alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2023-27977 (published 2023-03-21)
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project report directory, this could lead to loss of data when an attacker sends specific crafted messages to the Data Server TCP port. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-345
Affected vendors: schneider-electric
Affected products: custom_reports, igss_dashboard, igss_data_server
CVE-2023-27978 (published 2023-03-21)
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: schneider-electric
Affected products: custom_reports, igss_dashboard, igss_data_server
CVE-2023-27979 (published 2023-03-21)
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project report directory, this could lead to denial of service when an attacker sends specific crafted messages to the Data Server TCP port. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Weakness: CWE-345
Affected vendors: schneider-electric
Affected products: custom_reports, igss_dashboard, igss_data_server
CVE-2023-2798 (published 2023-05-25)
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue affects htmlunit before 2.70.0.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: htmlunit
Affected products: htmlunit
CVE-2023-27980 (published 2023-03-21)
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious report file in the IGSS project report directory, this could lead to remote code execution when a victim eventually opens the report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: schneider-electric
Affected products: custom_reports, igss_dashboard, igss_data_server
CVE-2023-27981 (published 2023-03-21)
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code execution when a victim tries to open a malicious report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: schneider-electric
Affected products: custom_reports, igss_dashboard, igss_data_server
CVE-2023-27982 (published 2023-03-21)
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS project report directory, when an attacker sends specific crafted messages to the Data Server TCP port, this could lead to remote code execution when a victim eventually opens a malicious dashboard file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-345
Affected vendors: schneider-electric
Affected products: custom_reports, igss_dashboard, igss_data_server
CVE-2023-27983 (published 2023-03-21)
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSS project report directory, this would lead to loss of data when an attacker abuses this functionality. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-306
Affected vendors: schneider-electric
Affected products: custom_reports, igss_dashboard, igss_data_server
CVE-2023-27984 (published 2023-03-21)
A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to remote code execution when a user opens a malicious report file planted by an attacker. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: schneider-electric
Affected products: custom_reports, igss_dashboard, igss_data_server
CVE-2023-27985 (published 2023-03-09)
emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: gnu
Affected products: emacs
CVE-2023-27986 (published 2023-03-09)
emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: gnu
Affected products: emacs
CVE-2023-27987 (published 2023-04-10)

In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values.




We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization[1]
 https://linkis.apache.org/docs/latest/auth/token https://linkis.apache.org/docs/latest/auth/token 





Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-326
Affected vendors: apache
Affected products: linkis
CVE-2023-27988 (published 2023-05-30)
The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: zyxel
Affected products: nas326, nas326_firmware, nas540, nas540_firmware, nas542, nas542_firmware
CVE-2023-27989 (published 2023-06-05)
A buffer overflow vulnerability in the CGI program of the Zyxel NR7101 firmware versions prior to  V1.00(ABUV.8)C0 could allow a remote authenticated attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: zyxel
Affected products: lte7480-m804, lte7480-m804_firmware, lte7490-m904, lte7490-m904_firmware, nebula_nr7101, nebula_nr7101_firmware, nr7101, nr7101_firmware
CVE-2023-2799 (published 2023-05-18)
A vulnerability, which was classified as problematic, has been found in cnoa OA up to 5.1.1.5. Affected by this issue is some unknown functionality of the file /index.php?app=main&func=passport&action=login. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229376. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-259
Affected vendors: cnoa_oa_project
Affected products: cnoa_oa
CVE-2023-27990 (published 2023-04-24)
The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: zyxel
Affected products: atp100, atp100_firmware, atp100w, atp100w_firmware, atp200, atp200_firmware, atp500, atp500_firmware, atp700, atp700_firmware, atp800, atp800_firmware, usg20-vpn, usg20-vpn_firmware, usg_20w-vpn, usg_20w-vpn_firmware, usg_flex_100, usg_flex_100_firmware, usg_flex_100w, usg_flex_100w_firmware, usg_flex_200, usg_flex_200_firmware, usg_flex_50, usg_flex_500, usg_flex_500_firmware
CVE-2023-27991 (published 2023-04-24)
The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker to execute some OS commands remotely.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: zyxel
Affected products: atp100, atp100_firmware, atp100w, atp100w_firmware, atp200, atp200_firmware, atp500, atp500_firmware, atp700, atp700_firmware, atp800, atp800_firmware, usg20-vpn, usg20-vpn_firmware, usg_20w-vpn, usg_20w-vpn_firmware, usg_flex_100, usg_flex_100_firmware, usg_flex_100w, usg_flex_100w_firmware, usg_flex_200, usg_flex_200_firmware, usg_flex_50, usg_flex_500, usg_flex_500_firmware
CVE-2023-27992 (published 2023-06-19)
The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: zyxel
Affected products: nas326, nas326_firmware, nas540, nas540_firmware, nas542, nas542_firmware
Added to CISA KEV catalog: 2023-06-23
KEV required action: Apply updates per vendor instructions.
CVE-2023-27993 (published 2023-05-03)
A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-23
Affected vendors: fortinet
Affected products: fortiadc
CVE-2023-27995 (published 2023-04-11)
A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute arbitrary code via a crafted payload.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1336
Affected vendors: fortinet
Affected products: fortisoar
CVE-2023-27997 (published 2023-06-13)
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: fortinet
Affected products: fortigate_6000, fortigate_7000, fortios, fortiproxy
Added to CISA KEV catalog: 2023-06-13
KEV required action: Apply updates per vendor instructions.
CVE-2023-27998 (published 2023-09-13)
A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow an unauthenticated attacker with the ability to navigate to the login GUI to gain sensitive information via navigating to specific HTTP(s) paths.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-756
Affected vendors: fortinet
Affected products: fortipresence
CVE-2023-27999 (published 2023-05-03)
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: fortinet
Affected products: fortiadc
CVE-2023-2800 (published 2023-05-18)
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-377
Affected vendors: huggingface
Affected products: transformers
CVE-2023-28000 (published 2023-06-13)
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.0 through 6.2.4, 6.1 all versions, 6.0 all versions may allow a local and authenticated attacker to execute unauthorized commands via specifically crafted arguments in diagnose system df CLI command.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: fortinet
Affected products: fortiadc
CVE-2023-28001 (published 2023-07-11)
An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-613
Affected vendors: fortinet
Affected products: fortios
CVE-2023-28002 (published 2023-11-14)
An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesystem integrity check in place.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-354
Affected vendors: fortinet
Affected products: fortios, fortiproxy
CVE-2023-28003 (published 2023-04-18)



A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to
maintain unauthorized access over a hijacked session in PME after the legitimate user has
signed out of their account.




Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-613
Affected vendors: schneider-electric
Affected products: ecostruxure_power_monitoring_expert
CVE-2023-28004 (published 2023-04-18)



A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted
Ethernet request could result in denial of service or remote code execution. 

 

 




Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: schneider-electric
Affected products: powerlogic_hdpm6000, powerlogic_hdpm6000_firmware
CVE-2023-28005 (published 2023-03-22)
A vulnerability in Trend Micro Endpoint Encryption Full Disk Encryption version 6.0.0.3204 and below could allow an attacker with physical access to an affected device to bypass Microsoft Windows� Secure Boot process in an attempt to execute other attacks to obtain access to the contents of the device.

An attacker must first obtain physical access to the target system in order to exploit this vulnerability. It is also important to note that the contents of the drive(s) encrypted with TMEE FDE would still be protected and would NOT be accessible by the attacker by exploitation of this vulnerability alone.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft, trendmicro
Affected products: trend_micro_endpoint_encryption, windows
CVE-2023-28006 (published 2023-06-22)
The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-327
Affected vendors: hcltech
Affected products: bigfix_osd_bare_metal_server
CVE-2023-28008 (published 2023-04-26)
HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-611
Affected vendors: hcltech
Affected products: workload_automation
CVE-2023-28009 (published 2023-04-26)
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-611
Affected vendors: hcltech
Affected products: workload_automation
CVE-2023-2801 (published 2023-06-06)
Grafana is an open-source platform for monitoring and observability. 

Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.

The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.

This might enable malicious users to crash Grafana instances through that endpoint.

Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-820
Affected vendors: grafana
Affected products: grafana
CVE-2023-28010 (published 2023-09-08)
In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: hcltech
Affected products: domino
CVE-2023-28012 (published 2023-07-27)
HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: hcltech
Affected products: bigfix_mobile
CVE-2023-28013 (published 2023-07-26)
HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability.  By tricking a user into entering crafted markup a remote, unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hcltech
Affected products: verse
CVE-2023-28014 (published 2023-07-27)
HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hcltech
Affected products: bigfix_mobile
CVE-2023-28015 (published 2023-05-23)
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability.   During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not.  The attacker could use this information to focus a brute force attack on valid users.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-203
Affected vendors: hcl
Affected products: domino_appdev_pack
CVE-2023-28016 (published 2023-06-22)
Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-74
Affected vendors: hcltech
Affected products: bigfix_osd_bare_metal_server
CVE-2023-28017 (published 2023-12-07)
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hcltech
Affected products: connections
CVE-2023-28018 (published 2024-02-12)
HCL Connections is vulnerable to a denial of service, caused by improper validation on certain requests. Using a specially-crafted request an attacker could exploit this vulnerability to cause denial of service for affected users.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Affected vendors: hcltech
Affected products: connections
CVE-2023-28019 (published 2023-07-18)
Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: hcltech
Affected products: bigfix_webui
CVE-2023-2802 (published 2023-08-14)
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: themefic
Affected products: ultimate_addons_for_contact_form_7
CVE-2023-28020 (published 2023-07-18)
 URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: hcltech
Affected products: bigfix_webui
CVE-2023-28021 (published 2023-07-18)
The BigFix WebUI uses weak cipher suites.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-326
Affected vendors: hcltech
Affected products: bigfix_webui
CVE-2023-28022 (published 2023-12-15)
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: hcltech
Affected products: connections
CVE-2023-28023 (published 2023-07-18)
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems (server machine and all the ones in its network). 

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-352
Affected vendors: hcltech
Affected products: bigfix_webui
CVE-2023-28025 (published 2023-12-21)
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage. 

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hcltech
Affected products: bigfix_modern_client_management
CVE-2023-28026 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28027 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28028 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28029 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-2803 (published 2023-08-14)
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: themefic
Affected products: ultimate_addons_for_contact_form_7
CVE-2023-28030 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28031 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28032 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28033 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28034 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28035 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28036 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28039 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-2804 (published 2023-05-25)
A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-122
Affected vendors: libjpeg-turbo
Affected products: libjpeg-turbo
CVE-2023-28040 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28041 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28042 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28043 (published 2023-06-01)

Dell SCG 5.14 contains an information disclosure vulnerability during the SRS to SCG upgrade path. A remote low privileged malicious user could potentially exploit this vulnerability to retrieve the plain text.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-327
Affected vendors: dell
Affected products: secure_connect_gateway
CVE-2023-28044 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28045 (published 2023-05-19)

Dell CloudIQ Collector version 1.10.2 contains a missing encryption of sensitive data vulnerability. An attacker with low privileges could potentially exploit this vulnerability, leading to gain access to unauthorized data.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)
Weakness: CWE-311
Affected vendors: dell
Affected products: aiops_collector
CVE-2023-28046 (published 2023-04-06)

Dell Display Manager, versions 2.1.0 and prior, contains an arbitrary file or folder deletion vulnerability during uninstallation A local low privilege attacker could potentially exploit this vulnerability, leading to the deletion of arbitrary files on the operating system with high privileges.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-272
Affected vendors: dell
Affected products: display_manager
CVE-2023-28047 (published 2023-04-20)

Dell Display Manager, versions 2.1.0 and prior, contains an arbitrary file or folder creation vulnerability during installation. A local low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code on the operating system with high privileges.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-272
Affected vendors: dell
Affected products: display_manager
CVE-2023-28049 (published 2024-02-06)

Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability. A locally authenticated malicious user may exploit this vulnerability in order to perform a privileged arbitrary file delete.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-267
Affected vendors: dell
Affected products: command_\|_monitor
CVE-2023-2805 (published 2023-06-19)
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: supportcandy
Affected products: supportcandy
CVE-2023-28050 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28051 (published 2023-04-07)

Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability. A low-privileged attacker could potentially exploit this vulnerability to elevate privileges on the system.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: dell
Affected products: power_manager
CVE-2023-28052 (published 2023-06-23)

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r12, alienware_aurora_r12_firmware, alienware_aurora_r13, alienware_aurora_r13_firmware, alienware_aurora_r15, alienware_aurora_r15_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16, alienware_m16_firmware, alienware_m17_r2
CVE-2023-28053 (published 2023-12-18)

Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to some information disclosure.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-327
Affected vendors: dell
Affected products: emc_networker