deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-30543
Published: 2023-04-17
Description: @web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.



CVSS Score: 5.2 (MEDIUM)
CWE: CWE-362
References: https://github.com/Uniswap/web3-react/pull/749; https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g; https://github.com/Uniswap/web3-react/pull/749
CVE: CVE-2023-30547
Published: 2023-04-17
Description: vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244; https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049; https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5
CVE: CVE-2023-2138
Published: 2023-04-18
Description: Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/nuxtlabs/github-module/commit/5490c43f729eee60f07920bf88c0aabdc1398b6e; https://huntr.dev/bounties/65096ef9-eafc-49da-b49a-5b88c0203ca6; https://github.com/nuxtlabs/github-module/commit/5490c43f729eee60f07920bf88c0aabdc1398b6e
CVE: CVE-2023-2119
Published: 2023-04-18
Description: The Responsive Filterable Portfolio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/trunk/wp-responsive-images-thumbnail-slider.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2808922%40responsive-filterable-portfolio%2Ftags%2F1.0.19&new=2899431%40responsive-filterable-portfolio%2Ftags%2F1.0.20; https://www.wordfence.com/threat-intel/vulnerabilities/id/e67dfe0f-ac1c-4a78-bfc9-0cfd6c3040d4?source=cve
CVE: CVE-2023-2120
Published: 2023-04-18
Description: The Thumbnail carousel slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/trunk/wp-responsive-images-thumbnail-slider.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2813150%40wp-responsive-thumbnail-slider%2Ftags%2F1.1.9&new=2899786%40wp-responsive-thumbnail-slider%2Ftags%2F1.1.10; https://www.wordfence.com/threat-intel/vulnerabilities/id/f4bf4e12-5cbb-45bc-938e-62163baaa15d?source=cve
CVE: CVE-2023-2144
Published: 2023-04-18
Description: A vulnerability was found in Campcodes Online Thesis Archiving System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/departments/view_department.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226265 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.226265; https://vuldb.com/?id.226265
CVE: CVE-2023-2145
Published: 2023-04-18
Description: A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been classified as critical. Affected is an unknown function of the file projects_per_curriculum.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226266 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.226266; https://vuldb.com/?id.226266
CVE: CVE-2021-40506
Published: 2023-04-18
Description: An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated for the msb and mac instructions, which results in an incorrect value in the overflow flag. Any software that relies on this flag may experience corruption in execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://github.com/openrisc/or1200/commit/2c0765d7ba12813df273cd693a99c4e744f0fbd5; https://seth.engr.tamu.edu/software-releases/thehuzz/; https://github.com/openrisc/or1200/commit/2c0765d7ba12813df273cd693a99c4e744f0fbd5
CVE: CVE-2021-40507
Published: 2023-04-18
Description: An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated correctly for the subtract instruction, which results in an incorrect value in the overflow flag. Any software that relies on this flag may experience corruption in execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://github.com/openrisc/or1200/commit/2c0765d7ba12813df273cd693a99c4e744f0fbd5; https://seth.engr.tamu.edu/software-releases/thehuzz/; https://github.com/openrisc/or1200/commit/2c0765d7ba12813df273cd693a99c4e744f0fbd5
CVE: CVE-2021-41612
Published: 2023-04-18
Description: An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract instruction, which results in an incorrect value of the carry flag. Any software that relies on this flag may experience corruption in execution.
CVSS Score: 8.8 (HIGH)
References: https://github.com/openrisc/mor1kx/issues/139; https://seth.engr.tamu.edu/software-releases/thehuzz/; https://github.com/openrisc/mor1kx/issues/139
CVE: CVE-2021-41613
Published: 2023-04-18
Description: An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic of Exception Effective Address Register (EEAR) is not implemented correctly. User programs from authorized privilege levels will be unable to write to EEAR.
CVSS Score: 4.3 (MEDIUM)
References: https://github.com/openrisc/mor1kx/issues/141; https://seth.engr.tamu.edu/software-releases/thehuzz/; https://github.com/openrisc/mor1kx/issues/141
CVE: CVE-2021-41614
Published: 2023-04-18
Description: An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program Counter Register (EPCR) are not implemented correctly. User programs from an unauthorized privilege level can make read/write accesses to EPCR.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/openrisc/mor1kx/issues/140; https://seth.engr.tamu.edu/software-releases/thehuzz/; https://github.com/openrisc/mor1kx/issues/140
CVE: CVE-2023-27092
Published: 2023-04-18
Description: Cross Site Scripting vulnerability found in Jbootfly allows attackers to obtain sensitive information via the username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitee.com/fuhai/jbootfly/issues/I6GDW8; https://github.com/yangfuhai/jbootfly/issues/1; https://gitee.com/fuhai/jbootfly/issues/I6GDW8
CVE: CVE-2023-2020
Published: 2023-04-18
Description: Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-280, CWE-863
References: https://checkmk.com/werk/13981; https://checkmk.com/werk/13981
CVE: CVE-2023-2146
Published: 2023-04-18
Description: A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226267.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.226267; https://vuldb.com/?id.226267
CVE: CVE-2023-2147
Published: 2023-04-18
Description: A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/students/view_details.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226268.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.226268; https://vuldb.com/?id.226268
