Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0949 State: PUBLISHED Published: 2023-02-22T00:00:00.000Z Last Updated: 2025-03-12T14:56:26.817Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: modoboa Products: modoboa/modoboa Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ef87be4e-493b-4ee9-9738-44c55b8acc19 - https://github.com/modoboa/modoboa/commit/aa74e9a4a870162eea169e0a6a2eab841f8811b7
CVE ID: CVE-2023-0950 State: PUBLISHED Published: 2023-05-25T00:00:00.000Z Last Updated: 2025-04-23T16:21:38.994Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-129 Description: Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary co
rmula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to 7.5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2023-0950 - https://www.debian.org/security/2023/dsa-5415 - https://lists.debian.org/debian-lts-announce/2023/08/msg00014.html - https://security.gentoo.org/glsa/202311-15
CVE ID: CVE-2023-0951 State: PUBLISHED Published: 2023-02-22T13:46:30.884Z Last Updated: 2025-03-17T18:27:58.139Z Vendors: Devolutions Products: Devolutions Server Problem Types: n/a Description: Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perform privileged actions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0003
CVE ID: CVE-2023-0952 State: PUBLISHED Published: 2023-02-22T13:51:39.898Z Last Updated: 2025-03-17T18:28:29.860Z Vendors: Devolutions Products: Devolutions Server Problem Types: n/a Description: Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data without proper authorization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0003
CVE ID: CVE-2023-0953 State: PUBLISHED Published: 2023-02-22T13:42:04.305Z Last Updated: 2025-03-12T13:55:52.607Z Vendors: Devolutions Products: Devolutions Server Problem Types: n/a Description: Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Injection, potentially resulting in unauthorized access to system resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0003
CVE ID: CVE-2023-0954 State: PUBLISHED Published: 2023-06-08T20:05:20.697Z Last Updated: 2025-01-06T20:20:50.514Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. Products: Illustra Pro Gen 4 Dome, Illustra Pro Gen 4 PTZ Problem Types: CWE-489 Description: A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/new
lnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-23-159-02
CVE ID: CVE-2023-0955 State: PUBLISHED Published: 2023-03-27T15:37:29.971Z Last Updated: 2025-02-19T20:04:49.536Z Vendors: Unknown Products: WP Statistics Problem Types: CWE-89 SQL Injection Description: The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/18b7e93f-b038-4f28-918b-4015d62f0eb8
CVE ID: CVE-2023-0956 State: PUBLISHED Published: 2023-08-03T18:08:13.924Z Last Updated: 2025-01-16T21:31:03.063Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TEL-STER Products: TelWin SCADA WebInterface Problem Types: cwe-35 Path Traversal Description: External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03 - ht
am Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03 - https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956 - https://cert.pl/posts/2023/07/CVE-2023-0956/
CVE ID: CVE-2023-0957 State: PUBLISHED Published: 2023-03-03T07:00:41.041Z Last Updated: 2025-03-05T19:56:51.958Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L) Vendors: Gitpod Products: Gitpod Problem Types: CWE-1385 Description: An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This can lead to the extraction of data from workspaces, to a full takeover of the workspace. Additional Analyst Notes: - CVE Program Container: - CISA
of data from workspaces, to a full takeover of the workspace. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=default&orgId=71ccd717-aa2d-4a1e-942e-c768d37e9e0c&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d - https://github.com/gitpod-io/gitpod/releases/tag/release-2022.11.2 - https://github.com/gitpod-io/gitpod/pull/16378 - https://github.com/gitpod-io/gitpod/pull/16405 - https://github.com/gitpod-io/gitpod/commit/12956988eec0031f42ffdfa3bdc3359f65628f9f - https://github.com/gitpod-io/gitpod/commit/673ab6856fa04c13b7b1f2a968e4d090f1d94e4f - https://snyk.io/blog/gitpod
8f9f - https://github.com/gitpod-io/gitpod/commit/673ab6856fa04c13b7b1f2a968e4d090f1d94e4f - https://snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets/
CVE ID: CVE-2023-0958 State: PUBLISHED Published: 2023-07-28T04:37:03.650Z Last Updated: 2024-09-27T20:03:50.151Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: steve85b, copydeleteposts, socialsharepro, cl272, migrate, popups, socialdude, s-feeds Products: SSL Mixed Content Fix, Duplicate Post, Social Share Icons & Social Share Buttons, Ultimate Posts Widget, Backup Migration, Pop-up, Redirection, Clone, Social Media Share Buttons & Social Sharing Icons, RSS Redirect & Feedburner Alternative, Enhanced Text Widget Problem Types: CWE-862 Missing Authorization Description: Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of
