Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3165 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41938 State: PUBLISHED Published: 2023-09-06T12:08:57.719Z Last Updated: 2024-09-26T19:53:22.647Z Vendors: Jenkins Project Products: Jenkins Ivy Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3093 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41939 State: PUBLISHED Published: 2023-09-06T12:08:58.383Z Last Updated: 2024-09-26T20:36:58.777Z Vendors: Jenkins Project Products: Jenkins SSH2 Easy Plugin Description: Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3064 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41940 State: PUBLISHED Published: 2023-09-06T12:08:59.019Z Last Updated: 2024-09-27T19:48:04.346Z Vendors: Jenkins Project Products: Jenkins TAP Plugin Description: Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control TAP file contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3190 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41941 State: PUBLISHED Published: 2023-09-06T12:08:59.655Z Last Updated: 2024-09-26T19:52:56.969Z Vendors: Jenkins Project Products: Jenkins AWS CodeCommit Trigger Plugin Description: A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3101%20(1) - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41942 State: PUBLISHED Published: 2023-09-06T12:09:00.293Z Last Updated: 2024-09-26T19:52:30.978Z Vendors: Jenkins Project Products: Jenkins AWS CodeCommit Trigger Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3101%20(2) - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41943 State: PUBLISHED Published: 2023-09-06T12:09:00.938Z Last Updated: 2024-09-26T19:51:59.246Z Vendors: Jenkins Project Products: Jenkins AWS CodeCommit Trigger Plugin Description: Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3101%20(2) - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41944 State: PUBLISHED Published: 2023-09-06T12:09:01.584Z Last Updated: 2024-09-27T19:43:56.443Z Vendors: Jenkins Project Products: Jenkins AWS CodeCommit Trigger Plugin Description: Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3102 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41945 State: PUBLISHED Published: 2023-09-06T12:09:02.231Z Last Updated: 2024-09-26T20:40:47.076Z Vendors: Jenkins Project Products: Jenkins Assembla Auth Plugin Description: Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3065 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41946 State: PUBLISHED Published: 2023-09-06T12:09:02.919Z Last Updated: 2024-09-26T19:47:18.189Z Vendors: Jenkins Project Products: Jenkins Frugal Testing Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Testing using attacker-specified credentials, and to retrieve test IDs and names from Frugal Testing, if a valid credential corresponds to the attacker-specified username. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3082 - http://www.openwall.com/lists/oss-secur
ferences: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3082 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41947 State: PUBLISHED Published: 2023-09-06T12:09:03.587Z Last Updated: 2024-09-26T19:20:50.520Z Vendors: Jenkins Project Products: Jenkins Frugal Testing Plugin Description: A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3082 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41948 State: PUBLISHED Published: 2023-09-25T00:36:50.648Z Last Updated: 2024-09-24T14:22:57.223Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Christoph Rado Products: Cookie Notice & Consent Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christoph Rado Cookie Notice & Consent plugin <= 1.6.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cookie-notice-consent/wordpress-cookie-notice-consent-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41949 State: PUBLISHED Published: 2023-09-25T00:31:22.877Z Last Updated: 2024-09-24T14:23:16.495Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Avirtum Products: iFolders Problem Types: CWE-79 Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Avirtum iFolders plugin <= 1.5.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ifolders/wordpress-ifolders-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-41950 State: PUBLISHED Published: 2023-10-06T14:57:00.745Z Last Updated: 2024-09-19T15:22:10.536Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Laposta - Roel Bousardt Products: Laposta Signup Basic Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Laposta - Roel Bousardt Laposta Signup Basic plugin <= 1.4.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/laposta-signup-basic/wordpress-laposta-signup-basic-plugin-1-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-41951 State: PUBLISHED Published: 2024-12-13T14:24:24.851Z Last Updated: 2024-12-16T17:37:40.725Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: rtCamp Products: rtMedia for WordPress, BuddyPress and bbPress Problem Types: CWE-862 Description: Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.6.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/word
ISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpress-rtmedia-for-wordpress-buddypress-and-bbpress-plugin-4-6-14-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41952 State: PUBLISHED Published: 2024-12-13T14:24:25.462Z Last Updated: 2024-12-16T16:42:05.269Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Contact Form - WPManageNinja LLC Products: FluentForm Problem Types: CWE-862 Description: Missing Authorization vulnerability in Contact Form - WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 5.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fluentform/vulnerability/wordpress-fluent-forms-plugin-5-0-8-broken-access-control-vulner
.com/database/wordpress/plugin/fluentform/vulnerability/wordpress-fluent-forms-plugin-5-0-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41953 State: PUBLISHED Published: 2024-12-09T13:16:49.673Z Last Updated: 2024-12-09T15:09:57.994Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ProfilePress Membership Team Products: ProfilePress Problem Types: CWE-862 Description: Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePress: from n/a through 4.13.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-user-avatar/vulnerability/wordpress-profilepress-plugin-4-13-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-41954 State: PUBLISHED Published: 2024-05-17T06:54:21.852Z Last Updated: 2024-08-02T19:09:49.421Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: ProfilePress Membership Team Products: ProfilePress Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-profilepress-plugin-4-13-1-unauthenticated-limited-privilege-escalation-vulnerabi
vulnerability/wp-user-avatar/wordpress-profilepress-plugin-4-13-1-unauthenticated-limited-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2023-41955 State: PUBLISHED Published: 2024-05-17T06:55:35.414Z Last Updated: 2024-08-02T19:09:49.517Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WPDeveloper Products: Essential Addons for Elementor Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 5.8.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/essential-addons-for-elementor-lite/wordpress-essential-addons-for-elementor-plugin-5-8
stack.com/database/vulnerability/essential-addons-for-elementor-lite/wordpress-essential-addons-for-elementor-plugin-5-8-8-contributor-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2023-41956 State: PUBLISHED Published: 2024-05-17T06:55:53.053Z Last Updated: 2024-08-02T19:09:49.408Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: smp7, wp.insider Products: Simple Membership Problem Types: CWE-287 Description: Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/simple-membership/wordpress-simple-membership-plugin-4-3-4-authenticated-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2023-41957 State: PUBLISHED Published: 2024-05-17T06:56:37.793Z Last Updated: 2024-08-02T19:09:49.437Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: smp7, wp.insider Products: Simple Membership Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in smp7, wp.Insider Simple Membership allows Privilege Escalation.This issue affects Simple Membership: from n/a through 4.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/simple-membership/wordpress-simple-membership-plugin-4-3-4-unauthenticated-membership-role-privilege-escalation-vuln
ity/simple-membership/wordpress-simple-membership-plugin-4-3-4-unauthenticated-membership-role-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2023-41960 State: PUBLISHED Published: 2023-10-25T14:12:08.722Z Last Updated: 2024-09-12T14:29:20.687Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Rexroth Products: ctrlX HMI Web Panel - WR21 (WR2107), ctrlX HMI Web Panel - WR21 (WR2110), ctrlX HMI Web Panel - WR21 (WR2115) Problem Types: CWE-926 Description: The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent application, potentially modifying sensitive settings of the Android Client application itself. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
ient application itself. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-175607.html
CVE ID: CVE-2023-41961 State: PUBLISHED Published: 2024-05-16T20:47:46.571Z Last Updated: 2024-08-21T16:00:42.015Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) GPA software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) GPA software before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00831.html
CVE ID: CVE-2023-41962 State: PUBLISHED Published: 2023-09-26T08:16:35.700Z Last Updated: 2024-09-24T14:49:58.520Z Vendors: Collne Inc. Products: Welcart e-Commerce Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script in the page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.welcart.com/archives/20106.html - https://jvn.jp/en/jp/JVN97197972/
