Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-28896 State: PUBLISHED Published: 2023-12-01T14:01:05.877Z Last Updated: 2024-08-02T13:51:38.819Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: JOYNEXT Products: MIB3 Infotainment Unit Problem Types: CWE-261 Description: Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022. Additional Analyst Notes: - CVE Program Container: References: - https://asrg.io/security-adv
TDI manufactured in 2022. Additional Analyst Notes: - CVE Program Container: References: - https://asrg.io/security-advisories/cve-2023-28896/
CVE ID: CVE-2023-28897 State: PUBLISHED Published: 2024-01-12T15:55:00.234Z Last Updated: 2025-06-17T21:09:16.817Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: JOYNEXT Products: MIB3 Infotainment Unit Problem Types: CWE-798 Description: The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware. Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://asrg.io/security-advisories/cve-2023-28897
CVE ID: CVE-2023-28898 State: PUBLISHED Published: 2024-01-12T16:04:57.218Z Last Updated: 2024-11-14T15:48:25.166Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: JOYNEXT Products: MIB3 Infotainment Unit Problem Types: CWE-233 Description: The Real-Time Streaming Protocol implementation in the MIB3 infotainment incorrectly handles requests to /logs URI, when the id parameter equals to zero. This issue allows an attacker connected to the in-vehicle Wi-Fi network to cause denial-of-service of the infotainment system, when the certain preconditions are met. Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022. Additional Analyst Not
tions are met. Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nonexistent.com
CVE ID: CVE-2023-28899 State: PUBLISHED Published: 2024-01-12T16:32:07.082Z Last Updated: 2024-10-25T20:21:34.771Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Škoda Products: Superb III Description: By sending a specific reset UDS request via OBDII port of Skoda vehicles, it is possible to cause vehicle engine shutdown and denial of service of other vehicle components even when the vehicle is moving at a high speed. No safety critical functions affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://asrg.io/security-advisories/cve-2023-28899
CVE ID: CVE-2023-28900 State: PUBLISHED Published: 2024-01-18T16:23:07.819Z Last Updated: 2025-06-17T21:19:19.977Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Škoda Auto Products: Škoda Connect Problem Types: CWE-200 Description: The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://asrg.io/security-advisories/cve-2023-28900
CVE ID: CVE-2023-28901 State: PUBLISHED Published: 2024-01-18T16:27:43.711Z Last Updated: 2025-06-17T21:19:20.121Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Skoda Auto Products: Skoda Connect Problem Types: CWE-200 Description: The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://asrg.io/security-advisories/cve-2023-28901/
CVE ID: CVE-2023-28902 State: PUBLISHED Published: 2025-06-28T15:38:23.242Z Last Updated: 2025-06-30T19:20:28.406Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-191 Description: An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the infotainment system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the r
r with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28903 State: PUBLISHED Published: 2025-06-28T15:38:02.954Z Last Updated: 2025-06-30T19:20:34.306Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-190 Description: An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-service of the infotainment system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/a
https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28904 State: PUBLISHED Published: 2025-06-28T15:37:35.093Z Last Updated: 2025-06-30T19:20:40.496Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-120 Description: A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU to bypass firmware signature verification and run arbitrary code in the infotainment system at boot process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentat
at boot process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28905 State: PUBLISHED Published: 2025-06-28T15:37:09.395Z Last Updated: 2025-06-30T19:20:46.621Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-122 Description: A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA
0. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28906 State: PUBLISHED Published: 2025-06-28T15:36:47.874Z Last Updated: 2025-06-30T19:20:53.245Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-78 Description: A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain administrative access to the system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in
II car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28907 State: PUBLISHED Published: 2025-06-28T15:36:10.983Z Last Updated: 2025-06-30T19:20:58.905Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-284 Description: There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating system to compromise the CPU core responsible for CAN message processing. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numb
d in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28908 State: PUBLISHED Published: 2025-06-28T15:35:48.124Z Last Updated: 2025-06-30T19:21:06.102Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-190 Description: A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving non-fragmented HCI packets on a channel. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. T
vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28909 State: PUBLISHED Published: 2025-06-28T15:35:21.590Z Last Updated: 2025-06-30T19:21:12.865Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-190 Description: A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving fragmented HCI packets on a channel. An attacker can leverage this vulnerability to bypass the MTU check on a channel with enabled fragmentation. Consequently, this can lead to
rage this vulnerability to bypass the MTU check on a channel with enabled fragmentation. Consequently, this can lead to a buffer overflow in upper layer profiles, which can be used to obtain remote code execution. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulner
ersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28910 State: PUBLISHED Published: 2025-06-28T15:34:50.755Z Last Updated: 2025-06-30T15:09:53.450Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-754 Description: A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventually leading to bypassing assertion functions. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the refer
th MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28911 State: PUBLISHED Published: 2025-06-28T15:34:25.867Z Last Updated: 2025-06-30T15:08:00.610Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-20 Description: A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which can result in an arbitrary channel disconnection. An attacker can leverage this vulnerability to cause a denial-of-service attack for every connected client of the infotainment device. The vulnerability was original
o cause a denial-of-service attack for every connected client of the infotainment device. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28912 State: PUBLISHED Published: 2025-06-28T15:33:58.714Z Last Updated: 2025-06-30T15:05:14.568Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Preh Car Connect GmbH (JOYNEXT GmbH) Products: Volkswagen MIB3 infotainment system MIB3 OI MQB Problem Types: CWE-312 Description: The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical access to the system to obtain vehicle owner's contact data. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM pa
scovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf - https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 - https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
CVE ID: CVE-2023-28929 State: PUBLISHED Published: 2023-06-26T21:52:22.423Z Last Updated: 2024-12-05T15:46:07.827Z Vendors: Trend Micro, Inc. Products: Trend Micro Security (Consumer) Description: Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable file as an execution and/or persistence mechanism which could execute a malicious program each time the executable file is started. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-19062
CVE ID: CVE-2023-28930 State: PUBLISHED Published: 2023-11-12T21:32:59.127Z Last Updated: 2024-09-03T13:32:51.932Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Robin Phillips Products: Mobile Banner Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Robin Phillips Mobile Banner plugin <= 1.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mobile-banner/wordpress-mobile-banner-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28931 State: PUBLISHED Published: 2023-08-08T12:35:44.360Z Last Updated: 2024-09-25T16:47:37.251Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Never5 Products: Post Connector Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Never5 Post Connector plugin <= 1.0.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/post-connector/wordpress-post-connector-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28932 State: PUBLISHED Published: 2023-05-10T07:07:24.036Z Last Updated: 2025-01-09T15:21:51.694Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPMobile.App Products: WPMobile.App — Android and iOS Mobile Application Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.20 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpappninja/wordpress-wpmobile-app-plugin-11-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28933 State: PUBLISHED Published: 2023-06-12T15:10:01.709Z Last Updated: 2024-10-10T17:27:50.221Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: StPeteDesign Products: Call Now Accessibility Button Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in StPeteDesign Call Now Accessibility Button plugin <= 1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/accessibility-help-button/wordpress-call-now-accessibility-button-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28934 State: PUBLISHED Published: 2023-08-08T12:25:44.931Z Last Updated: 2025-02-19T21:26:46.167Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Mammothology Products: WP Full Stripe Free Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-full-stripe-free/wordpress-wp-full-stripe-free-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28935 State: PUBLISHED Published: 2023-03-30T09:10:11.178Z Last Updated: 2024-10-23T15:12:10.819Z Vendors: Apache Software Foundation Products: Apache UIMA DUCC Problem Types: CWE-77 Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC. When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA, an authenticated user that has the permissions to modify core entities can cause command execution as the system user that runs the web process. As the "Distributed UIMA Cluster Computing" module for UIMA is retired, we do not
ystem user that runs the web process. As the "Distributed UIMA Cluster Computing" module for UIMA is retired, we do not plan to release a fix for this issue. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/r19z14b9rrfxv72r93q5trq5tyffo75g
CVE ID: CVE-2023-28936 State: PUBLISHED Published: 2023-05-12T07:45:04.835Z Last Updated: 2024-10-10T20:30:03.380Z Vendors: Apache Software Foundation Products: Apache OpenMeetings Problem Types: CWE-697 Description: Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/y6vng44c22ll221rtvsv208x1pbjmdoc
CVE ID: CVE-2023-28937 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T19:27:35.450Z Vendors: SAISON INFORMATION SYSTEMS CO.,LTD. Products: DataSpider Servista Problem Types: Use of hard-coded cryptographic key Description: DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunner and ScriptRunner for Amazon SQS are used to start the configured processes on DataSpider Servista. The cryptographic key is embedded in ScriptRunner and ScriptRunner for Amazon SQS, which is common to all users. If an attacker who can gain access to a target DataSpider Servista instance and obtain a Launch
is common to all users. If an attacker who can gain access to a target DataSpider Servista instance and obtain a Launch Settings file of ScriptRunner and/or ScriptRunner for Amazon SQS, the attacker may perform operations with the user privilege encrypted in the file. Note that DataSpider Servista and some of the OEM products are affected by this vulnerability. For the details of affected products and versions, refer to the information listed in [References]. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hulft.com/download_file/18675 - https://jvn.jp/en/jp/JVN38222042/ - https://www.hulft.com/application/files/4416/8420/4506/informatio