Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-39444 State: PUBLISHED Published: 2024-01-08T14:47:40.483Z Last Updated: 2025-11-04T18:16:33.552Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-119 Description: Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the string copy loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosin
ing copy loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1826 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-39445 State: PUBLISHED Published: 2023-08-18T09:40:17.145Z Last Updated: 2024-10-08T15:11:13.950Z Vendors: LOGITEC CORPORATION Products: LAN-WH300N/RE Problem Types: Hidden Functionality Description: Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execute arbitrary code by sending a specially crafted file to the product's certain management console. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20230810-01/ - https://jvn.jp/en/vu/JVNVU91630351/
CVE ID: CVE-2023-39446 State: PUBLISHED Published: 2023-09-18T20:02:40.767Z Last Updated: 2024-09-24T18:13:14.700Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H) Vendors: Socomec Products: MODULYS GP (MOD3GP-SY-120K) Problem Types: CWE-352 Description: Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE ID: CVE-2023-39447 State: PUBLISHED Published: 2023-10-10T12:32:21.469Z Last Updated: 2024-09-18T20:35:21.196Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-532 Description: When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K47756555
CVE ID: CVE-2023-39448 State: PUBLISHED Published: 2023-09-05T08:28:06.883Z Last Updated: 2024-09-30T15:46:01.328Z Vendors: SHIRASAGI Project Products: SHIRASAGI Problem Types: Path traversal Description: Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arbitrary files on the server, resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ss-proj.org/support/954.html - https://jvn.jp/en/jp/JVN82758000/
CVE ID: CVE-2023-39450 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:03:07.141Z Description: No description available.
CVE ID: CVE-2023-39452 State: PUBLISHED Published: 2023-09-18T20:01:05.148Z Last Updated: 2024-09-25T15:34:56.243Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Socomec Products: MODULYS GP (MOD3GP-SY-120K) Problem Types: CWE-256 Description: The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
CVE ID: CVE-2023-39453 State: PUBLISHED Published: 2023-09-25T15:22:33.134Z Last Updated: 2025-11-04T19:17:43.196Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Accusoft Products: ImageGear Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. An attacker can deliver this file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1830
CVE ID: CVE-2023-39454 State: PUBLISHED Published: 2023-08-18T09:41:14.665Z Last Updated: 2025-07-03T14:02:46.054Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ELECOM CO.,LTD. Products: WRC-X1800GS-B, WRC-X1800GSA-B, WRC-X1800GSH-B, WRC-X6000QS-G, WRC-X6000QSA-G Problem Types: CWE-120 Description: Buffer overflow vulnerability exists in ELECOM wireless LAN routers, which may allow an unauthenticated attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20230711-01/ - https://jvn.jp/en/vu/JVNVU91630351/
CVE ID: CVE-2023-39455 State: PUBLISHED Published: 2023-08-18T09:42:19.491Z Last Updated: 2024-08-02T18:10:20.649Z Vendors: ELECOM CO.,LTD. Products: WRC-600GHBK-A, WRC-1467GHBK-A, WRC-1900GHBK-A, WRC-733FEBK2-A, WRC-F1167ACF2, WRC-1467GHBK-S, WRC-1900GHBK-S Problem Types: OS command injection Description: OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request. Affected products and versions are as follows: WRC-600GHBK-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-F1167ACF2 all versions, WRC-1467GHBK-S all versions, and
, WRC-1900GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-F1167ACF2 all versions, WRC-1467GHBK-S all versions, and WRC-1900GHBK-S all versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.elecom.co.jp/news/security/20230810-01/ - https://jvn.jp/en/vu/JVNVU91630351/
CVE ID: CVE-2023-39456 State: PUBLISHED Published: 2023-10-17T06:58:17.515Z Last Updated: 2025-06-12T15:10:53.829Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/me
h42mxfsn8l1wy6o41xwhsjlsd87q - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ - https://www.debian.org/security/2023/dsa-5549
CVE ID: CVE-2023-39457 State: PUBLISHED Published: 2024-05-03T01:59:22.050Z Last Updated: 2024-08-02T18:10:20.768Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-306 Description: Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists due to the lack of user authentication. The issue results from missing authentication in the default system configu
ists due to the lack of user authentication. The issue results from missing authentication in the default system configuration. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-20501. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1025/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39458 State: PUBLISHED Published: 2024-05-03T01:59:22.784Z Last Updated: 2024-08-02T18:10:20.663Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-798 Description: Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of certificates. The service uses a hard-coded default SSL
s vulnerability. The specific flaw exists within the handling of certificates. The service uses a hard-coded default SSL certificate. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20509. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1026/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39459 State: PUBLISHED Published: 2024-05-03T01:59:23.567Z Last Updated: 2024-08-02T18:10:20.767Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-22 Description: Triangle MicroWorks SCADA Data Gateway Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of wor
t the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of workspace files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of Administrator. Was ZDI-CAN-20531. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1027/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39460 State: PUBLISHED Published: 2024-05-03T01:59:24.376Z Last Updated: 2024-08-02T18:10:20.445Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-22 Description: Triangle MicroWorks SCADA Data Gateway Event Log Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the creation of event
nerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the creation of event logs. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-20534. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1028/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39461 State: PUBLISHED Published: 2024-05-03T01:59:25.080Z Last Updated: 2024-08-02T18:10:20.704Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-117 Description: Triangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to write arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th
to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of event logs. The issue results from improper sanitization of log output. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-20535. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1029/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39462 State: PUBLISHED Published: 2024-05-03T01:59:25.792Z Last Updated: 2024-08-02T18:10:20.821Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-434 Description: Triangle MicroWorks SCADA Data Gateway Workspace Unrestricted Upload Vulnerability. This vulnerability allows remote attackers to upload arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of workspace files. The iss
ing authentication mechanism can be bypassed. The specific flaw exists within the processing of workspace files. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this in conjunction with other vulnerabilitites to execute arbitrary code in the context of root. Was ZDI-CAN-20536. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1030/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39463 State: PUBLISHED Published: 2024-05-03T01:59:26.598Z Last Updated: 2024-08-02T18:10:20.694Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-434 Description: Triangle MicroWorks SCADA Data Gateway Trusted Certification Unrestricted Upload of File Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th
to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the trusted certification feature. The issue lies in the handling of the OpcUaSecurityCertificateAuthorityTrustDir variable, which allows an arbitrary file write with attacker-controlled data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20537. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1031/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39464 State: PUBLISHED Published: 2024-05-03T01:59:27.382Z Last Updated: 2024-08-02T18:10:20.680Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-428 Description: Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of
lnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the GTWWebMonitorService service. The path to the service executable contains spaces not surrounded by quotations. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-20538. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1032/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39465 State: PUBLISHED Published: 2024-05-03T01:59:28.085Z Last Updated: 2024-08-02T18:10:21.061Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-321 Description: Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TmwCrypto class. The issue results from the usage of a hard-code
this vulnerability. The specific flaw exists within the TmwCrypto class. The issue results from the usage of a hard-coded cryptograhic key and the usage of a hard-coded certificate. An attacker can leverage this vulnerability to disclose sensitive information. Was ZDI-CAN-20615. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1033/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39466 State: PUBLISHED Published: 2024-05-03T01:59:28.811Z Last Updated: 2024-08-02T18:10:20.933Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-306 Description: Triangle MicroWorks SCADA Data Gateway get_config Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the get_config endpoint. The issue results from the lack of authent
this vulnerability. The specific flaw exists within the get_config endpoint. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose sensitive information. Was ZDI-CAN-20797. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1034/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39467 State: PUBLISHED Published: 2024-05-03T01:59:29.616Z Last Updated: 2024-08-02T18:10:20.678Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-219 Description: Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of certificate web directory. The issue results from the exposure of se
he specific flaw exists within the configuration of certificate web directory. The issue results from the exposure of sensitive information in the application webroot. An attacker can leverage this vulnerability to disclose sensitive information. Was ZDI-CAN-20798. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1035/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39468 State: PUBLISHED Published: 2024-05-03T01:59:30.325Z Last Updated: 2024-08-02T18:10:20.697Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Triangle MicroWorks Products: SCADA Data Gateway Problem Types: CWE-749 Description: Triangle MicroWorks SCADA Data Gateway DbasSectorFileToExecuteOnReset Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of DbasSectorFileToExecuteOnReset parameter.
o exploit this vulnerability. The specific flaw exists within the handling of DbasSectorFileToExecuteOnReset parameter. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20799. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1036/ - https://www.trianglemicroworks.com/products/scada-data-gateway/what's-new
CVE ID: CVE-2023-39469 State: PUBLISHED Published: 2024-05-03T01:59:31.060Z Last Updated: 2024-08-02T18:10:20.806Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: PaperCut Products: NG Problem Types: CWE-94 Description: PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability. The specific flaw exists within the External User Lookup functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute Java code. An at
e issue results from the lack of proper validation of a user-supplied string before using it to execute Java code. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21013. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1285/ - https://www.papercut.com/kb/Main/SecurityBulletinJuly2023/