Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-27980 State: PUBLISHED Published: 2023-03-21T00:00:00.000Z Last Updated: 2025-02-05T20:05:44.377Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server(IGSSdataServer.exe), IGSS Dashboard (DashBoard.exe), Custom Reports (RMS16.dll) Problem Types: CWE-306 Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious report file in the IGSS project report directory, this could lead to remote code execution when a victim eventually opens the report. Affected Products: IGSS Data Server(IGSSdataServer.exe
remote code execution when a victim eventually opens the report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf
CVE ID: CVE-2023-27981 State: PUBLISHED Published: 2023-03-21T00:00:00.000Z Last Updated: 2025-02-05T20:05:37.369Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server(IGSSdataServer.exe), IGSS Dashboard (DashBoard.exe), Custom Reports (RMS16.dll) Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code execution when a victim tries to open a malicious report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom R
ta Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf
CVE ID: CVE-2023-27982 State: PUBLISHED Published: 2023-03-21T00:00:00.000Z Last Updated: 2025-02-05T20:05:29.007Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server(IGSSdataServer.exe), IGSS Dashboard (DashBoard.exe), Custom Reports (RMS16.dll) Problem Types: CWE-345 Description: A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS project report directory, when an attacker sends specific crafted messages to the Data Server TCP port, this could lead to remote code execution when a victim eventually opens a malici
d messages to the Data Server TCP port, this could lead to remote code execution when a victim eventually opens a malicious dashboard file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf
CVE ID: CVE-2023-27983 State: PUBLISHED Published: 2023-03-21T00:00:00.000Z Last Updated: 2025-02-05T20:05:21.731Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Schneider Electric Products: IGSS Data Server(IGSSdataServer.exe), IGSS Dashboard (DashBoard.exe), Custom Reports (RMS16.dll) Problem Types: CWE-306 Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSS project report directory, this would lead to loss of data when an attacker abuses this functionality. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prio
en an attacker abuses this functionality. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf
CVE ID: CVE-2023-27984 State: PUBLISHED Published: 2023-03-21T00:00:00.000Z Last Updated: 2025-02-05T20:05:14.263Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server(IGSSdataServer.exe), IGSS Dashboard (DashBoard.exe), Custom Reports (RMS16.dll) Problem Types: CWE-20 Description: A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to remote code execution when a user opens a malicious report file planted by an attacker. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0
r. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf
CVE ID: CVE-2023-27985 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-03-05T16:57:02.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2023/03/08/2 - http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=d32091199ae5de590a83f1542a01d75fba000467 - https://debbugs.gnu.org/cgi/bugreport.cgi?bug
emacs.git/commit/?h=emacs-29&id=d32091199ae5de590a83f1542a01d75fba000467 - https://debbugs.gnu.org/cgi/bugreport.cgi?bug=60204 - http://www.openwall.com/lists/oss-security/2023/03/09/1 - https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/
CVE ID: CVE-2023-27986 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-03-05T17:06:50.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2023/03/08/2 - http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=3c1693d08b0a71d40a77e7b40c0ebc42dca2d2cc - http://www.openwall.com/lists/oss-security/2023/03/09/1 - https://www.gabriel.u
1693d08b0a71d40a77e7b40c0ebc42dca2d2cc - http://www.openwall.com/lists/oss-security/2023/03/09/1 - https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/
CVE ID: CVE-2023-27987 State: PUBLISHED Published: 2023-04-10T07:37:07.558Z Last Updated: 2024-10-17T20:20:41.204Z Vendors: Apache Software Foundation Products: Apache Linkis Problem Types: CWE-326 Description: In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization[1] https://linkis.apache.org/docs/latest/auth/token https://linkis.apache.org/docs/latest/auth/token Additional Analyst Notes: - C
/linkis.apache.org/docs/latest/auth/token https://linkis.apache.org/docs/latest/auth/token Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/3cr1cz3210wzwngldwrqzm43vwhghp0p - https://www.openwall.com/lists/oss-security/2023/04/10/3
CVE ID: CVE-2023-27988 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-14T16:26:24.864Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NAS326 firmware Problem Types: CWE-78 Description: The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-fo
A ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products
CVE ID: CVE-2023-27989 State: PUBLISHED Published: 2023-06-05T11:02:54.929Z Last Updated: 2025-01-08T17:19:22.830Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: NR7101 firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the CGI program of the Zyxel NR7101 firmware versions prior to V1.00(ABUV.8)C0 could allow a remote authenticated attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-f
SA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-4g-lte-and-5g-nr-outdoor-routers
CVE ID: CVE-2023-27990 State: PUBLISHED Published: 2023-04-24T00:00:00 Last Updated: 2024-08-02T12:23:30.803Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) firmware, USG20(W)-VPN firmware, VPN series firmware Problem Types: CWE-79 Description: The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticate
rmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls
CVE ID: CVE-2023-27991 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T16:47:55.646Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) firmware, USG20(W)-VPN firmware, VPN series firmware Problem Types: CWE-78 Description: The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35,
