Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-27232 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-18T20:15:21.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/32
CVE ID: CVE-2023-27233 State: PUBLISHED Published: 2023-05-17T00:00:00.000Z Last Updated: 2025-01-22T19:44:16.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/renanavs/dcb13bb1cd618ce7eb0c80290b837245 - https://github.com/Piwigo/Piwigo/issues/1872
CVE ID: CVE-2023-27234 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T19:15:14.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Cherry-toto/jizhicms/issues/85
CVE ID: CVE-2023-27235 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T14:26:53.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Cherry-toto/jizhicms/issues/85
CVE ID: CVE-2023-27237 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-24T19:52:03.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://lavalite.com - https://i.ibb.co/34DSW7B/1.png - https://i.ibb.co/kSkqPhQ/3.png - https://i.ibb.co/mJq9CH8/2.png - https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-27237
CVE ID: CVE-2023-27238 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-27T16:27:47.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LavaLite/cms/blob/c0a36dd748c8f7ff53eb16eb572bdeebe72eb420/app/Http/Controllers/ResourceController.php#L8 - https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-27238
CVE ID: CVE-2023-27239 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T14:59:15.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yjzy00001/CVE/blob/main/vuln/WifiGuestSet/readme.md
CVE ID: CVE-2023-27240 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T14:25:19.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX3 V16.03.12.11 was discovered to contain a command injection vulnerability via the lanip parameter at /goform/AdvSetLanip. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yjzy00001/CVE/blob/main/vuln/rce/readme.md
CVE ID: CVE-2023-27241 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:34:58.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Water Billing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the lastname text box under the Add Client module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kaikai-11/WaterBilling-System - https://github.com/kaikai-11/WaterBilling-System/blob/main/README.md
CVE ID: CVE-2023-27242 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-19T21:43:56.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Loan Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Type parameter under the Edit Loan Types module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kaikai-11/Loan-Management-System - https://github.com/kaikai-11/Loan-Management-System/blob/main/README.md
CVE ID: CVE-2023-27243 State: PUBLISHED Published: 2023-06-21T00:00:00 Last Updated: 2024-12-06T18:47:25.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via a crafted web request to the product API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://dcap.com - http://makves.com - https://pastebin.com/L5BkBeEE
CVE ID: CVE-2023-27245 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:33:18.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Edit User module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flyasolo/File-Management-System
CVE ID: CVE-2023-27246 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-18T20:14:21.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted .htaccess file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/IntruderLabs/2023-05-25-ziroudei/blob/main/README.md
CVE ID: CVE-2023-27247 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-18T20:36:43.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cynet Client Agent v4.6.0.8010 allows attackers with Administrator rights to disable the EDR functions by disabling process privilege tokens. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/NF-Security-Team/CVEs/blob/main/CVE-Cynet/Readme.md - https://github.com/advisories/GHSA-hmjw-7429-p2vc
CVE ID: CVE-2023-27249 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T20:23:22.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: swfdump v0.9.2 was discovered to contain a heap buffer overflow in the function swf_GetPlaceObject at swfobject.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://swfdump.com - https://github.com/keepinggg/poc/blob/main/poc_of_swfdump/poc - https://github.com/matthiaskramm/swftools - https://github.com/matthiaskramm/swftools/issues/197 - https://github.com/keepinggg/poc/tree/main/poc_of_swfdump
CVE ID: CVE-2023-27250 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T18:45:58.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Book Store Project v1.0 is vulnerable to SQL Injection via /bookstore/bookPerPub.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/iknownt/bug_report/blob/main/vendors/itsourcecode.com/Online-Book-Store-Project/sql_injection.md
CVE ID: CVE-2023-27253 State: PUBLISHED Published: 2023-03-17T00:00:00.000Z Last Updated: 2025-02-26T14:58:43.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://redmine.pfsense.org/issues/13935 - https://github.com/pfsense/pfsense/commit/ca80d18493f8f91b21933ebd6b714215ae1e5e94 - http://packetstormsecurity.com/files/173487/pfSense-Restore-RRD-Data-C
commit/ca80d18493f8f91b21933ebd6b714215ae1e5e94 - http://packetstormsecurity.com/files/173487/pfSense-Restore-RRD-Data-Command-Injection.html
CVE ID: CVE-2023-27254 State: PUBLISHED Published: 2023-10-25T10:04:35.529Z Last Updated: 2024-09-11T13:14:28.360Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-89 Description: Unauthenticated SQL injection in the GetRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27254
CVE ID: CVE-2023-27255 State: PUBLISHED Published: 2023-10-25T10:08:00.636Z Last Updated: 2024-09-11T13:14:47.434Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-89 Description: Unauthenticated SQL injection in the DeleteRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27255
CVE ID: CVE-2023-27256 State: PUBLISHED Published: 2023-10-25T10:13:40.729Z Last Updated: 2024-09-25T11:45:46.513Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the GetLogFiles method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of sensitive log files by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27256
