Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-35784 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-17T17:05:30.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/004_ssl.patch.sig - https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig - https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt - https://ftp.
s/7.2/common/026_ssl.patch.sig - https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt - https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt - https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54
CVE ID: CVE-2023-35785 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-08-02T16:30:45.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 and below, Eventlog Analyzer 12301 and below, Exchange Reporter Plus 5709 and below, Log360 5315 and below, Log360 UEBA 4045 and below, M365 Manager Plus 4529 and below, M365 Security Plus 4529 and below, Recovery Manager Plus 6061 and below, ServiceDesk Plus 14204 and below and 143xx 14302
65 Security Plus 4529 and below, Recovery Manager Plus 6061 and below, ServiceDesk Plus 14204 and below and 143xx 14302 and below, ServiceDesk Plus MSP 14300 and below, SharePoint Manager Plus 4402 and below, and Support Center Plus 14300 and below are vulnerable to 2FA bypass via a few TOTP authenticators. Note: A valid pair of username and password is required to leverage this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://manageengine.com - https://www.manageengine.com/security/advisory/CVE/CVE-2023-35785.html
CVE ID: CVE-2023-35786 State: PUBLISHED Published: 2023-07-05T00:00:00 Last Updated: 2024-11-22T15:44:28.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-35786.html
CVE ID: CVE-2023-35788 State: PUBLISHED Published: 2023-06-16T00:00:00.000Z Last Updated: 2025-05-05T15:57:20.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2023/06/07/1 - https://git.kernel.org/linus/4d56304e5827c8cc8cc18c75343d283af7c4825c - https://cdn.kernel.org/pub/linu
y/2023/06/07/1 - https://git.kernel.org/linus/4d56304e5827c8cc8cc18c75343d283af7c4825c - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.7 - http://www.openwall.com/lists/oss-security/2023/06/17/1 - https://www.debian.org/security/2023/dsa-5448 - https://security.netapp.com/advisory/ntap-20230714-0002/ - https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html - https://www.debian.org/security/2023/dsa-5480 - http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE ID: CVE-2023-35789 State: PUBLISHED Published: 2023-06-16T00:00:00.000Z Last Updated: 2025-03-30T01:30:27.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/alanxz/rabbitmq-c/issues/575 - https://github.com/alanxz/rabbitmq-c/pull/781
CVE ID: CVE-2023-35790 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-17T17:02:35.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in dec_patch_dictionary.cc in libjxl before 0.8.2. An integer underflow in patch decoding can lead to a denial of service, such as an infinite loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libjxl/libjxl/releases/tag/v0.8.2 - https://github.com/libjxl/libjxl/pull/2551
CVE ID: CVE-2023-35791 State: PUBLISHED Published: 2023-07-31T00:00:00.000Z Last Updated: 2025-05-30T16:02:48.331Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Vound Intella Connect 2.6.0.3 has an Open Redirect vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2023-35791 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-35791
CVE ID: CVE-2023-35792 State: PUBLISHED Published: 2023-07-31T00:00:00.000Z Last Updated: 2025-05-30T16:02:46.462Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2023-35792 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-35792
CVE ID: CVE-2023-35793 State: PUBLISHED Published: 2023-09-26T00:00:00 Last Updated: 2024-08-02T16:30:45.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cassia Access Controller 2.1.1.2303271039. Establishing a web SSH session to gateways is vulnerable to Cross Site Request Forgery (CSRF) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.cassianetworks.com/products/iot-access-controller/ - https://github.com/Dodge-MPTC/CVE-2023-35793-CSRF-On-Web-SSH - https://blog.kscsc.online/cves/202335793/md.html
CVE ID: CVE-2023-35794 State: PUBLISHED Published: 2023-10-27T00:00:00 Last Updated: 2024-08-02T16:30:45.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only Basic Authentication to the SSH console. Additional Analyst Notes: - CVE Program Container: References: - https://www.cassianetworks.com/products/iot-access-controller/ - https://github.com/Dodge-MPTC/CVE-2023-35794-WebSSH-Hijacking - https://blog.kscsc.online/cves/202335
cess-controller/ - https://github.com/Dodge-MPTC/CVE-2023-35794-WebSSH-Hijacking - https://blog.kscsc.online/cves/202335794/md.html
