Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-39957 State: PUBLISHED Published: 2023-08-10T15:04:16.233Z Last Updated: 2024-10-04T18:59:32.675Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-22 Description: Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Prior to version 17.0.0, an unprotected intend allowed malicious third party apps to trick the Talk Android app into writing files outside of its intended cache directory. Nextcloud Talk Android version 17.0.0 has a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA A
a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36f7-93f3-mcfj - https://github.com/nextcloud/talk-android/pull/3064 - https://hackerone.com/reports/1997029
CVE ID: CVE-2023-39958 State: PUBLISHED Published: 2023-08-10T17:04:51.729Z Last Updated: 2024-10-10T15:52:01.095Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-307 Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 2
Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vv27-g2hq-v48h - https://github.com/nextcloud/server/pull/38773 - https://hackerone.com/reports/1258448
CVE ID: CVE-2023-39959 State: PUBLISHED Published: 2023-08-10T17:07:42.367Z Last Updated: 2024-10-08T14:11:04.848Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1
Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g97r-8ffm-hfpj - https://github.com/nextcloud/server/pull/38747 - https://hackerone.com/reports/1832126
CVE ID: CVE-2023-39960 State: PUBLISHED Published: 2023-10-13T12:07:59.934Z Last Updated: 2024-09-17T20:32:00.464Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-307 Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Serv
an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9 - https://github.com/nextcloud/server/pull/38046 - https://hackerone.com/reports/1924212
CVE ID: CVE-2023-39961 State: PUBLISHED Published: 2023-08-10T17:18:40.903Z Last Updated: 2024-10-10T15:51:18.932Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and download it. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 24.0.12.5, 25.0.9, 26.0.4
Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qhgm-w4gx-gvgp - https://github.com/nextcloud/text/pull/4481 - https://hackerone.com/reports/1965156
CVE ID: CVE-2023-39962 State: PUBLISHED Published: 2023-08-10T17:23:50.261Z Last Updated: 2024-10-03T19:54:43.544Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delete any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterpri
them inaccessible for everyone else as well. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. As a workaround, disable app files_external. This also makes the external storage inaccessible but retains the configurations until a patched version has been deployed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwxx-2752-w3xm - https://github.com/nextcloud/server/pull/39323 - https://hackerone.com/reports/2047
ity/advisories/GHSA-xwxx-2752-w3xm - https://github.com/nextcloud/server/pull/39323 - https://hackerone.com/reports/2047168
CVE ID: CVE-2023-39963 State: PUBLISHED Published: 2023-08-10T17:26:30.163Z Last Updated: 2024-10-10T17:53:05.396Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully stealing a session from a logged in user, to create app passwords for the victim. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and
from a logged in user, to create app passwords for the victim. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j4qm-5q5x-54m5 - https://github.com/nextcloud/server/pull/39416 - https://hackerone.com/reports/2067572
CVE ID: CVE-2023-39964 State: PUBLISHED Published: 2023-08-10T17:39:11.768Z Last Updated: 2024-10-04T18:57:45.505Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: 1Panel-dev Products: 1Panel Problem Types: CWE-22 Description: 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the `api/v1/file.go` file, there is a function called `LoadFromFile`, which directly reads the file by obtaining the requested path `parameter[path]`. The request parameters are not filtered, resulting in a background arbitrary file read
requested path `parameter[path]`. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability. Version 1.5.0 has a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-pv7q-v9mv-9mh5 - https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0
CVE ID: CVE-2023-39965 State: PUBLISHED Published: 2023-08-10T17:42:05.793Z Last Updated: 2024-10-04T18:57:04.477Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: 1Panel-dev Products: 1Panel Problem Types: CWE-863 Description: 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may cause a large amount of information leakage. Version 1.5.0 has a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA A
formation leakage. Version 1.5.0 has a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-85cf-gj29-f555 - https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0
CVE ID: CVE-2023-39966 State: PUBLISHED Published: 2023-08-10T17:46:21.104Z Last Updated: 2024-10-04T18:56:18.054Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: 1Panel-dev Products: 1Panel Problem Types: CWE-862 Description: 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for th
t. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-hf7j-xj3w-87g4 - https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0
CVE ID: CVE-2023-39967 State: PUBLISHED Published: 2023-09-06T20:40:43.679Z Last Updated: 2024-09-26T15:11:42.697Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: wiremock Products: wiremock Problem Types: CWE-918 Description: WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via “TestRequester” functionality, webhooks and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with t
, webhooks and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with the default level of credentials for the WireMock instance. The vendor has discontinued the affected Wiremock studio product and there will be no fix. Users are advised to find alternatives. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wiremock/wiremock/security/advisories/GHSA-676j-xrv3-73vc
CVE ID: CVE-2023-39968 State: PUBLISHED Published: 2023-08-28T20:16:20.851Z Last Updated: 2025-02-13T17:03:19.337Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: jupyter-server Products: jupyter_server Problem Types: CWE-601 Description: jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit `29036259` which is included in release 2.7.2. Users are advised to upgrade. There are
