auren-research/cyber-sec huggingface dataset:
cveID: CVE-2024-21351
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
dateAdded: 2024-02-13
shortDescription: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-03-05
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21351; https://nvd.nist.gov/vuln/detail/CVE-2024-21351
cwes: CWE-94
cveID: CVE-2023-43770
vendorProject: Roundcube
product: Webmail
vulnerabilityName: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
dateAdded: 2024-02-12
shortDescription: Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-03-04
knownRansomwareCampaignUse: Unknown
notes: https://roundcube.net/news/2023/09/15/security-update-1.6.3-released ; https://nvd.nist.gov/vuln/detail/CVE-2023-43770
cwes: CWE-79
cveID: CVE-2024-21762
vendorProject: Fortinet
product: FortiOS
vulnerabilityName: Fortinet FortiOS Out-of-Bound Write Vulnerability
dateAdded: 2024-02-09
shortDescription: Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-16
knownRansomwareCampaignUse: Known
notes: https://fortiguard.fortinet.com/psirt/FG-IR-24-015 ; https://nvd.nist.gov/vuln/detail/CVE-2024-21762
cwes: CWE-787
cveID: CVE-2023-4762
vendorProject: Google
product: Chromium V8
vulnerabilityName: Google Chromium V8 Type Confusion Vulnerability
dateAdded: 2024-02-06
shortDescription: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-27
knownRansomwareCampaignUse: Unknown
notes: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html; https://nvd.nist.gov/vuln/detail/CVE-2023-4762
cwes: CWE-843
cveID: CVE-2022-48618
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Memory Corruption Vulnerability
dateAdded: 2024-01-31
shortDescription: Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-21
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/HT213530, https://support.apple.com/en-us/HT213532, https://support.apple.com/en-us/HT213535, https://support.apple.com/en-us/HT213536; https://nvd.nist.gov/vuln/detail/CVE-2022-48618
cwes: CWE-367
cveID: CVE-2024-21893
vendorProject: Ivanti
product: Connect Secure, Policy Secure, and Neurons
vulnerabilityName: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
dateAdded: 2024-01-31
shortDescription: Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-02
knownRansomwareCampaignUse: Known
notes: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21893
cwes: CWE-918
cveID: CVE-2023-22527
vendorProject: Atlassian
product: Confluence Data Center and Server
vulnerabilityName: Atlassian Confluence Data Center and Server Template Injection Vulnerability
dateAdded: 2024-01-24
shortDescription: Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-14
knownRansomwareCampaignUse: Known
notes: https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html; https://nvd.nist.gov/vuln/detail/CVE-2023-22527
cwes: CWE-74
cveID: CVE-2024-23222
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products WebKit Type Confusion Vulnerability
dateAdded: 2024-01-23
shortDescription: Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-13
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/HT214055, https://support.apple.com/en-us/HT214056, https://support.apple.com/en-us/HT214057, https://support.apple.com/en-us/HT214058, https://support.apple.com/en-us/HT214059, https://support.apple.com/en-us/HT214061, https://support.apple.com/en-us/HT214063 ; https://nvd.nist.gov/vuln/detail/CVE-2024-23222
cwes: CWE-843
cveID: CVE-2023-34048
vendorProject: VMware
product: vCenter Server
vulnerabilityName: VMware vCenter Server Out-of-Bounds Write Vulnerability
dateAdded: 2024-01-22
shortDescription: VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-12
knownRansomwareCampaignUse: Unknown
notes: https://www.vmware.com/security/advisories/VMSA-2023-0023.html; https://nvd.nist.gov/vuln/detail/CVE-2023-34048
cwes: CWE-787
cveID: CVE-2023-35082
vendorProject: Ivanti
product: Endpoint Manager Mobile (EPMM) and MobileIron Core
vulnerabilityName: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
dateAdded: 2024-01-18
shortDescription: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-08
knownRansomwareCampaignUse: Known
notes: https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older; https://nvd.nist.gov/vuln/detail/CVE-2023-35082
cwes: CWE-287
cveID: CVE-2024-0519
vendorProject: Google
product: Chromium V8
