deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39209
Published: 2023-08-08
Description: Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network access.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-449, CWE-20
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39210
Published: 2023-08-08
Description: Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user to enable an information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39211
Published: 2023-08-08
Description: Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347, CWE-269
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39212
Published: 2023-08-08
Description: 
Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.


CVSS Score: 7.9 (HIGH)
CWE: CWE-144, CWE-426
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39213
Published: 2023-08-08
Description: Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-176, CWE-74
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39214
Published: 2023-08-08
Description: Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.
CVSS Score: 7.6 (HIGH)
CWE: CWE-749, CWE-668
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2023-39951
Published: 2023-08-08
Description: OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. OpenTelemetry Java Instrumentation prior to version 1.28.0 contains an issue related to the instrumentation of Java applications using the AWS SDK v2 with Amazon Simple Email Service (SES) v1 API. When SES POST requests are instrumented, the query parameters of the request are inserted into the trace `url.path` field. This behavior leads to the http body, containing the email subject and message, to be present in the trace request url metadata. Any user using a version before 1.28.0 of OpenTelemetry Java Instrumentation to instrument AWS SDK v2 call to SES’s v1 SendEmail API is affected. The e-mail content sent to SES may end up in telemetry backend. This exposes the e-mail content to unintended audiences. The issue can be mitigated by updating OpenTelemetry Java Instrumentation to version 1.28.0 or later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/open-telemetry/opentelemetry-java-instrumentation/issues/8956; https://github.com/open-telemetry/opentelemetry-java-instrumentation/pull/8931; https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-hghr-r469-gfq6
CVE: CVE-2023-39341
Published: 2023-08-09
Description: "FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to denial-of-service (DoS) condition. 
Affected products and versions are as follows: FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0, FFRI yarai Home and Business Edition version 1.4.0, InfoTrace Mark II Malware Protection (Mark II Zerona) versions 3.0.1 to 3.2.2, Zerona / Zerona PLUS versions 3.2.32 to 3.2.36, ActSecure χ versions 3.4.0 to 3.4.6 and 3.5.0, Dual Safe Powered by FFRI yarai version 1.4.1, EDR Plus Pack (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0), and EDR Plus Pack Cloud (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0).
CVSS Score: 3.3 (LOW)
CWE: CWE-755
References: https://jvn.jp/en/jp/JVN42527152/; https://www.ffri.jp/security-info/index.htm; https://www.skyseaclientview.net/news/230807_01/
CVE: CVE-2023-39910
Published: 2023-08-09
Description: The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/commands/seed.cpp#L44; https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/utility.cpp#L78; https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
CVE: CVE-2023-4239
Published: 2023-08-09
Description: The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.2 due to insufficient restriction on the 'rem_save_profile_front' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/6.7.1/classes/shortcodes.class.php#L1439; https://www.wordfence.com/threat-intel/vulnerabilities/id/d83d1fd0-6e21-406e-a7c0-89d26eabbb32?source=cve; https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/6.7.1/classes/shortcodes.class.php#L1439
CVE: CVE-2023-38751
Published: 2023-08-09
Description: Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view the organization information of the information receiver that is set as "non-disclosure" in the information provision operation.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/jp/JVN83334799/; https://www.jpcert.or.jp/press/2023/PR20230807_notice.html; https://jvn.jp/en/jp/JVN83334799/
CVE: CVE-2023-38752
Published: 2023-08-09
Description: Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view the attribute information of the poster that is set as"non-disclosure" in the system settings.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/jp/JVN83334799/; https://www.jpcert.or.jp/press/2023/PR20230807_notice.html; https://jvn.jp/en/jp/JVN83334799/
CVE: CVE-2023-4242
Published: 2023-08-09
Description: The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287, CWE-863
References: https://plugins.trac.wordpress.org/browser/full-customer/tags/1.1.0/app/api/Health.php; https://plugins.trac.wordpress.org/browser/full-customer/tags/2.3/app/api/Controller.php?rev=2951561; https://www.wordfence.com/threat-intel/vulnerabilities/id/a77d0fb5-8829-407d-a40a-169cf0c5f837?source=cve
CVE: CVE-2023-4243
Published: 2023-08-09
Description: The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing plugins from arbitrary remote locations including non-repository sources onto the site, granted they are packaged as a valid WordPress plugin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285, CWE-434
References: https://plugins.trac.wordpress.org/browser/full-customer/tags/1.1.0/app/api/Plugin.php; https://plugins.trac.wordpress.org/browser/full-customer/tags/2.2.1/app/api/PluginInstallation.php; https://plugins.trac.wordpress.org/browser/full-customer/tags/2.3/app/api/Controller.php?rev=2951561
CVE: CVE-2023-2905
Published: 2023-08-09
Description: Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.

CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/cesanta/mongoose/pull/2274; https://github.com/cesanta/mongoose/releases/tag/7.11; https://takeonme.org/cves/CVE-2023-2905.html
CVE: CVE-2022-47185
Published: 2023-08-09
Description: Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lists.apache.org/thread/jsl6dfdgs1mjjo1mbtyflyjr7xftswhc; https://lists.debian.org/debian-lts-announce/2023/09/msg00042.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BOTOM2MFKOLK46Q3BQHO662HTPZFRQUC/
CVE: CVE-2023-26310
Published: 2023-08-09
Description: There is a command injection problem in the old version of the mobile phone backup app.
CVSS Score: 7.4 (HIGH)
CWE: CWE-88, CWE-77
References: https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]721477632; https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]721477632
CVE: CVE-2023-33934
Published: 2023-08-09
Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-444, CWE-444
References: https://lists.apache.org/thread/jsl6dfdgs1mjjo1mbtyflyjr7xftswhc; https://lists.debian.org/debian-lts-announce/2023/09/msg00042.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BOTOM2MFKOLK46Q3BQHO662HTPZFRQUC/
CVE: CVE-2023-37855
Published: 2023-08-09
Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-610
References: https://cert.vde.com/en/advisories/VDE-2023-018/; https://cert.vde.com/en/advisories/VDE-2023-018/
CVE: CVE-2023-37856
Published: 2023-08-09
Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem through a configuration dialog within the embedded Qt browser .


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-610
References: https://cert.vde.com/en/advisories/VDE-2023-018/; https://cert.vde.com/en/advisories/VDE-2023-018/
CVE: CVE-2023-37857
Published: 2023-08-09
Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies.  These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.

CVSS Score: 3.8 (LOW)
CWE: CWE-798
References: https://cert.vde.com/en/advisories/VDE-2023-018/; https://cert.vde.com/en/advisories/VDE-2023-018/
CVE: CVE-2023-37858
Published: 2023-08-09
Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://cert.vde.com/en/advisories/VDE-2023-018/; https://cert.vde.com/en/advisories/VDE-2023-018/
CVE: CVE-2023-37859
Published: 2023-08-09
Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowledge of the SNMPv2 r/w community string to execute system commands as root.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://cert.vde.com/en/advisories/VDE-2023-018/; https://cert.vde.com/en/advisories/VDE-2023-018/
CVE: CVE-2023-37860
Published: 2023-08-09
Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon.

CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://cert.vde.com/en/advisories/VDE-2023-018/; https://cert.vde.com/en/advisories/VDE-2023-018/
CVE: CVE-2023-37861
Published: 2023-08-09
Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a certificate to the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en/advisories/VDE-2023-018/; https://cert.vde.com/en/advisories/VDE-2023-018/
CVE: CVE-2023-37862
Published: 2023-08-09
Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This might cause certificate errors for SSL-connections and might result in a partial denial-of-service.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://cert.vde.com/en/advisories/VDE-2023-018/; https://cert.vde.com/en/advisories/VDE-2023-018/
CVE: CVE-2023-37863
Published: 2023-08-09
Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en/advisories/VDE-2023-018/; https://cert.vde.com/en/advisories/VDE-2023-018/
CVE: CVE-2023-37864
Published: 2023-08-09
Description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-494, CWE-494
References: https://cert.vde.com/en/advisories/VDE-2023-018/; https://cert.vde.com/en/advisories/VDE-2023-018/
CVE: CVE-2023-24477
Published: 2023-08-09
Description: In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.
CVSS Score: 7.0 (HIGH)
CWE: CWE-384, CWE-384
References: https://security.nozominetworks.com/NN-2023:8-01; https://security.nozominetworks.com/NN-2023:8-01
CVE: CVE-2023-38207
Published: 2023-08-09
Description: Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-91
References: https://helpx.adobe.com/security/products/magento/apsb23-42.html; https://helpx.adobe.com/security/products/magento/apsb23-42.html
CVE: CVE-2023-38208
Published: 2023-08-09
Description: Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://helpx.adobe.com/security/products/magento/apsb23-42.html; https://helpx.adobe.com/security/products/magento/apsb23-42.html
CVE: CVE-2023-38209
Published: 2023-08-09
Description: Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb23-42.html; https://helpx.adobe.com/security/products/magento/apsb23-42.html
CVE: CVE-2023-22378
Published: 2023-08-09
Description: A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application.

Authenticated users may be able to extract arbitrary information from the DBMS in an uncontrolled way, alter its structure and data, and/or affect its availability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://security.nozominetworks.com/NN-2023:2-01; https://security.nozominetworks.com/NN-2023:2-01
CVE: CVE-2023-22843
Published: 2023-08-09
Description: An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule.
Via stored Cross-Site Scripting (XSS), an attacker may be able to perform unauthorized actions on behalf of legitimate users and/or gather sensitive information. JavaScript injection was possible in the contents for Yara rules, while limited HTML injection has been proven for packet and STYX rules.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.nozominetworks.com/NN-2023:4-01; https://security.nozominetworks.com/NN-2023:4-01
CVE: CVE-2023-23574
Published: 2023-08-09
Description: A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_count component, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application.

Authenticated users may be able to extract arbitrary information from the DBMS in an uncontrolled way, alter its structure and data, and/or affect its availability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://security.nozominetworks.com/NN-2023:3-01; https://security.nozominetworks.com/NN-2023:3-01
CVE: CVE-2023-24471
Published: 2023-08-09
Description: An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.

An authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data that would normally be not accessible in the Query and Assertions functions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://security.nozominetworks.com/NN-2023:5-01; https://security.nozominetworks.com/NN-2023:5-01
CVE: CVE-2023-38211
Published: 2023-08-09
Description: Adobe Dimension version 3.4.9 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/dimension/apsb23-44.html; https://helpx.adobe.com/security/products/dimension/apsb23-44.html
CVE: CVE-2023-38212
Published: 2023-08-09
Description: Adobe Dimension version 3.4.9 is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/dimension/apsb23-44.html; https://helpx.adobe.com/security/products/dimension/apsb23-44.html
CVE: CVE-2023-38213
Published: 2023-08-09
Description: Adobe Dimension version 3.4.9 is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb23-44.html; https://helpx.adobe.com/security/products/dimension/apsb23-44.html
CVE: CVE-2023-3632
Published: 2023-08-09
Description: Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, Authentication Bypass.This issue affects Kunduz - Homework Helper App: before 6.2.3.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://www.usom.gov.tr/bildirim/tr-23-0446; https://www.usom.gov.tr/bildirim/tr-23-0446
CVE: CVE-2023-23903
Published: 2023-08-09
Description: An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error.

The whole application in rendered unusable until a console intervention.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-1286
References: https://security.nozominetworks.com/NN-2023:7-01; https://security.nozominetworks.com/NN-2023:7-01
CVE: CVE-2023-24015
Published: 2023-08-09
Description: A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null.

The reports section will be partially unavailable for all later attempts to use it, with the report list seemingly stuck on loading.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1286
References: https://security.nozominetworks.com/NN-2023:6-01; https://security.nozominetworks.com/NN-2023:6-01
CVE: CVE-2023-31448
Published: 2023-08-09
Description: A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the HL7 sensor into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520; https://www.paessler.com/prtg/history/stable; https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520