Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e (MITM) attack, intercepting and potentially altering communications between the user and the website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/insecure-trust-of-basic-constraints-certificate-in-bitdefender-total-security-https-scanning-va-11210/
CVE ID: CVE-2023-49572 State: PUBLISHED Published: 2024-05-24T12:39:32.532Z Last Updated: 2025-05-21T11:25:06.488Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Flexense Products: VX Search Enterprise, Disk Pulse Enterprise Problem Types: CWE-79 Description: A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_odbc in odbc_data_source, odbc_user and odbc_password parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads. Addit
could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise
CVE ID: CVE-2023-49573 State: PUBLISHED Published: 2024-05-24T12:39:56.943Z Last Updated: 2024-08-02T22:01:25.701Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Flexense Products: VX Search Enterprise Problem Types: CWE-79 Description: A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /add_command_action in action_value. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es
e loads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise
CVE ID: CVE-2023-49574 State: PUBLISHED Published: 2024-05-24T12:40:10.823Z Last Updated: 2024-08-02T22:01:24.745Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Flexense Products: VX Search Enterprise Problem Types: CWE-79 Description: A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /add_job in job_name. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise
CVE ID: CVE-2023-49575 State: PUBLISHED Published: 2024-05-24T12:40:24.398Z Last Updated: 2025-05-21T11:26:56.297Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Flexense Products: VX Search Enterprise, Sync Breeze Enterprise Server, Disk Pulse Enterprise Problem Types: CWE-79 Description: A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, in Sync Breeze Enterprise Server 10.4.18 version, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker
p in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise
CVE ID: CVE-2023-49577 State: PUBLISHED Published: 2023-12-12T01:04:03.771Z Last Updated: 2024-08-02T22:01:25.526Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP HCM (SMART PAYE solution) Problem Types: CWE-79 Description: The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/note
d integrity of the application. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3217087 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-49578 State: PUBLISHED Published: 2023-12-12T01:08:32.245Z Last Updated: 2024-10-09T13:25:33.422Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: SAP_SE Products: SAP Cloud Connector Problem Types: CWE-732 Description: SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious request which leads to low impact on the availability and no impact on confidentiality or Integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3362463 - https://www.sap.com/documents
ogram Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3362463 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-49580 State: PUBLISHED Published: 2023-12-12T01:09:55.716Z Last Updated: 2024-09-28T22:14:46.907Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP_SE Products: SAP GUI for Windows and SAP GUI for Java Problem Types: CWE-732 Description: SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to create Layout configurations of the ABAP List Viewer and with this causing a mild impact on integrity and availability
o create Layout configurations of the ABAP List Viewer and with this causing a mild impact on integrity and availability, e.g. also increasing the response times of the AS ABAP. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3385711 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-49581 State: PUBLISHED Published: 2023-12-12T01:10:14.702Z Last Updated: 2024-08-02T22:01:25.898Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP and ABAP Platform Problem Types: CWE-89 Description: SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability. Additional Analyst Notes: - CV
ker could increase response times of the AS ABAP, leading to mild impact on availability. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3392547 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-49582 State: PUBLISHED Published: 2024-08-26T14:03:44.588Z Last Updated: 2025-03-13T14:25:56.517Z Vendors: Apache Software Foundation Products: Apache Portable Runtime (APR) Problem Types: CWE-732 Description: Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR version 1.7.5, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.a
es this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/sntjc04t1rvjhdzz2tzmtz2zdnmv7dc4
CVE ID: CVE-2023-49583 State: PUBLISHED Published: 2023-12-12T01:22:58.910Z Last Updated: 2024-09-28T22:15:23.358Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: @sap/xssec Problem Types: CWE-749 Description: SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3411067 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.h
ences: - https://me.sap.com/notes/3411067 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://www.npmjs.com/package/@sap/xssec - https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/ - https://me.sap.com/notes/3412456 - https://me.sap.com/notes/3413475
CVE ID: CVE-2023-49584 State: PUBLISHED Published: 2023-12-12T01:35:22.515Z Last Updated: 2025-05-24T10:27:48.125Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Fiori Launchpad Problem Types: CWE-444 Description: SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3406786 - https://www.sap.com/documents/2022/02/fa865ea4-167e-001
P Vulnrichment: References: - https://me.sap.com/notes/3406786 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-49587 State: PUBLISHED Published: 2023-12-12T01:35:53.057Z Last Updated: 2024-11-26T14:33:19.513Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Solution Manager Problem Types: CWE-77 Description: SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3395306 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-49588 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:18:42.672Z Description: No description available.
CVE ID: CVE-2023-49589 State: PUBLISHED Published: 2024-01-10T15:48:09.137Z Last Updated: 2025-11-04T18:19:41.694Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-640 Description: An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to an arbitrary user password recovery. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/T
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1896
CVE ID: CVE-2023-49590 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:18:43.181Z Description: No description available.
