Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-37135 State: PUBLISHED Published: 2023-07-06T00:00:00 Last Updated: 2024-11-19T17:09:48.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weng-xianhu/eyoucms/issues/48
CVE ID: CVE-2023-37136 State: PUBLISHED Published: 2023-07-06T00:00:00 Last Updated: 2024-11-19T17:07:14.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weng-xianhu/eyoucms/issues/49
CVE ID: CVE-2023-37139 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T16:44:37.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlotArray(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chakra-core/ChakraCore/issues/6884
CVE ID: CVE-2023-37140 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T16:44:06.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chakra-core/ChakraCore/issues/6885
CVE ID: CVE-2023-37141 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T16:42:20.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chakra-core/ChakraCore/issues/6886
CVE ID: CVE-2023-37142 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T16:38:07.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chakra-core/ChakraCore/issues/6887
CVE ID: CVE-2023-37143 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T16:34:38.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chakra-core/ChakraCore/issues/6888
CVE ID: CVE-2023-37144 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-13T14:34:16.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 v15.03.06.26 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DaDong-G/Vulnerability_info/blob/main/ac10_command_injection/Readme.md
CVE ID: CVE-2023-37145 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-13T14:33:22.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DaDong-G/Vulnerability_info/blob/main/TOTOLINK/lr350/1/Readme.md
CVE ID: CVE-2023-37146 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-12T19:59:33.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DaDong-G/Vulnerability_info/tree/main/TOTOLINK/lr350/2
CVE ID: CVE-2023-37148 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-14T14:01:39.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DaDong-G/Vulnerability_info/blob/main/TOTOLINK/lr350/3/README.md
CVE ID: CVE-2023-37149 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-13T21:44:12.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DaDong-G/Vulnerability_info/blob/main/TOTOLINK/lr350/4/README.md
CVE ID: CVE-2023-37150 State: PUBLISHED Published: 2023-07-10T00:00:00 Last Updated: 2024-11-12T19:32:16.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in "/admin/index.php?page=categories" Category item. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/Online%20Pizza%20Ordering%20System%20v1.0.md - https://www.chtsecurity.com/news/57fd2fe6-11d9-421d-9087-88b4d5090452 - https://www.chtsecurity.com/news/c27389f3-a70b-4a71-952a-49f273d1db90
CVE ID: CVE-2023-37151 State: REJECTED Published: N/A Last Updated: 2023-08-28T15:28:47.182135 Description: No description available.
CVE ID: CVE-2023-37152 State: PUBLISHED Published: 2023-07-10T00:00:00 Last Updated: 2024-08-02T17:09:33.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds Online Art Gallery Project 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page. Note: This has been disputed as not a valid vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/51524 - https://github.com/Trinity-SYT-SECURITY/arbitrary-file-upload-RCE/blob/main/Online%20Art%20gallery%20project%201.0.md - https://www.chtsecurity.com/news/afe25fb4-55ac-45d9-9ece-cbc1edda2fb2%20 - https://www.chtsecurity.com/news
t%201.0.md - https://www.chtsecurity.com/news/afe25fb4-55ac-45d9-9ece-cbc1edda2fb2%20 - https://www.chtsecurity.com/news/ad3cee07-3e35-45c0-97f9-811cce13dda9
CVE ID: CVE-2023-37153 State: PUBLISHED Published: 2023-07-10T00:00:00 Last Updated: 2024-11-12T19:30:27.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: KodExplorer 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature. An attacker can exploit this vulnerability by injecting XSS syntax into the Description field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/KodExplorer4.51.03.md - https://github.com/kalcaddle/KodExplorer - https://www.chtsecurity.com/news/55f0a781-f7bf-4b2f-b2cc-7957fdf846da - https://www.cht
thub.com/kalcaddle/KodExplorer - https://www.chtsecurity.com/news/55f0a781-f7bf-4b2f-b2cc-7957fdf846da - https://www.chtsecurity.com/news/13a86b33-7e49-4167-9682-7ff3f51cbcba%20
CVE ID: CVE-2023-37154 State: PUBLISHED Published: 2024-10-09T00:00:00 Last Updated: 2024-10-09T21:30:44.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \${IFS}. This has been categorized both as fixed in e8810de, and as intended behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nagios-plugins/nagios-plugins/commit/e8810de21be80148562b7e0168b0a62aeedffde6 - https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-p3gv-vmpx-hhw4 - https://joshua.hu/nagios-hacking-cve-2023-
nitoring-plugins/monitoring-plugins/security/advisories/GHSA-p3gv-vmpx-hhw4 - https://joshua.hu/nagios-hacking-cve-2023-37154
CVE ID: CVE-2023-37164 State: PUBLISHED Published: 2023-07-20T00:00:00 Last Updated: 2024-10-24T16:49:15.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the cat_id parameter at /shop/?module=shop&action=search. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51529
CVE ID: CVE-2023-37165 State: PUBLISHED Published: 2023-07-20T00:00:00 Last Updated: 2024-10-24T16:48:46.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Millhouse-Project v1.414 was discovered to contain a remote code execution (RCE) vulnerability via the component /add_post_sql.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51450
CVE ID: CVE-2023-37170 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-12T19:54:46.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_1
CVE ID: CVE-2023-37171 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-12T19:53:47.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_2
CVE ID: CVE-2023-37172 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-12T19:52:47.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_3
CVE ID: CVE-2023-37173 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-12T19:51:22.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_4
CVE ID: CVE-2023-37174 State: PUBLISHED Published: 2023-07-11T00:00:00 Last Updated: 2024-11-08T15:24:21.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dump_isom_scene function at /mp4box/filedump.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2505