CVE: CVE-2022-44735
Published: 2023-04-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gus Sevilla WP Clictracker plugin <= 1.0.5 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/clictracker/wordpress-clictracker-plugin-1-0-5-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/clictracker/wordpress-clictracker-plugin-1-0-5-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45838
Published: 2023-04-18
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARForms Form Builder plugin <= 1.5.5 versions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/arforms-form-builder/wordpress-arforms-form-builder-plugin-1-5-3-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/arforms-form-builder/wordpress-arforms-form-builder-plugin-1-5-3-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45839
Published: 2023-04-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA WHA Puzzle plugin <= 1.0.9 versions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wha-puzzle/wordpress-wha-puzzle-plugin-1-0-9-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wha-puzzle/wordpress-wha-puzzle-plugin-1-0-9-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-46640
Published: 2023-04-18
Description: Nanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://nanoleaf.com; https://pwning.tech/cve-2022-46640/; http://nanoleaf.com
CVE: CVE-2023-2148
Published: 2023-04-18
Description: A vulnerability classified as critical has been found in Campcodes Online Thesis Archiving System 1.0. This affects an unknown part of the file /admin/curriculum/view_curriculum.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226269 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.226269; https://vuldb.com/?id.226269
CVE: CVE-2023-2149
Published: 2023-04-18
Description: A vulnerability classified as critical was found in Campcodes Online Thesis Archiving System 1.0. This vulnerability affects unknown code of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226270 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%207.pdf; https://vuldb.com/?ctiid.226270; https://vuldb.com/?id.226270
CVE: CVE-2023-2150
Published: 2023-04-18
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Task Reminder System 1.0. This issue affects some unknown processing of the file Master.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226271.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.226271; https://vuldb.com/?id.226271; https://youtu.be/o46oHLvY2-E
CVE: CVE-2023-2151
Published: 2023-04-18
Description: A vulnerability, which was classified as critical, was found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file manage_student.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226272.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/xzz0787/vul/blob/main/README.pdf; https://vuldb.com/?ctiid.226272; https://vuldb.com/?id.226272
CVE: CVE-2022-44632
Published: 2023-04-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Denis Buka Content Repeater – Custom Posts Simplified plugin <= 1.1.13 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/content-repeater/wordpress-content-repeater-plugin-1-1-13-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/content-repeater/wordpress-content-repeater-plugin-1-1-13-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45836
Published: 2023-04-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/download-manager/wordpress-download-manager-plugin-3-2-59-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/download-manager/wordpress-download-manager-plugin-3-2-59-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28863
Published: 2023-04-18
Description: AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-345, CWE-345
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023003.pdf; https://ami.com; https://www.kb.cert.org/vuls/id/163057
CVE: CVE-2023-2152
Published: 2023-04-18
Description: A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226273 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-73, CWE-610
References: https://github.com/xzz0787/vul/blob/main/README.pdf; https://vuldb.com/?ctiid.226273; https://vuldb.com/?id.226273
CVE: CVE-2023-2153
Published: 2023-04-18
Description: A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/assets/plugins/DataTables/examples/examples_support/editable_ajax.php of the component POST Parameter Handler. The manipulation of the argument value with the input 1><script>alert(666)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-226274 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/[PII_REDACTED]/bug_report/blob/main/XSS-1.md; https://vuldb.com/?ctiid.226274; https://vuldb.com/?id.226274
CVE: CVE-2023-29774
Published: 2023-04-18
Description: Dreamer CMS 3.0.1 is vulnerable to stored Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/iteachyou-wjn/dreamer_cms/issues/10; https://github.com/iteachyou-wjn/dreamer_cms/issues/10
CVE: CVE-2023-2154
Published: 2023-04-18
Description: A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/?page=reminders/view_reminder. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226275.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.226275; https://vuldb.com/?id.226275; https://youtu.be/teK82KkWtdA
CVE: CVE-2023-2155
Published: 2023-04-18
Description: A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file classes/Master.php?f=save_cargo_type. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226276.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/kev6798/bug_report/blob/main/XSS-1.md; https://vuldb.com/?ctiid.226276; https://vuldb.com/?id.226276
CVE: CVE-2023-28140
Published: 2023-04-18
Description: 
An Executable Hijacking condition exists in the
Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers
may load a malicious copy of a Dependency Link Library (DLL) via a local
attack vector instead of the DLL that the application was expecting, when
processes are running with escalated privileges. This vulnerability
is bounded only to the time of uninstallation and can only be exploited
locally.