CVE ID: CVE-2023-35796 State: PUBLISHED Published: 2023-10-10T10:21:20.721Z Last Updated: 2024-09-19T14:28:45.193Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Siemens Products: SINEMA Server V14 Problem Types: CWE-79 Description: A vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could perform a stored cross-site scripting (XSS) attack that may lead to arbitrary code execution with `SYSTEM` privileges on the application server. (ZDI-CAN-19823) Additional Analyst Not
d to arbitrary code execution with `SYSTEM` privileges on the application server. (ZDI-CAN-19823) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-594373.pdf
CVE ID: CVE-2023-35797 State: PUBLISHED Published: 2023-07-03T09:08:53.795Z Last Updated: 2025-02-13T16:55:55.149Z Vendors: Apache Software Foundation Products: Apache Airflow Apache Hive Provider Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details. It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability. Additional Analyst Notes: -
It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/31983 - https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y - http://www.openwall.com/lists/oss-security/2023/07/12/3
CVE ID: CVE-2023-35798 State: PUBLISHED Published: 2023-06-27T11:39:51.759Z Last Updated: 2024-10-07T18:25:05.749Z Vendors: Apache Software Foundation Products: Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Problem Types: CWE-20 Description: Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it. This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: bef
nection to exploit it. This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1. It is recommended to upgrade to a version that is not affected Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/31984 - https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj
CVE ID: CVE-2023-35799 State: PUBLISHED Published: 2023-06-27T00:00:00 Last Updated: 2024-12-02T21:35:59.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.stormshield.eu - https://advisories.stormshield.eu/2023-022/
CVE ID: CVE-2023-35800 State: PUBLISHED Published: 2023-06-27T00:00:00 Last Updated: 2024-12-02T21:36:25.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved to administrators. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.stormshield.eu - https://advisories.stormshield.eu/2023-021/
CVE ID: CVE-2023-35801 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-11-29T19:33:18.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a network-based resource connection, resulting in the unauthorized reading and writing of arbitrary files. Successful exploitation requires an attacker to have access to a user account with write privileges. FME Flow 2023.0 is also a fixed version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.safe.com/s/ - https://downloads.safe.com/
VE Program Container: - CISA ADP Vulnrichment: References: - https://community.safe.com/s/ - https://downloads.safe.com/fme/2023/whatsnew_server_2023_0_0_3.txt - https://community.safe.com/s/article/Known-Issue-FME-Flow-Directory-Traversal-Vulnerability
CVE ID: CVE-2023-35802 State: PUBLISHED Published: 2023-07-15T00:00:00 Last Updated: 2024-10-30T18:24:42.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploited to obtain elevated privileges to conduct remote code execution. Access to the internal management interface/subnet is required to conduct the exploit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://extremeportal.force.com/ExtrArticleDetail?an=000112741
CVE ID: CVE-2023-35803 State: PUBLISHED Published: 2023-10-04T00:00:00 Last Updated: 2024-09-20T13:34:09.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2023-067-iq-engine-acsd-service-buffer-overflow-cve-2023/ba-p/96472
CVE ID: CVE-2023-35808 State: PUBLISHED Published: 2023-06-17T00:00:00 Last Updated: 2024-12-17T16:28:18.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using crafted requests, custom PHP code can be injected and executed through the Notes module because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sugarc
fected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-006/ - http://seclists.org/fulldisclosure/2023/Aug/26 - http://packetstormsecurity.com/files/174300/SugarCRM-12.2.0-Shell-Upload.html
CVE ID: CVE-2023-35809 State: PUBLISHED Published: 2023-06-17T00:00:00 Last Updated: 2024-12-17T16:28:37.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sugarcrm.com/Resources/Security/su
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-007/ - http://seclists.org/fulldisclosure/2023/Aug/27 - http://packetstormsecurity.com/files/174301/SugarCRM-12.2.0-Bean-Manipulation.html
CVE ID: CVE-2023-35810 State: PUBLISHED Published: 2023-06-17T00:00:00 Last Updated: 2024-12-17T16:26:03.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has been identified in the DocuSign module. By using crafted requests, custom PHP code can be injected and executed through the DocuSign module because of missing input validation. Admin user privileges are required to exploit this vulnerability. Editions other than Enterprise are also affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://s