CVE ID: CVE-2023-37177 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-08-15T18:07:35.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via the query parameter in the /admin/convert/export_z3950.php endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nexacybersecurity.blogspot.com/2024/02/journey-finding-vulnerabilities-in-pmb-library-management-system.html
CVE ID: CVE-2023-37185 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-11-26T14:55:28.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Blosc/c-blosc2/issues/519 - https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5 - https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3
CVE ID: CVE-2023-37186 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T17:09:34.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Blosc/c-blosc2/issues/522 - https://github.com/Blosc/c-blosc2/commit/d55bfcd6804699e1435dc3e233fd76c8a5d3f9e3 - https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3
CVE ID: CVE-2023-37187 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T17:09:32.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5 - https://github.com/Blosc/c-blosc2/issues/520 - https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3
CVE ID: CVE-2023-37188 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T17:09:33.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5 - https://github.com/Blosc/c-blosc2/issues/521 - https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3
CVE ID: CVE-2023-37189 State: PUBLISHED Published: 2023-07-11T00:00:00 Last Updated: 2024-11-08T15:12:20.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://reference1.example.com/index.php?menu=billing_rates - https://github.com/sahiloj/CVE-2023-37189/blob/main/README.md
CVE ID: CVE-2023-37190 State: PUBLISHED Published: 2023-07-11T00:00:00 Last Updated: 2024-11-08T17:43:13.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Virtual Fax Name and Caller ID Name parameters under the New Virtual Fax feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://reference2.example.com/index.php?menu=grouplist - https://github.com/sahiloj/CVE-2023-37190/blob/main/README.md
CVE ID: CVE-2023-37191 State: PUBLISHED Published: 2023-07-11T00:00:00 Last Updated: 2024-11-13T21:38:11.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://reference3.example.com/index.php?menu=faxnew - https://github.com/sahiloj/CVE-2023-37191/blob/main/README.md
CVE ID: CVE-2023-37192 State: PUBLISHED Published: 2023-07-06T00:00:00 Last Updated: 2024-11-20T19:46:59.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bitcoin.org/en/bitcoin-core/ - https://satoshihunter1.blogspot.com/2023/06/the-bitcoin-app-is-vulnerable-to-hackers.html - https://www.youtube.com/watch?v=oEl4M1oZim0
CVE ID: CVE-2023-37194 State: PUBLISHED Published: 2023-10-10T10:21:22.914Z Last Updated: 2024-09-19T14:27:20.089Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CP 1604, SIMATIC CP 1616, SIMATIC CP 1623, SIMATIC CP 1626, SIMATIC CP 1628 Problem Types: CWE-284 Description: A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 1628 (All versions). The kernel memory of affected devices is exposed to user-mode via direct memory access (DMA) which could allow a local attacker with administrative priv
vices is exposed to user-mode via direct memory access (DMA) which could allow a local attacker with administrative privileges to execute arbitrary code on the host system without any restrictions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-784849.pdf
CVE ID: CVE-2023-37195 State: PUBLISHED Published: 2023-10-10T10:21:24.004Z Last Updated: 2024-09-19T14:23:36.338Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CP 1604, SIMATIC CP 1616, SIMATIC CP 1623, SIMATIC CP 1626, SIMATIC CP 1628 Problem Types: CWE-400 Description: A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 1628 (All versions). Affected devices insufficiently control continuous mapping of direct memory access (DMA) requests. This could allow local attackers with administrative
control continuous mapping of direct memory access (DMA) requests. This could allow local attackers with administrative privileges to cause a denial of service situation on the host. A physical power cycle is required to get the system working again. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-784849.pdf
CVE ID: CVE-2023-37196 State: PUBLISHED Published: 2023-07-12T06:22:46.848Z Last Updated: 2024-11-07T14:46:44.245Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: StruxureWare Data Center Expert Problem Types: CWE-89 Description: A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the alert settings of endpoints on DCE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
with the alert settings of endpoints on DCE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf
CVE ID: CVE-2023-37197 State: PUBLISHED Published: 2023-07-12T06:41:30.783Z Last Updated: 2024-11-07T14:46:11.017Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: StruxureWare Data Center Expert Problem Types: CWE-89 Description: A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the mass configuration settings of endpoints on DCE. Additional Analyst Notes: - CVE Program Container: - CISA ADP
with the mass configuration settings of endpoints on DCE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf
CVE ID: CVE-2023-37198 State: PUBLISHED Published: 2023-07-12T06:44:34.037Z Last Updated: 2024-11-07T14:45:30.711Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: StruxureWare Data Center Expert Problem Types: CWE-94 Description: A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Na
ttps://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf
CVE ID: CVE-2023-37199 State: PUBLISHED Published: 2023-07-12T07:04:08.510Z Last Updated: 2024-11-07T14:44:46.940Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: StruxureWare Data Center Expert Problem Types: CWE-94 Description: A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Not
ferences: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf
CVE ID: CVE-2023-37200 State: PUBLISHED Published: 2023-07-12T07:11:30.005Z Last Updated: 2024-11-07T14:07:40.931Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: EcoStruxure OPC UA Server Expert Problem Types: CWE-611 Description: A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replacing a project file on the local filesystem and after manual restart of the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-02&p_enDocType=Security+
lnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-02.pdf