At the time of this disclosure, versions before 4.0 are classified as End of
Life.



















CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.qualys.com/security-advisories/; https://www.qualys.com/security-advisories/
CVE: CVE-2023-28141
Published: 2023-04-18
Description: 
An NTFS Junction condition exists in the Qualys Cloud Agent
for Windows platform in versions before 4.8.0.31. Attackers may write files to
arbitrary locations via a local attack vector. This allows attackers to assume
the privileges of the process, and they may delete or otherwise on unauthorized
files, allowing for the potential modification or deletion of sensitive files
limited only to that specific directory/file object. This vulnerability is
bounded to the time of installation/uninstallation and can only be exploited locally.



At the time of this disclosure, versions before 4.0 are
classified as End of Life.
















CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59
References: https://www.qualys.com/security-advisories/; https://www.qualys.com/security-advisories/
CVE: CVE-2023-28142
Published: 2023-04-18
Description: 
A Race Condition exists in the Qualys Cloud Agent for Windows
platform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers to
escalate privileges limited on the local machine during uninstallation of the
Qualys Cloud Agent for Windows. Attackers may gain SYSTEM level privileges on
that asset to run arbitrary commands.



At the time of this disclosure, versions before 4.0 are classified as End
of Life.

















CVSS Score: 6.7 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://www.qualys.com/security-advisories/; https://www.qualys.com/security-advisories/
CVE: CVE-2023-28143
Published: 2023-04-18
Description: 
Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7)
installer allows a local escalation of privilege bounded only to the time of
installation and only on older macOSX (macOS 10.15 and older) versions.
Attackers may exploit incorrect file permissions to give them ROOT command
execution privileges on the host. During the install of the PKG, a step in the
process involves extracting the package and copying files to several
directories. Attackers may gain writable access to files during the install of
PKG when extraction of the package and copying files to several directories,
enabling a local escalation of privilege.










CVSS Score: 6.7 (MEDIUM)
CWE: CWE-426, CWE-426
References: https://qualys.com/security-advisories; https://qualys.com/security-advisories
CVE: CVE-2023-2160
Published: 2023-04-18
Description: Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-521
References: https://github.com/modoboa/modoboa/commit/130257c96a2392ada795785a91178e656e27015c; https://huntr.dev/bounties/54fb6d6a-6b39-45b6-b62a-930260ba484b; https://github.com/modoboa/modoboa/commit/130257c96a2392ada795785a91178e656e27015c
CVE: CVE-2023-1548
Published: 2023-04-18
Description: 
A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to
perform a denial of service through the console server service that is part of EcoStruxure Control Expert. Affected Products: EcoStruxure Control Expert (V15.1 and above)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-03.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-03.pdf