Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-32732 State: PUBLISHED Published: 2023-06-09T10:48:15.075Z Last Updated: 2025-02-13T16:55:01.392Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Google Products: gRPC Problem Types: CWE-440 Description: gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309 https://www.google.com/url Additional Analyst Notes: - CVE Program Container: - CISA ADP
ithub.com/grpc/grpc/pull/32309 https://www.google.com/url Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grpc/grpc/pull/32309 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/37IDNVY5AWVH7JDMM2SDTL24ZPPZJNSY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VWE44J5FG7THHL7XVEVTNIGEYBNKJBLL/
CVE ID: CVE-2023-32734 State: PUBLISHED Published: 2023-07-27T00:22:26.298Z Last Updated: 2024-10-22T20:43:54.723Z Vendors: Apple Products: tvOS, iOS and iPadOS, macOS, watchOS Problem Types: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213846 - https://support.apple.com/en-us/HT213841 - https://support.apple.com/en-us/HT
https://support.apple.com/en-us/HT213846 - https://support.apple.com/en-us/HT213841 - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213848
CVE ID: CVE-2023-32735 State: PUBLISHED Published: 2024-07-09T12:04:26.871Z Last Updated: 2025-08-27T20:32:53.425Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC STEP 7 Safety V16, SIMATIC STEP 7 Safety V17, SIMATIC STEP 7 Safety V18, SIMATIC STEP 7 V16, SIMATIC STEP 7 V17, SIMATIC STEP 7 V18, SIMATIC WinCC Unified V16, SIMATIC WinCC Unified V17, SIMATIC WinCC Unified V18, SIMATIC WinCC V16, SIMATIC WinCC V17, SIMATIC WinCC V18, SIMOCODE ES V16, SIMOCODE ES V17, SIMOCODE ES V18, SIMOTION SCOUT TIA V5.4 SP1, SIMOTION SCOUT TIA V5.4 SP3, SIMOTION SCOUT TIA V5.5 SP1, SINAMICS Startdrive V16, SINAMICS Startdrive V17, SINA
.4 SP1, SIMOTION SCOUT TIA V5.4 SP3, SIMOTION SCOUT TIA V5.5 SP1, SINAMICS Startdrive V16, SINAMICS Startdrive V17, SINAMICS Startdrive V18, SIRIUS Safety ES V17, SIRIUS Safety ES V18, SIRIUS Soft Starter ES V17, SIRIUS Soft Starter ES V18, Soft Starter ES V16, TIA Portal Cloud V3.0 Problem Types: CWE-502 Description: A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 7), SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2), SIMATIC STEP 7 V16 (All versions < V16 Update 7), SIMATIC STEP 7 V17 (All versions < V17 Update 7), SIMATIC STEP 7 V18 (All versions < V18 Update 2), SIMATIC WinCC Unifie
SIMATIC STEP 7 V17 (All versions < V17 Update 7), SIMATIC STEP 7 V18 (All versions < V18 Update 2), SIMATIC WinCC Unified V16 (All versions < V16 Update 7), SIMATIC WinCC Unified V17 (All versions < V17 Update 7), SIMATIC WinCC Unified V18 (All versions < V18 Update 2), SIMATIC WinCC V16 (All versions < V16.7), SIMATIC WinCC V17 (All versions < V17.7), SIMATIC WinCC V18 (All versions < V18 Update 2), SIMOCODE ES V16 (All versions < V16 Update 7), SIMOCODE ES V17 (All versions < V17 Update 7), SIMOCODE ES V18 (All versions < V18 Update 2), SIMOTION SCOUT TIA V5.4 SP1 (All versions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SINAMICS Startdrive V16
rsions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SINAMICS Startdrive V16 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SIRIUS Safety ES V17 (All versions < V17 Update 7), SIRIUS Safety ES V18 (All versions < V18 Update 2), SIRIUS Soft Starter ES V17 (All versions < V17 Update 7), SIRIUS Soft Starter ES V18 (All versions < V18 Update 2), Soft Starter ES V16 (All versions < V16 Update 7), TIA Portal Cloud V3.0 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing hardware configuration profiles. This could allow an attacker to cau
estrict the .NET BinaryFormatter when deserializing hardware configuration profiles. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-779936.html
CVE ID: CVE-2023-32736 State: PUBLISHED Published: 2024-11-12T12:49:22.651Z Last Updated: 2025-01-14T10:27:17.694Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC S7-PLCSIM V16, SIMATIC S7-PLCSIM V17, SIMATIC STEP 7 Safety V16, SIMATIC STEP 7 Safety V17, SIMATIC STEP 7 Safety V18, SIMATIC STEP 7 V16, SIMATIC STEP 7 V17, SIMATIC STEP 7 V18, SIMATIC WinCC Unified V16, SIMATIC WinCC Unified V17, SIMATIC WinCC Unified V18, SIMATIC WinCC V16, SIMATIC WinCC V17, SIMATIC WinCC V18, SIMOCODE ES V16, SIMOCODE ES V17, SIMOCODE ES V18, SIMOTION SCOUT TIA V5.4 SP1, SIMOTION SCOUT TIA V5.4 SP3, SIMOTION SCOUT TIA V5.5 SP1, SINAMICS S
V17, SIMOCODE ES V18, SIMOTION SCOUT TIA V5.4 SP1, SIMOTION SCOUT TIA V5.4 SP3, SIMOTION SCOUT TIA V5.5 SP1, SINAMICS Startdrive V16, SINAMICS Startdrive V17, SINAMICS Startdrive V18, SIRIUS Safety ES V17 (TIA Portal), SIRIUS Safety ES V18 (TIA Portal), SIRIUS Soft Starter ES V17 (TIA Portal), SIRIUS Soft Starter ES V18 (TIA Portal), TIA Portal Cloud V16, TIA Portal Cloud V17, TIA Portal Cloud V18 Problem Types: CWE-502 Description: A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 8), SIMATIC STEP 7 Safety V18 (All versions < V18 Up