.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker to execute some OS commands remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls
CVE ID: CVE-2023-27992 State: PUBLISHED Published: 2023-06-19T11:42:41.774Z Last Updated: 2025-10-21T23:05:45.675Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NAS326 firmware, NAS540 firmware, NAS542 firmware Problem Types: CWE-78 Description: The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request. Additional Analyst Notes: - CVE Program Co
me operating system (OS) commands remotely by sending a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products
CVE ID: CVE-2023-27993 State: PUBLISHED Published: 2023-05-03T21:26:44.359Z Last Updated: 2024-10-22T20:46:48.661Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-23 Description: A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-069
CVE ID: CVE-2023-27995 State: PUBLISHED Published: 2023-04-11T16:05:43.728Z Last Updated: 2024-10-23T14:30:21.861Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X) Vendors: Fortinet Products: FortiSOAR Problem Types: CWE-1336 Description: A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute arbitrary code via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-051
CVE ID: CVE-2023-27997 State: PUBLISHED Published: 2023-06-13T08:41:47.415Z Last Updated: 2025-10-21T23:05:46.296Z Severity: CRITICAL (CVSS 9.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R) Vendors: Fortinet Products: FortiOS-6K7K, FortiProxy, FortiOS Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically
ons, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-097
CVE ID: CVE-2023-27998 State: PUBLISHED Published: 2023-09-13T12:29:15.591Z Last Updated: 2024-09-25T17:26:14.202Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:X/RC:C) Vendors: Fortinet Products: FortiPresence Problem Types: CWE-756 Description: A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow an unauthenticated attacker with the ability to navigate to the login GUI to gain sensitive information via navigating to specific HTTP(s) paths. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-288
CVE ID: CVE-2023-27999 State: PUBLISHED Published: 2023-05-03T21:26:40.680Z Last Updated: 2024-10-23T14:28:03.856Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-297
CVE ID: CVE-2023-28000 State: PUBLISHED Published: 2023-06-13T08:41:47.901Z Last Updated: 2024-10-23T14:26:03.944Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R) Vendors: Fortinet Products: FortiADC Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.0 through 6.2.4, 6.1 all versions, 6.0 all versions may allow a local and authenticated attacker to execute unauthorized commands via specifically crafted arguments in diagnose system df CLI command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
n diagnose system df CLI command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-107
CVE ID: CVE-2023-28001 State: PUBLISHED Published: 2023-07-11T16:52:46.709Z Last Updated: 2024-10-22T20:41:43.447Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiOS Problem Types: CWE-613 Description: An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-028
CVE ID: CVE-2023-28002 State: PUBLISHED Published: 2023-11-14T18:05:12.283Z Last Updated: 2025-06-11T14:23:35.801Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-354 Description: An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesystem integrity check in place. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
esystem integrity check in place. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-396
CVE ID: CVE-2023-28003 State: PUBLISHED Published: 2023-04-18T20:43:50.362Z Last Updated: 2025-02-05T21:23:55.818Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Power Monitoring Expert Problem Types: CWE-613 Description: A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate user has signed out of their account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-01&p_enDocType=Security+and
ichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-01.pdf
CVE ID: CVE-2023-28004 State: PUBLISHED Published: 2023-04-18T21:16:01.333Z Last Updated: 2024-08-02T12:23:30.800Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: PowerLogic HDPM6000 Problem Types: CWE-129 Description: A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted Ethernet request could result in denial of service or remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-02.pdf
CVE ID: CVE-2023-28005 State: PUBLISHED Published: 2023-03-14T21:51:21.908Z Last Updated: 2025-05-05T16:02:55.834Z Vendors: Trend Micro, Inc. Products: Trend Micro Endpoint Encryption Full Disk Encryption Problem Types: n/a Description: A vulnerability in Trend Micro Endpoint Encryption Full Disk Encryption version 6.0.0.3204 and below could allow an attacker with physical access to an affected device to bypass Microsoft Windows� Secure Boot process in an attempt to execute other attacks to obtain access to the contents of the device. An attacker must first obtain physical access to the target system in order to exploit this vulnerability. It is also important to note that the contents of th
access to the target system in order to exploit this vulnerability. It is also important to note that the contents of the drive(s) encrypted with TMEE FDE would still be protected and would NOT be accessible by the attacker by exploitation of this vulnerability alone. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000292473
CVE ID: CVE-2023-28006 State: PUBLISHED Published: 2023-06-22T22:07:58.142Z Last Updated: 2024-12-05T17:21:01.968Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: HCL BigFix OSD Bare Metal Server Description: The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105601
CVE ID: CVE-2023-28008 State: PUBLISHED Published: 2023-04-26T19:24:37.974Z Last Updated: 2025-01-30T21:29:33.785Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: HCL Software Products: Workload Automation Description: HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0104371
CVE ID: CVE-2023-28009 State: PUBLISHED Published: 2023-04-26T19:38:54.631Z Last Updated: 2025-01-30T21:29:13.323Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: Workload Automation Description: HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0104371