sue has been addressed in commit `29036259` which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-r726-vmfq-j9j3 - https://github.com/jupyter-server/jupyter_server/commit/290362593b2ffb23c59f8114d76f77875de4b925 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XDKQAWQN6SQTOVACZNXYKEHWQXGG4DOF/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRP7DNZYVOIA4ZB3U3ZWKTFZEPYWN
s://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRP7DNZYVOIA4ZB3U3ZWKTFZEPYWNGCQ/
CVE ID: CVE-2023-39969 State: PUBLISHED Published: 2023-08-09T15:34:07.776Z Last Updated: 2024-10-03T15:15:12.245Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: trailofbits Products: uthenticode Problem Types: CWE-347 Description: uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Version 1.0.9 of uthenticode hashed the entire file rather than hashing sections by virtual address, in violation of the Authenticode specification. As a result, an attacker could modify code within a binary without changing its Authenticode hash, making it appear valid from uthenticode's perspective. Versions of uthenticode p
without changing its Authenticode hash, making it appear valid from uthenticode's perspective. Versions of uthenticode prior to 1.0.9 are not vulnerable to this attack, nor are versions in the 2.x series. By design, uthenticode does not perform full-chain validation. However, the malleability of signature verification introduced in 1.0.9 was an unintended oversight. The 2.x series addresses the vulnerability. Versions prior to 1.0.9 are also not vulnerable, but users are encouraged to upgrade rather than downgrade. There are no workarounds to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/trailofbits/uthenticod
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/trailofbits/uthenticode/security/advisories/GHSA-rc7g-99x7-4p9g - https://github.com/trailofbits/uthenticode/pull/84 - https://github.com/trailofbits/uthenticode/commit/8670b7bb9154d79c276483dcb7c9e9fd5e66455b
CVE ID: CVE-2023-39970 State: PUBLISHED Published: 2023-08-17T20:06:32.953Z Last Updated: 2024-10-20T04:33:26.300Z Vendors: acymailing.com Products: AcyMailing component for Joomla Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/extension/acymailing-starter/
CVE ID: CVE-2023-39971 State: PUBLISHED Published: 2023-08-17T20:06:40.974Z Last Updated: 2024-10-20T04:33:27.361Z Vendors: acymailing.com Products: AcyMailing Enterprise component for Joomla Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/extension/acymailing-starter/ - https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/
CVE ID: CVE-2023-39972 State: PUBLISHED Published: 2023-08-17T20:06:39.150Z Last Updated: 2024-10-20T04:33:20.711Z Vendors: acymailing.com Products: AcyMailing Enterprise component for Joomla Problem Types: CWE-284 Description: Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/extension/acymailing-starter/ - https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/
CVE ID: CVE-2023-39973 State: PUBLISHED Published: 2023-08-17T20:06:35.442Z Last Updated: 2024-10-20T04:33:20.343Z Vendors: acymailing.com Products: AcyMailing Enterprise component for Joomla Problem Types: CWE-284 Description: Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/extension/acymailing-starter/ - https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/
CVE ID: CVE-2023-39974 State: PUBLISHED Published: 2023-08-17T20:06:39.321Z Last Updated: 2024-10-20T04:33:25.578Z Vendors: acymailing.com Products: AcyMailing Enterprise component for Joomla Problem Types: CWE-200 Description: Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/extension/acymailing-starter/ - https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/
CVE ID: CVE-2023-39975 State: PUBLISHED Published: 2023-08-16T00:00:00 Last Updated: 2024-08-02T18:18:10.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another. Additional Analyst Notes: - CVE Program Container: References: - https://web.mit.edu/kerberos/www/advisories/ - https://github.com/krb5/krb5/compare/krb5-1.21.1-final...krb5-1.21.2-final - https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840 - https://security.netapp.com/advi
-final - https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840 - https://security.netapp.com/advisory/ntap-20230915-0014/ - https://security.netapp.com/advisory/ntap-20240201-0008/ - https://security.netapp.com/advisory/ntap-20240201-0005/
CVE ID: CVE-2023-39976 State: PUBLISHED Published: 2023-08-08T00:00:00 Last Updated: 2024-10-15T17:56:46.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ClusterLabs/libqb/pull/490 - https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8 - https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6E
8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6EM7ACVMIBP63WH/
CVE ID: CVE-2023-39977 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:03:20.073Z Description: No description available.
CVE ID: CVE-2023-39978 State: PUBLISHED Published: 2023-08-08T00:00:00 Last Updated: 2024-11-27T14:26:44.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rmagick/rmagick/pull/1406/files - https://github.com/ImageMagick/ImageMagick6/commit/c90e79b3b22fec309cab55af2ee606f71b027b12 - https://github.com/ImageMagick/ImageMagick6/compare/6.9.12-90...6.9.12-91 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ
...6.9.12-91 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3/
CVE ID: CVE-2023-39979 State: PUBLISHED Published: 2023-09-02T12:05:48.829Z Last Updated: 2024-09-30T20:18:16.494Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: MXsecurity Series Problem Types: CWE-334 Description: There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities
CVE ID: CVE-2023-39980 State: PUBLISHED Published: 2023-09-02T12:14:15.692Z Last Updated: 2024-09-27T16:02:36.484Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: Moxa Products: MXsecurity Series Problem Types: CWE-89 Description: A vulnerability that allows the unauthorized disclosure of authenticated information has been identified in MXsecurity versions prior to v1.0.1. This vulnerability arises when special elements are not neutralized correctly, allowing remote attackers to alter SQL commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230
ainer: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities
CVE ID: CVE-2023-39981 State: PUBLISHED Published: 2023-09-02T12:25:12.195Z Last Updated: 2024-10-28T06:11:47.253Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Moxa Products: MXsecurity Series Problem Types: CWE-306 Description: A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authentication measures, potentially leading to the disclosure of device information by a remote attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecur
SA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilities