, integrity, and availability of the system Additional Analyst Notes: - CVE Program Con
ly compromise the confidentiality, integrity, and availability of the system Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3317710 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-37491 State: PUBLISHED Published: 2023-08-08T00:46:40.819Z Last Updated: 2024-10-22T19:40:56.499Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Message Server Problem Types: CWE-863 Description: The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as ren
P systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3344295 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-37492 State: PUBLISHED Published: 2023-08-08T00:47:40.255Z Last Updated: 2024-10-08T16:26:09.133Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver AS ABAP and ABAP Platform Problem Types: CWE-863 Description: SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793, SAP_BASIS 804, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This
, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read sensitive information which can be used in a subsequent serious attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3348000 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-37495 State: PUBLISHED Published: 2024-02-20T18:22:21.038Z Last Updated: 2024-11-05T17:56:44.670Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: HCL Domino Server Description: Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administrator are secured using a cryptographically weak hash algorithm. This could enable attackers with access to the hashed value to determine a user's password, e.g. using a brute force attack. This issue does not impact Person documents created through user registration https://help.hcltechsw
brute force attack. This issue does not impact Person documents created through user registration https://help.hcltechsw.com/domino/10.0.1/admin/conf_userregistration_c.html . Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107585
CVE ID: CVE-2023-37496 State: PUBLISHED Published: 2023-08-01T00:41:55.777Z Last Updated: 2024-09-27T21:58:22.836Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: HCL Software Products: HCL Verse Description: HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105904
CVE ID: CVE-2023-37497 State: PUBLISHED Published: 2023-08-03T21:14:43.014Z Last Updated: 2024-10-17T15:00:50.717Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: HCL Unica Platform Description: The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106547
CVE ID: CVE-2023-37498 State: PUBLISHED Published: 2023-08-03T21:34:23.721Z Last Updated: 2024-10-17T15:43:19.004Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: HCL Unica Platform Description: A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106545
CVE ID: CVE-2023-37499 State: PUBLISHED Published: 2023-08-03T21:38:49.220Z Last Updated: 2024-09-27T21:57:44.313Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: HCL Unica Platform Description: A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106555
CVE ID: CVE-2023-37500 State: PUBLISHED Published: 2023-08-03T21:51:45.461Z Last Updated: 2024-09-27T21:57:37.608Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: HCL Unica Platform Description: A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and perform other attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106554
CVE ID: CVE-2023-37501 State: PUBLISHED Published: 2023-08-03T22:01:10.844Z Last Updated: 2024-09-27T21:57:31.191Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: HCL Unica Campaign Description: A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106556
CVE ID: CVE-2023-37502 State: PUBLISHED Published: 2023-10-18T22:51:16.664Z Last Updated: 2024-09-13T14:54:58.654Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: HCL Software Products: HCL Compass Description: HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107510
CVE ID: CVE-2023-37503 State: PUBLISHED Published: 2023-10-19T02:06:25.097Z Last Updated: 2024-09-12T18:01:46.032Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: HCL Software Products: HCL Compass Description: HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107512
CVE ID: CVE-2023-37504 State: PUBLISHED Published: 2023-10-19T00:09:02.682Z Last Updated: 2024-09-12T18:04:17.190Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: HCL Software Products: HCL Compass Description: HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511
CVE ID: CVE-2023-37511 State: PUBLISHED Published: 2023-08-11T00:16:40.590Z Last Updated: 2024-10-04T13:06:22.893Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL Traveler To Do Description: If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106690
CVE ID: CVE-2023-37512 State: PUBLISHED Published: 2023-08-11T00:34:17.647Z Last Updated: 2024-10-04T13:05:54.758Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL Traveler Companion Description: When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106691