CVE ID: CVE-2023-49593 State: PUBLISHED Published: 2024-07-08T15:22:29.162Z Last Updated: 2025-11-04T17:13:19.140Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: LevelOne Products: WBR-6013 Problem Types: CWE-489 Description: Leftover debug code exists in the boa formSysCmd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A specially crafted network request can lead to arbitrary command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1873
CVE ID: CVE-2023-49594 State: PUBLISHED Published: 2023-12-23T20:04:48.013Z Last Updated: 2025-11-04T18:19:42.906Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: instipod Products: DuoUniversalKeycloakAuthenticator Problem Types: CWE-201 Description: An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin triggers this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
gin triggers this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1907 - https://github.com/instipod/DuoUniversalKeycloakAuthenticator/releases/tag/1.0.8
CVE ID: CVE-2023-49595 State: PUBLISHED Published: 2024-07-08T15:22:27.092Z Last Updated: 2025-11-04T17:13:20.513Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: LevelOne, Realtek Products: WBR-6013, rtl819x Jungle SDK Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the boa rollback_control_code functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence
ity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1878
CVE ID: CVE-2023-49598 State: PUBLISHED Published: 2023-12-26T07:21:02.611Z Last Updated: 2024-08-02T22:01:25.946Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cross-site scripting (XSS) Description: Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product. Additional Analyst Notes: - CVE Program Container: References: - https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/ - https://jvn.jp/en/jp/JVN18715935/
CVE ID: CVE-2023-49599 State: PUBLISHED Published: 2024-01-10T15:48:07.636Z Last Updated: 2025-11-04T18:19:44.073Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-331 Description: An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline, leading to forging a legitimate password recovery code for the admin user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric
itimate password recovery code for the admin user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1900
CVE ID: CVE-2023-49600 State: PUBLISHED Published: 2024-05-28T14:02:42.497Z Last Updated: 2025-02-13T17:18:43.745Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: libigl Products: libigl Problem Types: CWE-122 Description: An out-of-bounds write vulnerability exists in the PlyFile ply_cast_ascii functionality of libigl v2.5.0. A specially crafted .ply file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1879 - https://www.talosintelligence.com/vulnera
ences: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1879 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1879
CVE ID: CVE-2023-49602 State: PUBLISHED Published: 2024-03-04T06:19:09.503Z Last Updated: 2024-08-12T13:41:57.262Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-843, CWE-125 Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through type confusion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md
CVE ID: CVE-2023-49603 State: PUBLISHED Published: 2025-02-12T21:20:17.394Z Last Updated: 2025-02-18T19:54:43.626Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) System Security Report and System Resources Defense firmware Problem Types: Escalation of Privilege, CWE-362 Description: Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01203.html
CVE ID: CVE-2023-49604 State: REJECTED Published: N/A Last Updated: 2025-05-28T21:32:06.756Z Description: No description available.
CVE ID: CVE-2023-49606 State: PUBLISHED Published: 2024-05-01T15:31:01.499Z Last Updated: 2025-11-04T17:13:21.882Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tinyproxy Products: Tinyproxy Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
HTTP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889 - http://www.openwall.com/lists/oss-security/2024/05/07/1
CVE ID: CVE-2023-49607 State: PUBLISHED Published: 2023-12-12T08:21:36.568Z Last Updated: 2024-08-02T22:01:26.012Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-754 Description: Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog. Additional Analyst Notes: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-49609 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:18:44.941Z Description: No description available.
CVE ID: CVE-2023-49610 State: PUBLISHED Published: 2024-02-01T22:35:12.834Z Last Updated: 2024-10-17T16:03:08.150Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: MachineSense Products: FeverWarn Problem Types: CWE-20 Description: MachineSense FeverWarn Raspberry Pi-based devices lack input sanitization, which could allow an attacker on an adjacent network to send a message running commands or could overflow the stack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01 - https://machinesense.com/pages/about-machinesense
CVE ID: CVE-2023-49611 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:18:45.559Z Description: No description available.
CVE ID: CVE-2023-49614 State: PUBLISHED Published: 2024-05-16T20:47:09.618Z Last Updated: 2024-08-15T15:18:44.089Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: n/a Products: Intel(R) FPGA products Problem Types: information disclosure, escalation of privilege, CWE-787 Description: Out of bounds write in firmware for some Intel(R) FPGA products before version 2.9.0 may allow escalation of privilege and information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01050.html
CVE ID: CVE-2023-49615 State: PUBLISHED Published: 2025-02-12T21:20:18.920Z Last Updated: 2025-02-18T19:54:33.795Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) System Security Report and System Resources Defense firmware Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01203.html
CVE ID: CVE-2023-49617 State: PUBLISHED Published: 2024-02-01T22:26:29.123Z Last Updated: 2025-06-06T17:26:50.942Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: MachineSense Products: FeverWarn Problem Types: CWE-306 Description: The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attacker could retrieve and modify sensitive information without any authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01 - https://machinesense.com/pages/about-machinesense
CVE ID: CVE-2023-49618 State: PUBLISHED Published: 2025-02-12T21:20:20.502Z Last Updated: 2025-02-18T19:54:24.167Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) System Security Report and System Resources Defense firmware Problem Types: Escalation of Privilege, CWE-119 Description: Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01203.html