ssing Authorization Description: Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7bdd0e-f3b3-4be5-8a30-2c6d9cb783a3?source=cve - https:/
s: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7bdd0e-f3b3-4be5-8a30-2c6d9cb783a3?source=cve - https://plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php#L427 - https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.0/banner/misc.php#L424 - https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426 - https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.7/modules/banner/misc.php#L438 - https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339 - https://plugins.trac.wordpress.org/browser/backup-backup/t
rowser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427 - https://plugins.trac.wordpress.org/browser/redirect-redirection/tags/1.1.3/includes/banner/misc.php#L427 - https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.4/banner/misc.php#L343 - https://plugins.trac.wordpress.org/browser/http-https-remover/tags/3.2.3/banner/misc.php#L427 - https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.1.9/modules/banner/misc.php#L427 - https://plugins.trac.wordpress.org/changeset?old_path=%2Fcopy-delete-posts%2Ftags%2F1.3.8&old=2923021&new_path=%2Fcopy-delete-posts%2Ftag
rac.wordpress.org/changeset?old_path=%2Fcopy-delete-posts%2Ftags%2F1.3.8&old=2923021&new_path=%2Fcopy-delete-posts%2Ftags%2F1.3.9&new=2923021&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.2/banner/misc.php#L434 - https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434 - https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.8/modules/banner/misc.php#L432 - https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.7/banner/misc.php#L351 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434 - https://plugins.trac.wordpre
plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434 - https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.5/banner/misc.php#L351 - https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.2.0/modules/banner/misc.php#L432 - https://plugins.trac.wordpress.org/browser/ultimate-social-media-plus/tags/3.5.7/banner/misc.php#L424 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823769%40http-https-remover%2Ftags%2F3.2.3&new=2944114%40http-https-remover%2Ftags%2F3.2.4 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823770%40feedburner-alternative-and-rss-redirect%
gins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823770%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.7&new=2944116%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.8#file115 - https://plugins.trac.wordpress.org/changeset/2944041/ultimate-social-media-plus/tags/3.5.8/banner/misc.php?old=2823720&old_path=ultimate-social-media-plus%2Ftags%2F3.5.7%2Fbanner%2Fmisc.php
CVE ID: CVE-2023-0959 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-13T19:00:35.668Z Vendors: n/a Products: Bhima Problem Types: Cross-site request forgery Description: Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator. This is possible because the application is vulnerable to CSRF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/IMA-WorldHealth/bhima/ - https://fluidattacks.com/advisories/calamaro/
CVE ID: CVE-2023-0960 State: PUBLISHED Published: 2023-02-22T17:46:17.392Z Last Updated: 2024-08-02T05:32:46.123Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: SeaCMS Problem Types: CWE-502 Description: A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php of the component Picture Management. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-221630 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https
is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221630 - https://vuldb.com/?ctiid.221630 - https://note.youdao.com/ynoteshare/index.html?id=ef23876c8744c5c230f3874387c06b11 - https://github.com/jidle123/Seacms-v11.6/issues/1
CVE ID: CVE-2023-0961 State: PUBLISHED Published: 2023-02-22T18:12:49.002Z Last Updated: 2024-08-02T05:32:46.320Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Music Gallery Site Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file view_music_details.php of the component GET Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221631. Additio
has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221631. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221631 - https://vuldb.com/?ctiid.221631 - https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Music%20Gallery%20Site%20-%20SQL%20Injection%202.md
CVE ID: CVE-2023-0962 State: PUBLISHED Published: 2023-02-22T18:12:51.052Z Last Updated: 2024-08-02T05:32:46.237Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Music Gallery Site Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. This vulnerability affects unknown code of the file Master.php of the component GET Request Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221632. Additional Analyst Notes: - CVE
