Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-48635 State: PUBLISHED Published: 2023-12-13T13:30:56.939Z Last Updated: 2024-09-11T13:29:17.941Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: After Effects Problem Types: CWE-125 Description: Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
hat a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/after_effects/apsb23-75.html
CVE ID: CVE-2023-48636 State: PUBLISHED Published: 2023-12-13T13:46:04.820Z Last Updated: 2024-08-02T21:37:54.285Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Substance3D - Designer Problem Types: CWE-125 Description: Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References:
interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html
CVE ID: CVE-2023-48637 State: PUBLISHED Published: 2023-12-13T13:46:05.587Z Last Updated: 2024-08-02T21:37:54.414Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Substance3D - Designer Problem Types: CWE-125 Description: Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References:
CVE ID: CVE-2023-48638 State: PUBLISHED Published: 2023-12-13T13:46:07.130Z Last Updated: 2024-08-02T21:37:53.591Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Substance3D - Designer Problem Types: CWE-125 Description: Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References:
CVE ID: CVE-2023-48639 State: PUBLISHED Published: 2023-12-13T13:46:06.358Z Last Updated: 2024-09-11T13:25:14.384Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Designer Problem Types: CWE-787 Description: Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/
file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html
CVE ID: CVE-2023-48641 State: PUBLISHED Published: 2023-12-12T00:00:00 Last Updated: 2024-10-09T13:31:27.026Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:N/A:L/C:H/I:H/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. An authenticated malicious user in a multi-instance installation could potentially exploit this vulnerability by manipulating application resource references in user requests to bypass authorization checks, in order to gain execute access to AWF application resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
ute access to AWF application resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/711859
CVE ID: CVE-2023-48642 State: PUBLISHED Published: 2023-12-12T00:00:00 Last Updated: 2024-08-02T21:37:53.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release. Additional Analyst Notes: - CVE Program Container: References: - https://www.a
n. 6.14 (6.14.0) is also a fixed release. Additional Analyst Notes: - CVE Program Container: References: - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/711859
CVE ID: CVE-2023-48643 State: PUBLISHED Published: 2024-05-16T16:14:01.041Z Last Updated: 2025-02-13T15:46:57.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shrubbery tac_plus 2.x, 3.x. and 4.x through F4.0.4.28 allows unauthenticated Remote Command Execution. The product allows users to configure authorization checks as shell commands through the tac_plus.cfg configuration file. These are executed when a client sends an authorization request with a username that has pre-authorization directives configured. However, it is possible to inject additional commands into these checks because strings from TACACS+ packets are used as command-line arguments. If the installation lacks
nds into these checks because strings from TACACS+ packets are used as command-line arguments. If the installation lacks a a pre-shared secret (there is no pre-shared secret by default), then the injection can be triggered without authentication. (The attacker needs to know a username configured to use a pre-authorization command.) NOTE: this is related to CVE-2023-45239 but the issue is in the original Shrubbery product, not Meta's fork. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/takeshixx/tac_plus-pre-auth-rce
CVE ID: CVE-2023-48644 State: PUBLISHED Published: 2024-03-05T00:00:00.000Z Last Updated: 2025-06-03T02:12:43.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the description field. This allows an attacker to perform an action on behalf of the user, exfiltrate data, and so on. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644
CVE ID: CVE-2023-48645 State: PUBLISHED Published: 2024-02-02T00:00:00.000Z Last Updated: 2025-06-03T02:13:52.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Archibus app 4.0.3 for iOS. It uses a local database that is synchronized with a Web central server instance every time the application is opened, or when the refresh button is used. There is a SQL injection in the search work request feature in the Maintenance module of the app. This allows performing queries on the local database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2023-48645 - http
Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2023-48645 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48645
CVE ID: CVE-2023-48646 State: PUBLISHED Published: 2023-11-22T00:00:00 Last Updated: 2024-08-02T21:37:54.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/ad-recovery-manager/advisory/CVE-2023-48646.html
CVE ID: CVE-2023-48648 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-29T14:39:22.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.concretecms.org/about/proje
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release - https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes
CVE ID: CVE-2023-48649 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-29T14:36:54.863Z Severity: LOW (CVSS 3.5 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release - https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes - https://documentation.concretecms.org/develo
concretecms.org/developers/introduction/version-history/922-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes - https://github.com/concretecms/concretecms/pull/11695 - https://github.com/concretecms/concretecms/pull/11739
CVE ID: CVE-2023-48650 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T21:37:53.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes - https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates
CVE ID: CVE-2023-48651 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T21:37:53.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) at /ccm/system/dialogs/file/delete/1/submit. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes - https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates
CVE ID: CVE-2023-48652 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T21:37:53.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes - https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates
CVE ID: CVE-2023-48653 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T21:37:54.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit. An attacker can force an admin to delete events on the site because the event ID is numeric and sequential. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes - https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updat
3-release-notes - https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates
CVE ID: CVE-2023-48654 State: PUBLISHED Published: 2023-12-25T00:00:00.000Z Last Updated: 2025-11-04T19:25:45.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: go to the Google ReCAPTCHA section, click on the Privacy link, observe that there is a new browser window, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORIT
ny website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://www.oneidentity.com/products/password-manager/ - https://sec-consult.com/vulnerability-lab/advisory/kiosk-escape-privilege-escalation-one-identity-password-manager-secure-password-extension/
CVE ID: CVE-2023-48655 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-10-15T17:47:48.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/compare/v2.4.175...v2.4.176 - https://github.com/MISP/MISP/commit/158c8b2f788b75e0d26e9249a75e1be291e59d4b - https://zigrin.com/advisories/misp-blind-sql-injection-in-array-input-parameters/
CVE ID: CVE-2023-48656 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-11-26T20:17:35.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/compare/v2.4.175...v2.4.176 - https://github.com/MISP/MISP/commit/d6ad402b31547c95280a6d8320f8f87a8f609074 - https://zigrin.com/advisories/misp-blind-sql-injection-in-order-parameter/
CVE ID: CVE-2023-48657 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T21:37:54.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.175...v2.4.176 - https://github.com/MISP/MISP/commit/08bd23281ead288de678de666ef43ed6de1899fc - https://zigrin.com/advisories/misp-time-based-sql-injection-in-logs-index/
CVE ID: CVE-2023-48658 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T21:37:54.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.175...v2.4.176 - https://github.com/MISP/MISP/commit/168621521b57b2437331174186f84a6aa3e71f0d - https://zigrin.com/advisories/misp-time-based-sql-injection-in-logs-index/
CVE ID: CVE-2023-48659 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T21:37:54.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.175...v2.4.176 - https://github.com/MISP/MISP/commit/37ecf81b84a01baa4d4b1fade4de94a9018c32ed - https://zigrin.com/advisories/misp-reflected-cross-site-scripting-in-galaxies/
CVE ID: CVE-2023-48660 State: PUBLISHED Published: 2023-12-14T15:51:56.902Z Last Updated: 2024-08-02T21:37:54.448Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: vApp Manger Problem Types: CWE-22 Description: Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to read arbitrary files from the target system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance
23-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-solutions-enabler-virtual-appliance-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2023-48661 State: PUBLISHED Published: 2023-12-14T15:55:26.488Z Last Updated: 2024-08-02T21:37:54.426Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: vApp Manager Problem Types: CWE-552 Description: Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability to read arbitrary files from the target system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unispher
ort/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-solutions-enabler-virtual-appliance-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2023-48662 State: PUBLISHED Published: 2023-12-14T15:59:26.417Z Last Updated: 2024-08-02T21:37:53.585Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: vApp Manager Problem Types: CWE-78 Description: Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-po
://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-solutions-enabler-virtual-appliance-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2023-48663 State: PUBLISHED Published: 2023-12-14T16:03:27.167Z Last Updated: 2025-05-21T14:36:07.199Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: vApp Manager Problem Types: CWE-78 Description: Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-
ment: References: - https://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-solutions-enabler-virtual-appliance-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2023-48664 State: PUBLISHED Published: 2023-12-14T16:08:11.100Z Last Updated: 2024-08-02T21:37:53.448Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: vApp Manager Problem Types: CWE-78 Description: Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-po
CVE ID: CVE-2023-48665 State: PUBLISHED Published: 2023-12-14T16:12:20.442Z Last Updated: 2024-08-02T21:37:54.654Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: vApp Manager, Problem Types: CWE-78 Description: Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-p
s://www.dell.com/support/kbdoc/en-us/000220427/dsa-2023-443-dell-powermaxos-5978-dell-unisphere-360-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-solutions-enabler-virtual-appliance-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2023-48667 State: PUBLISHED Published: 2023-12-14T15:40:07.760Z Last Updated: 2024-08-02T21:37:54.550Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerProtect DD Problem Types: CWE-78 Description: Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. A remote high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS to bypass security restriction. Exploitation may lead to a system take over by an attacker. Additional Analyst Notes