All versions), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 8), SIMATIC STEP 7 Safety V18 (All versions < V18 Update 5), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 8), SIMATIC STEP 7 V18 (All versions < V18 Update 5), SIMATIC WinCC Unified V16 (All versions), SIMATIC WinCC Unified V17 (All versions < V17 Update 8), SIMATIC WinCC Unified V18 (All versions < V18 SP5), SIMATIC WinCC V16 (All versions), SIMATIC WinCC V17 (All versions < V17 Update 8), SIMATIC WinCC V18 (All versions < V18 SP5), SIMOCODE ES V16 (All versions), SIMOCODE ES V17 (All versions < V17 Update 8), SIMOCODE ES V18 (All versions), SIMOTION SCOUT TIA V5.4 SP1 (All versions), SIM
DE ES V17 (All versions < V17 Update 8), SIMOCODE ES V18 (All versions), SIMOTION SCOUT TIA V5.4 SP1 (All versions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SINAMICS Startdrive V16 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions < V17 Update 8), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions < V17 Update 8), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), TIA Portal Cloud V16 (All versions), TIA Portal Cloud V17 (All versions < V4.6.0.1), TIA Portal Cloud V18 (All versions < V4.6.1.0).
oud V16 (All versions), TIA Portal Cloud V17 (All versions < V4.6.0.1), TIA Portal Cloud V18 (All versions < V4.6.1.0). Affected products do not properly sanitize user-controllable input when parsing user settings. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-871035.html
CVE ID: CVE-2023-32737 State: PUBLISHED Published: 2024-07-09T12:04:28.195Z Last Updated: 2025-08-27T20:32:53.574Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC STEP 7 Safety V18 Problem Types: CWE-502 Description: A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft
code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-313039.html
CVE ID: CVE-2023-32738 State: PUBLISHED Published: 2023-10-27T20:16:55.896Z Last Updated: 2024-09-06T18:47:04.856Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Alkaweb Products: Eonet Manual User Approve Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alkaweb Eonet Manual User Approve plugin <= 2.1.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/eonet-manual-user-approve/wordpress-eonet-manual-user-approve-plugin-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32739 State: PUBLISHED Published: 2023-11-09T20:56:15.813Z Last Updated: 2025-02-19T21:18:14.767Z Vendors: Web_Trendy Products: WP Custom Cursors | WordPress Cursor Plugin Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-custom-cursors/wordpress-wp-custom-cursors-plugin-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-32740 State: PUBLISHED Published: 2023-08-30T10:50:50.286Z Last Updated: 2024-09-24T19:24:34.304Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Kunal Nagar Products: Custom 404 Pro Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-404-pro/wordpress-custom-404-pro-plugin-3-8-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32741 State: PUBLISHED Published: 2023-11-03T23:04:23.323Z Last Updated: 2025-02-13T16:55:02.206Z Vendors: IT Path Solutions PVT LTD Products: Contact Form to Any API Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows SQL Injection.This issue affects Contact Form to Any API: from n/a through 1.1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contact-form-to-any-api/wordpress-contact-form-to-any-api-plugin-1-1-2-sql-injection-vulnerability?_s_id
e/vulnerability/contact-form-to-any-api/wordpress-contact-form-to-any-api-plugin-1-1-2-sql-injection-vulnerability?_s_id=cve - http://packetstormsecurity.com/files/175654/WordPress-Contact-Form-To-Any-API-1.1.2-SQL-Injection.html
CVE ID: CVE-2023-32742 State: PUBLISHED Published: 2023-08-30T11:08:09.174Z Last Updated: 2025-02-19T21:25:58.043Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: VeronaLabs Products: WP SMS Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS plugin <= 6.1.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-sms/wordpress-wp-sms-plugin-6-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32743 State: PUBLISHED Published: 2023-12-20T15:55:22.844Z Last Updated: 2024-08-02T15:25:36.592Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: WooCommerce Products: AutomateWoo Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/automatewoo/wordpress-automatewoo-plugin-5-7-1-shop-manager-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-32744 State: PUBLISHED Published: 2023-11-09T20:53:04.847Z Last Updated: 2024-09-03T18:14:01.277Z Vendors: WooCommerce Products: Product Recommendations Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Recommendations plugin <= 2.3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-product-recommendations/wordpress-woocommerce-product-recommendations-plugin-2-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-32745 State: PUBLISHED Published: 2023-11-09T20:38:31.093Z Last Updated: 2024-09-03T18:15:21.496Z Vendors: WooCommerce Products: AutomateWoo Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/automatewoo/wordpress-automatewoo-plugin-5-7-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-32746 State: PUBLISHED Published: 2023-08-30T11:39:25.494Z Last Updated: 2024-09-24T19:24:02.000Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WooCommerce Products: WooCommerce Brands Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-brands/wordpress-woocommerce-brands-plugin-1-6-45-contributor-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-32747 State: PUBLISHED Published: 2023-12-21T18:18:28.415Z Last Updated: 2025-04-24T14:49:38.755Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: WooCommerce Products: WooCommerce Bookings Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-bookings/wordpress-woocommerce-bookings-plugin-1-15-78-insecure-direct-object-references-idor-vulnerability?_s