vulnerabilityName: Google Chromium V8 Out-of-Bounds Memory Access Vulnerability
dateAdded: 2024-01-17
shortDescription: Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-07
knownRansomwareCampaignUse: Unknown
notes: https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html; https://nvd.nist.gov/vuln/detail/CVE-2024-0519
cwes: CWE-787
cveID: CVE-2023-6549
vendorProject: Citrix
product: NetScaler ADC and NetScaler Gateway
vulnerabilityName: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
dateAdded: 2024-01-17
shortDescription: Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-07
knownRansomwareCampaignUse: Unknown
notes: https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549; https://nvd.nist.gov/vuln/detail/CVE-2023-6549
cwes: CWE-119
cveID: CVE-2023-6548
vendorProject: Citrix
product: NetScaler ADC and NetScaler Gateway
vulnerabilityName: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
dateAdded: 2024-01-17
shortDescription: Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-24
knownRansomwareCampaignUse: Unknown
notes: https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549; https://nvd.nist.gov/vuln/detail/CVE-2023-6548
cwes: CWE-94
cveID: CVE-2018-15133
vendorProject: Laravel
product: Laravel Framework
vulnerabilityName: Laravel Deserialization of Untrusted Data Vulnerability
dateAdded: 2024-01-16
shortDescription: Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-02-06
knownRansomwareCampaignUse: Unknown
notes: https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30; https://nvd.nist.gov/vuln/detail/CVE-2018-15133
cwes: CWE-502
cveID: CVE-2023-29357
vendorProject: Microsoft
product: SharePoint Server
vulnerabilityName: Microsoft SharePoint Server Privilege Escalation Vulnerability
dateAdded: 2024-01-10
shortDescription: Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-31
knownRansomwareCampaignUse: Known
notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357; https://nvd.nist.gov/vuln/detail/CVE-2023-29357
cwes: CWE-303
cveID: CVE-2023-46805
vendorProject: Ivanti
product: Connect Secure and Policy Secure
vulnerabilityName: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
dateAdded: 2024-01-10
shortDescription: Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-22
knownRansomwareCampaignUse: Known
notes: Please apply mitigations per vendor instructions. For more information, please see: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-46805
cwes: CWE-287
cveID: CVE-2024-21887
vendorProject: Ivanti
product: Connect Secure and Policy Secure
vulnerabilityName: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
dateAdded: 2024-01-10
shortDescription: Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-22
knownRansomwareCampaignUse: Known
notes: Please apply mitigations per vendor instructions. For more information, please see: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21887
cwes: CWE-77
cveID: CVE-2023-23752
vendorProject: Joomla!
product: Joomla!
vulnerabilityName: Joomla! Improper Access Control Vulnerability
dateAdded: 2024-01-08
shortDescription: Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-29
knownRansomwareCampaignUse: Unknown
notes: https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html; https://nvd.nist.gov/vuln/detail/CVE-2023-23752
cwes: CWE-284
cveID: CVE-2016-20017
vendorProject: D-Link
product: DSL-2750B Devices
vulnerabilityName: D-Link DSL-2750B Devices Command Injection Vulnerability
dateAdded: 2024-01-08
shortDescription: D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-29
knownRansomwareCampaignUse: Unknown
notes: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088; https://nvd.nist.gov/vuln/detail/CVE-2016-20017
cwes: CWE-77
cveID: CVE-2023-41990
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Code Execution Vulnerability
dateAdded: 2024-01-08
shortDescription: Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-29
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/HT213599, https://support.apple.com/en-us/HT213601, https://support.apple.com/en-us/HT213605, https://support.apple.com/en-us/HT213606, https://support.apple.com/en-us/HT213842, https://support.apple.com/en-us/HT213844, https://support.apple.com/en-us/HT213845 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41990
cveID: CVE-2023-27524
vendorProject: Apache
product: Superset
