Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-29030 State: PUBLISHED Published: 2023-05-11T17:41:17.097Z Last Updated: 2024-08-02T14:00:14.600Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: ArmorStart ST Problem Types: CWE-79 Description: A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://rockwellautomation.custhelp.com/ap
CVE ID: CVE-2023-29031 State: PUBLISHED Published: 2023-05-11T17:38:06.128Z Last Updated: 2024-08-02T14:00:14.782Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: ArmorStart ST Problem Types: CWE-79 Description: A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://rockwellautomation.custhelp.com/ap
CVE ID: CVE-2023-29032 State: PUBLISHED Published: 2023-05-12T07:43:30.483Z Last Updated: 2024-10-10T19:48:37.089Z Vendors: Apache Software Foundation Products: Apache OpenMeetings Problem Types: CWE-287 Description: An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/j2d6mg3rzcphfd8vvvk09d8p4o9lvnqp
CVE ID: CVE-2023-29033 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-29034 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-29035 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-29036 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-29037 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-29038 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-29039 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-29040 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-29041 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-29042 State: REJECTED Published: N/A Last Updated: 2023-04-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-29043 State: PUBLISHED Published: 2023-11-02T13:01:28.171Z Last Updated: 2024-12-03T14:33:59.243Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: OX Software GmbH Products: OX App Suite Problem Types: CWE-79 Description: Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document. Script code embedded in malicious documents could be executed in the context of the user editing the document when performing certain actions, like copying content. The relevant attribute does now get encoded to avoid the possibility of executing script code. No p
ike copying content. The relevant attribute does now get encoded to avoid the possibility of executing script code. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE ID: CVE-2023-29044 State: PUBLISHED Published: 2023-11-02T13:01:31.388Z Last Updated: 2024-08-02T14:00:14.693Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: OX Software GmbH Products: OX App Suite Problem Types: CWE-79 Description: Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get escaped to avoid code execution. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: Refere
void code execution. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE ID: CVE-2023-29045 State: PUBLISHED Published: 2023-11-02T13:01:35.652Z Last Updated: 2024-08-02T14:00:14.652Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: OX Software GmbH Products: OX App Suite Problem Types: CWE-79 Description: Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now gets checked for validity to avoid code execution. No publicly available exploits are known. Additional Analyst
does now gets checked for validity to avoid code execution. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE ID: CVE-2023-29046 State: PUBLISHED Published: 2023-11-02T13:01:39.521Z Last Updated: 2024-08-02T14:00:14.609Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OX Software GmbH Products: OX App Suite Problem Types: CWE-400 Description: Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources
esult users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE ID: CVE-2023-29047 State: PUBLISHED Published: 2023-11-02T13:01:43.877Z Last Updated: 2025-06-12T14:33:40.573Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: OX Software GmbH Products: OX App Suite Problem Types: CWE-89 Description: Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. None No publicly available exploits are known. Additional Analyst Notes: - CVE Program Con
geconverter SQL user account. None No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
CVE ID: CVE-2023-29048 State: PUBLISHED Published: 2024-01-08T08:51:31.461Z Last Updated: 2025-06-06T17:33:01.115Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-78 Description: A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system lev
by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json - http://seclists.org/fulldisclosure/2024/Jan/3 - http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html
CVE ID: CVE-2023-29049 State: PUBLISHED Published: 2024-01-08T08:51:36.992Z Last Updated: 2025-04-17T18:09:04.675Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-79 Description: The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain. User input for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known.