losed to the public and may be used. The identifier of this vulnerability is VDB-221632. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221632 - https://vuldb.com/?ctiid.221632 - https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Music%20Gallery%20Site%20-%20SQL%20Injection%203.md
CVE ID: CVE-2023-0963 State: PUBLISHED Published: 2023-02-22T18:12:53.599Z Last Updated: 2024-11-25T15:30:29.125Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Music Gallery Site Problem Types: CWE-284 Description: A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users.php of the component POST Request Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221633 was assigned to this vulnerability. Additional Analyst Notes: -
o the public and may be used. The identifier VDB-221633 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.221633 - https://vuldb.com/?ctiid.221633 - https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Music%20Gallery%20Site%20-%20Broken%20Access%20Control.md
CVE ID: CVE-2023-0964 State: PUBLISHED Published: 2023-02-22T18:28:43.721Z Last Updated: 2024-08-02T05:32:46.366Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Sales Tracker Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. Affected is an unknown function of the file admin/products/view_product.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. VDB-221634 is the identifier assig
e complexity of an attack is rather high. The exploitability is told to be difficult. VDB-221634 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221634 - https://vuldb.com/?ctiid.221634
CVE ID: CVE-2023-0965 State: PUBLISHED Published: 2023-05-18T18:38:56.910Z Last Updated: 2025-01-22T14:33:25.929Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: silabs.com Products: Gecko Platform Problem Types: CWE-14 Description: Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk - https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U19lGQAR?operationContext=S1
CVE ID: CVE-2023-0966 State: PUBLISHED Published: 2023-02-22T19:25:23.170Z Last Updated: 2024-08-02T05:32:45.997Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=orders/view_order. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221635. Additional Analyst
closed to the public and may be used. The associated identifier of this vulnerability is VDB-221635. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221635 - https://vuldb.com/?ctiid.221635 - https://github.com/1MurasaKi/Eyewear_Shop_XSS/blob/main/README.md
CVE ID: CVE-2023-0967 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-13T21:05:39.650Z Vendors: n/a Products: Bhima Problem Types: Insecure object reference Description: Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and data that should only be viewed by the administrator. This is possible because the application is vulnerable to IDOR, it does not properly validate user permissions with respect to certain actions the user can perform. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/IMA-WorldHealth/bhima/ - https://fluid
CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/IMA-WorldHealth/bhima/ - https://fluidattacks.com/advisories/ingrosso/
CVE ID: CVE-2023-0968 State: PUBLISHED Published: 2023-03-03T21:29:17.221Z Last Updated: 2025-01-13T17:02:28.710Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: prasunsen Products: Watu Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Watu Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dn’, 'email', 'points', and 'date' parameters in versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they c
ng. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6341bdcc-c99f-40c3-81c4-ad90ff19f802 - https://plugins.trac.wordpress.org/browser/watu/trunk/views/takings.php#L31
CVE ID: CVE-2023-0969 State: PUBLISHED Published: 2023-06-21T19:40:44.577Z Last Updated: 2024-12-06T18:29:58.439Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Silicon Labs Products: Z/IP Gateway Problem Types: CWE-125, CWE-787 Description: A vulnerability in SiLabs Z/IP Gateway 7.18.01 and earlier allows an authenticated attacker within Z-Wave range to manipulate an array pointer to disclose the contents of global memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1
CVE ID: CVE-2023-0970 State: PUBLISHED Published: 2023-06-21T19:41:46.419Z Last Updated: 2024-12-06T18:27:49.739Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Silicon Labs Products: Z/IP Gateway Problem Types: CWE-787, CWE-125 Description: Multiple buffer overflow vulnerabilities in SiLabs Z/IP Gateway SDK version 7.18.01 and earlier allow an attacker with invasive physical access to a Z-Wave controller device to overwrite global memory and potentially execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZz
lnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1
CVE ID: CVE-2023-0971 State: PUBLISHED Published: 2023-06-21T19:42:25.906Z Last Updated: 2024-12-06T18:27:23.817Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Silicon Labs Products: Z/IP Gateway Problem Types: CWE-863, CWE-268 Description: A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1