ocommerce-bookings/wordpress-woocommerce-bookings-plugin-1-15-78-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2023-32748 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T16:15:12.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0004
CVE ID: CVE-2023-32749 State: PUBLISHED Published: 2023-06-08T00:00:00 Last Updated: 2025-01-06T20:44:56.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - http
ment: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - http://seclists.org/fulldisclosure/2023/May/18 - http://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.html - https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-003/-pydio-cells-unauthorised-role-assignments
CVE ID: CVE-2023-32750 State: PUBLISHED Published: 2023-06-08T00:00:00 Last Updated: 2025-01-06T20:40:51.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "remote-download" can be used to cause the backend to send a HTTP GET request to a specified URL and save the response to a new file. The response file is then available in a user-specified folder in Pydio Cells. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vu
tainer: - CISA ADP Vulnrichment: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - https://www.redteam-pentesting.de/advisories/rt-sa-2023-005/
CVE ID: CVE-2023-32751 State: PUBLISHED Published: 2023-06-08T00:00:00 Last Updated: 2025-01-06T20:38:54.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript [1]. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web application. Therefore, it is possible to generate valid signatures for arbitrary download URLs. By uploading an HTML file and modifying the download URL to serve the file inline instead of as an attachment, any included JavaScript code is executed when the UR
download URL to serve the file inline instead of as an attachment, any included JavaScript code is executed when the URL is opened in a browser, leading to a cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - https://www.redteam-pentesting.de/advisories/rt-sa-2023-004/
CVE ID: CVE-2023-32752 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-11T20:21:26.970Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: L7 Networks Products: InstantScan, InstantQoS Problem Types: CWE-434 Description: L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/en/cp-1
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/en/cp-139-7189-5995e-2.html
CVE ID: CVE-2023-32753 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-11T20:20:13.317Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ITPison Products: Contact ITPison Problem Types: CWE-434 Description: OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/en/cp-139-7190-d73c1-2.html
CVE ID: CVE-2023-32754 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-12T17:07:08.695Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Thinking Software Products: Efence Problem Types: CWE-89 Description: Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7161-3e7c9-1.html
CVE ID: CVE-2023-32755 State: PUBLISHED Published: 2023-08-25T06:48:31.747Z Last Updated: 2024-10-02T17:40:29.138Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: e-Excellence Products: U-Office Force Problem Types: CWE-209 Description: e-Excellence U-Office Force generates an error message in webiste service. An unauthenticated remote attacker can obtain partial sensitive system information from error message by sending a crafted command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7328-d4112-1.html
CVE ID: CVE-2023-32756 State: PUBLISHED Published: 2023-08-25T07:14:39.112Z Last Updated: 2024-10-02T17:39:51.077Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: e-Excellence Products: U-Office Force Problem Types: CWE-22 Description: e-Excellence U-Office Force has a path traversal vulnerability within its file uploading and downloading functions. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary system files, but can’t control system or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7329-d8e4c-1.html
CVE ID: CVE-2023-32757 State: PUBLISHED Published: 2023-08-25T07:29:05.292Z Last Updated: 2024-10-02T17:38:10.035Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: e-Excellence Products: U-Office Force Problem Types: CWE-434 Description: e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7330-94442-1.html