CVE ID: CVE-2023-27257 State: PUBLISHED Published: 2023-10-25T10:15:17.834Z Last Updated: 2024-09-25T11:46:39.925Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student information by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27257
CVE ID: CVE-2023-27258 State: PUBLISHED Published: 2023-10-25T10:16:16.821Z Last Updated: 2024-09-25T11:47:27.956Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student and teacher data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27258
CVE ID: CVE-2023-27259 State: PUBLISHED Published: 2023-10-25T10:17:25.615Z Last Updated: 2024-09-25T11:48:26.985Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teacher data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27259
CVE ID: CVE-2023-27260 State: PUBLISHED Published: 2023-10-25T10:23:07.152Z Last Updated: 2024-09-17T14:08:21.350Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-89 Description: Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27260
CVE ID: CVE-2023-27261 State: PUBLISHED Published: 2023-10-25T10:21:36.996Z Last Updated: 2024-09-25T11:49:35.682Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the DeleteAssignments method in IDAttend’s IDWeb application 3.1.052 and earlier allows deletion of data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27261
CVE ID: CVE-2023-27262 State: PUBLISHED Published: 2023-10-25T10:25:22.287Z Last Updated: 2024-09-10T20:25:13.783Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-89 Description: Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27260
CVE ID: CVE-2023-27263 State: PUBLISHED Published: 2023-02-27T14:44:52.790Z Last Updated: 2024-12-06T23:07:00.432Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-27264 State: PUBLISHED Published: 2023-02-27T14:46:16.310Z Last Updated: 2024-12-06T23:06:49.092Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-27265 State: PUBLISHED Published: 2023-02-27T14:46:23.494Z Last Updated: 2024-12-06T23:06:38.055Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-27266 State: PUBLISHED Published: 2023-02-27T14:46:28.880Z Last Updated: 2024-12-06T23:06:25.577Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-27267 State: PUBLISHED Published: 2023-04-11T02:36:15.882Z Last Updated: 2025-02-07T19:32:45.187Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP Products: Diagnostics Agent (OSCommand Bridge) Problem Types: CWE-306 Description: Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system. Additional Analyst Notes: - CVE Program Container: - CI
omise confidentiality, integrity and availability of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3305369 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27268 State: PUBLISHED Published: 2023-03-14T04:57:30.115Z Last Updated: 2025-02-27T15:05:10.709Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP Products: NetWeaver AS Java (Object Analyzing Service) Problem Types: CWE-284 Description: SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability., resulting in escalation of privileges. Additional A
not modify server settings and data with no effect on availability., resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3288480 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27269 State: PUBLISHED Published: 2023-03-14T04:58:10.184Z Last Updated: 2025-02-27T15:03:19.178Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: SAP Products: NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-22 Description: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files. In this attack, no data can be read but potentially critical OS files can be overwritten making the syst
e system files. In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3294595 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27270 State: PUBLISHED Published: 2023-03-14T04:58:44.671Z Last Updated: 2025-02-27T15:02:08.114Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP Products: NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-400 Description: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is n
quest with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3296328 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27271 State: PUBLISHED Published: 2023-03-14T05:01:07.144Z Last Updated: 2025-02-27T18:05:13.758Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP Products: BusinessObjects Business Intelligence Platform (Web Services) Problem Types: CWE-918 Description: In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3287120 - http
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3287120 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27272 State: PUBLISHED Published: 2025-04-14T20:38:20.988Z Last Updated: 2025-08-17T00:08:48.731Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Aspera Console Problem Types: CWE-521 Description: IBM Aspera Console 3.4.0 through 3.4.4 allows passwords to be reused when a new user logs into the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7169766
CVE ID: CVE-2023-27279 State: PUBLISHED Published: 2024-04-19T16:39:27.659Z Last Updated: 2024-08-02T12:09:41.845Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-799 Description: IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting. IBM X-Force ID: 248533. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7148632 - https://exchange.xforce.ibmcloud.com/vulnerabilities/248533
CVE ID: CVE-2023-27283 State: PUBLISHED Published: 2024-05-04T13:16:14.314Z Last Updated: 2024-08-02T12:09:42.807Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Aspera Orchestrator Problem Types: CWE-204 Description: IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7150191 - https://exchange.xforce.ibmcloud.com/vulnerabilities/248545
CVE ID: CVE-2023-27284 State: PUBLISHED Published: 2023-03-28T20:07:01.832Z Last Updated: 2025-02-18T20:08:49.324Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Aspera Problem Types: CWE-119 Description: IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248616. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6966588 - https://exchange.xforce.ibmcloud.com/vulnerabilities/248616