vulnerabilityName: Apache Superset Insecure Default Initialization of Resource Vulnerability
dateAdded: 2024-01-08
shortDescription: Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-29
knownRansomwareCampaignUse: Unknown
notes: https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk; https://nvd.nist.gov/vuln/detail/CVE-2023-27524
cwes: CWE-1188
cveID: CVE-2023-29300
vendorProject: Adobe
product: ColdFusion
vulnerabilityName: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
dateAdded: 2024-01-08
shortDescription: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-29
knownRansomwareCampaignUse: Known
notes: https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://nvd.nist.gov/vuln/detail/CVE-2023-29300
cwes: CWE-502
cveID: CVE-2023-38203
vendorProject: Adobe
product: ColdFusion
vulnerabilityName: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
dateAdded: 2024-01-08
shortDescription: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-29
knownRansomwareCampaignUse: Known
notes: https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html ; https://nvd.nist.gov/vuln/detail/CVE-2023-38203
cwes: CWE-502
cveID: CVE-2023-7101
vendorProject: Spreadsheet::ParseExcel
product: Spreadsheet::ParseExcel
vulnerabilityName: Spreadsheet::ParseExcel Remote Code Execution Vulnerability
dateAdded: 2024-01-02
shortDescription: Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-23
knownRansomwareCampaignUse: Unknown
notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://metacpan.org/dist/Spreadsheet-ParseExcel and Barracuda's specific implementation and fix for their downstream issue CVE-2023-7102 at https://www.barracuda.com/company/legal/esg-vulnerability; https://nvd.nist.gov/vuln/detail/CVE-2023-7101
cwes: CWE-95
cveID: CVE-2023-7024
vendorProject: Google
product: Chromium WebRTC
vulnerabilityName: Google Chromium WebRTC Heap Buffer Overflow Vulnerability
dateAdded: 2024-01-02
shortDescription: Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-23
knownRansomwareCampaignUse: Unknown
notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html; https://nvd.nist.gov/vuln/detail/CVE-2023-7024
cwes: CWE-787
cveID: CVE-2023-49897
vendorProject: FXC
product: AE1021, AE1021PE
vulnerabilityName: FXC AE1021, AE1021PE OS Command Injection Vulnerability
dateAdded: 2023-12-21
shortDescription: FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-11
knownRansomwareCampaignUse: Unknown
notes: https://www.fxc.jp/news/20231206 ; https://nvd.nist.gov/vuln/detail/CVE-2023-49897
cwes: CWE-78
cveID: CVE-2023-47565
vendorProject: QNAP
product: VioStor NVR
vulnerabilityName: QNAP VioStor NVR OS Command Injection Vulnerability
dateAdded: 2023-12-21
shortDescription: QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-01-11
knownRansomwareCampaignUse: Unknown
notes: https://www.qnap.com/en/security-advisory/qsa-23-48 ; https://nvd.nist.gov/vuln/detail/CVE-2023-47565
cwes: CWE-78
cveID: CVE-2023-6448
vendorProject: Unitronics
product: Vision PLC and HMI
vulnerabilityName: Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
dateAdded: 2023-12-11
shortDescription: Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2023-12-18
knownRansomwareCampaignUse: Unknown
notes: Note that while it is possible to change the default password, implementors are encouraged to remove affected controllers from public networks and update the affected firmware: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf; https://nvd.nist.gov/vuln/detail/CVE-2023-6448
cwes: CWE-1188
cveID: CVE-2023-41266
vendorProject: Qlik
product: Sense
vulnerabilityName: Qlik Sense Path Traversal Vulnerability
dateAdded: 2023-12-07
shortDescription: Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.
requiredAction: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
dueDate: 2023-12-28
knownRansomwareCampaignUse: Known
notes: https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41266
cwes: CWE-20
cveID: CVE-2023-41265
vendorProject: Qlik
product: Sense
vulnerabilityName: Qlik Sense HTTP Tunneling Vulnerability
dateAdded: 2023-12-07
shortDescription: Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
requiredAction: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
dueDate: 2023-12-28
knownRansomwareCampaignUse: Known
notes: https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801; https://nvd.nist.gov/vuln/detail/CVE-2023-41265
cwes: CWE-444