e are also affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-009/ - http://seclists.org/fulldisclosure/2023/Aug/28 - http://packetstormsecurity.com/files/174302/SugarCRM-12.2.0-PHP-Object-Injection.html
CVE ID: CVE-2023-35811 State: PUBLISHED Published: 2023-06-17T00:00:00 Last Updated: 2024-12-17T16:22:38.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using crafted requests, custom SQL code can be injected through the REST API because of missing input validation. Regular user privileges can use used for exploitation. Editions other than Enterprise are also affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-008/
Container: - CISA ADP Vulnrichment: References: - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-008/ - http://seclists.org/fulldisclosure/2023/Aug/29 - http://packetstormsecurity.com/files/174303/SugarCRM-12.2.0-SQL-Injection.html
CVE ID: CVE-2023-35812 State: PUBLISHED Published: 2024-04-03T00:00:00.000Z Last Updated: 2025-03-25T15:50:30.662Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:H/AV:N/A:N/C:N/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 within these specific packages. The fix had only covered cases where an absolute path is passed to scp. When a relative path is used, there is no verification that the name of a file received by the client matches the file requested. Fixed packages are available with numbers 7.4p1-22.78.amzn1 and 7.4p1-22.amzn2
by the client matches the file requested. Fixed packages are available with numbers 7.4p1-22.78.amzn1 and 7.4p1-22.amzn2.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://alas.aws.amazon.com/cve/html/CVE-2023-35812.html
CVE ID: CVE-2023-35813 State: PUBLISHED Published: 2023-06-17T00:00:00 Last Updated: 2024-12-17T16:20:49.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002979
CVE ID: CVE-2023-35814 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-28T15:56:00.337Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: DevExpress Products: DevExpress Problem Types: CWE-502 Description: DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 - https://code-white.com/public-vulnerability-list/ - https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-
bility-list/ - https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms - https://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-use - https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access
CVE ID: CVE-2023-35815 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-28T18:08:30.889Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: DevExpress Products: DevExpress Problem Types: CWE-502 Description: DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 - https://supportcenter.devexpress.com/ticket/details/t1159142/web-reporting-data-source-protection-bypassed-during-xml-deserialization - https://code-w
ss.com/ticket/details/t1159142/web-reporting-data-source-protection-bypassed-during-xml-deserialization - https://code-white.com/public-vulnerability-list/ - https://supportcenter.devexpress.com/ticket/details/t1141947/data-source-protection-bypass-during-xml-deserialization
CVE ID: CVE-2023-35816 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-28T18:08:07.672Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: DevExpress Products: DevExpress Problem Types: CWE-23 Description: DevExpress before 23.1.3 allows arbitrary TypeConverter conversion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 - https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization - https://code-white.com/public-vulnerability-list/ - https://suppo
op-and-web-controls-unsafe-data-type-deserialization - https://code-white.com/public-vulnerability-list/ - https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion
CVE ID: CVE-2023-35817 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-28T18:03:18.175Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: DevExpress Products: DevExpress Problem Types: CWE-918 Description: DevExpress before 23.1.3 allows AsyncDownloader SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 - https://supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration-can-lead-to-ssrf-attacks - https://supportcenter.devexpress.com/ticket/details/t11
server-improper-default-configuration-can-lead-to-ssrf-attacks - https://supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configuration-to-help-prevent-ssrf-attacks - https://code-white.com/public-vulnerability-list/ - https://supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloader
CVE ID: CVE-2023-35818 State: PUBLISHED Published: 2023-07-17T00:00:00 Last Updated: 2024-10-31T15:25:01.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit another behavior in the chip to gain unauthorized access to the ROM download mode. Access to ROM download mode may be further exploited to read the encrypted flash content in cleartext format or execute stub code. Additional Analyst No