for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json - http://seclists.org/fulldisclosure/2024/Jan/3 - http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html
CVE ID: CVE-2023-29050 State: PUBLISHED Published: 2024-01-08T08:51:40.489Z Last Updated: 2024-08-26T18:42:52.971Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-90 Description: The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP qu
ng to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json - http://seclists.org/fulldisclosure/2024/Jan/3 - http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html
CVE ID: CVE-2023-29051 State: PUBLISHED Published: 2024-01-08T09:04:31.561Z Last Updated: 2025-11-04T18:14:32.761Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-284 Description: User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users and contexts. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the
s. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json
CVE ID: CVE-2023-29052 State: PUBLISHED Published: 2024-01-08T09:04:35.617Z Last Updated: 2025-11-04T18:14:34.110Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-79 Description: Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json
CVE ID: CVE-2023-29053 State: PUBLISHED Published: 2023-04-11T09:03:07.730Z Last Updated: 2025-02-26T21:06:46.463Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: JT Open, JT Utilities Problem Types: CWE-125 Description: A vulnerability has been identified in JT Open (All versions < V11.3.2.0), JT Utilities (All versions < V13.3.0.0). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
de in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-642810.pdf
CVE ID: CVE-2023-29054 State: PUBLISHED Published: 2023-04-11T09:03:08.813Z Last Updated: 2025-02-07T16:49:26.184Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H/E:P/RL:U/RC:C) Vendors: Siemens Products: SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X202-2P IRT, SCALANCE X202-2P IRT PRO, SCALANCE X204IRT, SCALANCE X204IRT PRO, SCALANCE XF201-3P IRT, SCALANCE XF202-2P IRT, SCALANCE XF204-2BA IRT, SCALANCE XF204IRT, SIPLUS NET SCALANCE X202-2P IRT Problem Types: CWE-326 Description: A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALA
has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SIPLUS NET SCALANCE X202-2P IRT (All
E XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SIPLUS NET SCALANCE X202-2P IRT (All versions < V5.5.2). The SSH server on affected devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-479249.pdf
CVE ID: CVE-2023-29055 State: PUBLISHED Published: 2024-01-29T12:20:55.147Z Last Updated: 2025-06-20T19:41:27.944Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: CWE-522 Description: In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.properties and potentially the containing credentials. To avoid this threat, users are recommended to * Always turn on HTTPS so that network pay
ly the containing credentials. To avoid this threat, users are recommended to * Always turn on HTTPS so that network payload is encrypted. * Avoid putting credentials in kylin.properties, or at least not in plain text. * Use network firewalls to protect the serverside such that it is not accessible to external attackers. * Upgrade to version Apache Kylin 4.0.4, which filters out the sensitive content that goes to the Server Config web interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/o1bvyv9wnfkx7dxpfjlor20nykgsoh6r - http://www.openwall.com/lists/oss-security/2024/01/29/1
CVE ID: CVE-2023-29056 State: PUBLISHED Published: 2023-04-28T21:07:40.439Z Last Updated: 2025-01-30T18:26:37.319Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Lenovo Products: XClarity Controller Problem Types: CWE-269 Description: A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-118321
CVE ID: CVE-2023-29057 State: PUBLISHED Published: 2023-04-28T20:53:13.267Z Last Updated: 2025-01-30T18:34:12.946Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: Lenovo Products: XClarity Controller Problem Types: CWE-276 Description: A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LE
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-118321
CVE ID: CVE-2023-29058 State: PUBLISHED Published: 2023-04-28T20:47:46.172Z Last Updated: 2025-01-30T18:49:28.930Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H) Vendors: Lenovo Products: XClarity Controller Problem Types: CWE-276 Description: A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-118321
CVE ID: CVE-2023-29059 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-05-05T16:01:52.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: 3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 of the 3CX DesktopApp Electron macOS application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/506.html - https://www.3cx.com/blog/news/desktopapp-security-alert
References: - https://cwe.mitre.org/data/definitions/506.html - https://www.3cx.com/blog/news/desktopapp-security-alert/ - https://www.fortinet.com/blog/threat-research/3cx-desktop-app-compromised - https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats - https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/ - https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/
CVE ID: CVE-2023-29060 State: PUBLISHED Published: 2023-11-28T20:07:00.245Z Last Updated: 2025-06-03T13:56:46.453Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Becton, Dickinson and Company (BD) Products: FACSChorus Problem Types: CWE-1299 Description: The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus
Container: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software
CVE ID: CVE-2023-29061 State: PUBLISHED Published: 2023-11-28T20:33:44.065Z Last Updated: 2025-06-03T13:56:04.911Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Becton, Dickinson and Company (BD) Products: FACSChorus Problem Types: CWE-306 Description: There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to access the BIOS configuration and modify the drive boot order and BIOS pre-boot authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facscho
am Container: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software