CVE ID: CVE-2023-41963 State: PUBLISHED Published: 2023-12-12T09:16:04.421Z Last Updated: 2024-08-02T19:09:49.464Z Vendors: JTEKT ELECTRONICS CORPORATION Products: GC-A22W-CW, GC-A24W-C(W), GC-A26W-C(W), GC-A24, GC-A24-M, GC-A25, GC-A26, GC-A26-J2, GC-A27-C, GC-A28-C Problem Types: Denial-of-service (DoS) Description: Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur. Additional Analyst Notes: - CVE Program Container: References: - https://www.electronics.jtekt.co.jp/en/topics/202312116562/ - https://jvn.jp/en/jp/JVN34145838/
CVE ID: CVE-2023-41964 State: PUBLISHED Published: 2023-10-10T12:33:51.097Z Last Updated: 2024-09-18T20:34:48.575Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: F5 Products: BIG-IP, BIG-IQ Problem Types: CWE-312 Description: The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K20850144
CVE ID: CVE-2023-41965 State: PUBLISHED Published: 2023-09-18T19:29:58.603Z Last Updated: 2025-04-15T18:26:43.433Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Socomec Products: MODULYS GP (MOD3GP-SY-120K) Problem Types: CWE-921 Description: Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE ID: CVE-2023-41966 State: PUBLISHED Published: 2023-10-26T16:21:56.412Z Last Updated: 2025-01-16T21:28:02.298Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Sielco, Sielco Products: Analog FM transmitter, Radio Link Problem Types: CWE-267 Description: The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08 - https://www.sielco.org/en/contacts
CVE ID: CVE-2023-41967 State: PUBLISHED Published: 2023-12-18T22:00:38.751Z Last Updated: 2024-08-02T19:09:49.372Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Gallagher Products: Controller 6000 Problem Types: CWE-1272 Description: Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages. This issue affects: Gallagher Controller 6000 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), v8.60 or earlier. Additional Analyst Note
ontroller 6000 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), v8.60 or earlier. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2023-41967
CVE ID: CVE-2023-41968 State: PUBLISHED Published: 2023-09-26T20:14:32.105Z Last Updated: 2025-11-04T19:21:16.150Z Vendors: Apple Products: iOS and iPadOS, macOS, tvOS, watchOS Problem Types: An app may be able to read arbitrary files Description: This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to read arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213932 - https://support.apple.com/en-us/HT213931 - ht
CVE ID: CVE-2023-41969 State: PUBLISHED Published: 2024-03-26T14:14:21.872Z Last Updated: 2024-10-17T15:11:15.463Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Zscaler Products: Client Connector Problem Types: CWE-61 Description: An arbitrary file deletion in ZSATrayManager where it protects the temporary encrypted ZApp issue reporting file from the unprivileged end user access and modification. Fixed version: Win ZApp 4.3.0 and later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023
CVE ID: CVE-2023-41970 State: PUBLISHED Published: 2024-05-02T13:10:51.042Z Last Updated: 2024-08-02T19:09:49.453Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Zscaler Products: Client Connector Problem Types: CWE-354 Description: An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on Windows during the Repair App functionality may allow Local Execution of Code.This issue affects Client Connector on Windows: before 4.1.0.62. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=wind
ferences: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=windows&applicable_version=4.1
CVE ID: CVE-2023-41971 State: PUBLISHED Published: 2024-05-02T13:11:07.860Z Last Updated: 2024-08-06T17:51:01.988Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Zscaler Products: Client Connector Problem Types: CWE-59 Description: An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021??applicable_category=windows&appl
://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021??applicable_category=windows&applicable_version=3.7
CVE ID: CVE-2023-41972 State: PUBLISHED Published: 2024-03-26T14:16:24.500Z Last Updated: 2024-10-17T15:17:06.136Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Zscaler Products: Client Connector Problem Types: CWE-280 Description: In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4.3.0.121 and later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Windows&applicable_version=4.3.0.121&deployment_date=2023-09-0
nt-connector-app-release-summary-2023?applicable_category=Windows&applicable_version=4.3.0.121&deployment_date=2023-09-01&id=1463196
CVE ID: CVE-2023-41973 State: PUBLISHED Published: 2024-03-26T14:19:13.244Z Last Updated: 2024-08-05T20:42:20.380Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Zscaler Products: Client Connector Problem Types: CWE-22 Description: ZSATray passes the previousInstallerName as a config parameter to TrayManager, and TrayManager constructs the path and appends previousInstallerName to get the full path of the exe. Fixed Version: Win ZApp 4.3.0.121 and later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Windows&applic
- https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Windows&applicable_version=4.3.0.121&deployment_date=2023-09-01&id=1463196