deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-26593
Published: 2023-04-11
Description: CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who can login or access the computer where the affected product is installed tampers the password file stored in the computer, the user privilege which CENTUM managed may be escalated. As a result, the control system may be operated with the escalated user privilege. To exploit this vulnerability, the following prerequisites must be met: (1)An attacker has obtained user credentials where the affected product is installed, (2)CENTUM Authentication Mode is used for user authentication when CENTUM VP is used. The affected products and versions are as follows: CENTUM CS 1000, CENTUM CS 3000 (Including CENTUM CS 3000 Entry Class) R2.01.00 to R3.09.50, CENTUM VP (Including CENTUM VP Entry Class) R4.01.00 to R4.03.00, R5.01.00 to R5.04.20, and R6.01.00 and later, B/M9000 CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R7.04.51 and R8.01.01 and later
CVSS Score: 7.8 (HIGH)
CWE: CWE-312, CWE-312
References: https://jvn.jp/en/vu/JVNVU98775218/; https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/; https://jvn.jp/en/vu/JVNVU98775218/
CVE: CVE-2023-27389
Published: 2023-04-11
Description: Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrative privilege to apply a specially crafted Firmware update file, alter the information, cause a denial-of-service (DoS) condition, and/or execute arbitrary code. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).
CVSS Score: 7.2 (HIGH)
CWE: CWE-326, CWE-326
References: https://jvn.jp/en/vu/JVNVU96198617/; https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdf; https://www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmware
CVE: CVE-2023-27520
Published: 2023-04-11
Description: Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authentication and perform unintended operations by having a logged-in user view a malicious page. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://jvn.jp/en/jp/JVN82424996/; https://www.epson.jp/support/misc_t/230308_oshirase.htm; https://jvn.jp/en/jp/JVN82424996/
CVE: CVE-2023-27917
Published: 2023-04-11
Description: OS command injection vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker who can access Network Maintenance page to execute arbitrary OS commands with a root privilege. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/vu/JVNVU96198617/; https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdf; https://www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmware
CVE: CVE-2023-28368
Published: 2023-04-11
Description: TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator may be tricked to login to the fake device, the credential information for the affected device may be obtained.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-1391
References: https://jvn.jp/en/jp/JVN62420378/; https://www.tp-link.com/en/support/download/t2600g-28sq/#Firmware; https://jvn.jp/en/jp/JVN62420378/
CVE: CVE-2022-43716
Published: 2023-04-11
Description: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SIMATIC CP 443-1 (6GK7443-1EX30-0XE0) (All versions < V3.3), SIMATIC CP 443-1 (6GK7443-1EX30-0XE1) (All versions < V3.3), SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) (All versions < V3.3), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) (All versions < V3.4.29), SIPLUS NET CP 443-1 (6AG1443-1EX30-4XE0) (All versions < V3.3), SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0) (All versions < V3.3), SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) (All versions < V3.4.29), SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) (All versions < V3.4.29), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.3.6), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.3.6). The webserver of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation which leads to a restart of the webserver of the affected product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://cert-portal.siemens.com/productcert/html/ssa-139628.html; https://cert-portal.siemens.com/productcert/html/ssa-566905.html; https://cert-portal.siemens.com/productcert/pdf/ssa-566905.pdf
CVE: CVE-2022-43767
Published: 2023-04-11
Description: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SIMATIC CP 443-1 (6GK7443-1EX30-0XE0) (All versions < V3.3), SIMATIC CP 443-1 (6GK7443-1EX30-0XE1) (All versions < V3.3), SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) (All versions < V3.3), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) (All versions < V3.4.29), SIPLUS NET CP 443-1 (6AG1443-1EX30-4XE0) (All versions < V3.3), SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0) (All versions < V3.3), SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) (All versions < V3.4.29), SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) (All versions < V3.4.29), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.3.6), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.3.6). The webserver of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation of the webserver of the affected product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-833
References: https://cert-portal.siemens.com/productcert/html/ssa-139628.html; https://cert-portal.siemens.com/productcert/html/ssa-566905.html; https://cert-portal.siemens.com/productcert/pdf/ssa-566905.pdf
CVE: CVE-2022-43768
Published: 2023-04-11
Description: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SIMATIC CP 443-1 (6GK7443-1EX30-0XE0) (All versions < V3.3), SIMATIC CP 443-1 (6GK7443-1EX30-0XE1) (All versions < V3.3), SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) (All versions < V3.3), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) (All versions < V3.4.29), SIPLUS NET CP 443-1 (6AG1443-1EX30-4XE0) (All versions < V3.3), SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0) (All versions < V3.3), SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) (All versions < V3.4.29), SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) (All versions < V3.4.29), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.3.6), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.3.6). The webserver of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation of the webserver of the affected product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://cert-portal.siemens.com/productcert/html/ssa-139628.html; https://cert-portal.siemens.com/productcert/html/ssa-566905.html; https://cert-portal.siemens.com/productcert/pdf/ssa-566905.pdf
CVE: CVE-2023-1974
Published: 2023-04-11
Description: Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1230
References: https://github.com/answerdev/answer/commit/ac3f2f047ee00b4edaea7530e570ab67ff87cd6a; https://huntr.dev/bounties/852781c6-9cc8-4d25-9336-bf3cb8ee3439; https://github.com/answerdev/answer/commit/ac3f2f047ee00b4edaea7530e570ab67ff87cd6a
CVE: CVE-2023-1975
Published: 2023-04-11
Description: Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://github.com/answerdev/answer/commit/ac3f2f047ee00b4edaea7530e570ab67ff87cd6a; https://huntr.dev/bounties/829cab7a-4ed7-465c-aa96-29f4f73dbfff; https://github.com/answerdev/answer/commit/ac3f2f047ee00b4edaea7530e570ab67ff87cd6a
CVE: CVE-2023-23588
Published: 2023-04-11
Description: A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC647D (All versions), SIMATIC IPC647E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC847D (All versions), SIMATIC IPC847E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows). The Adaptec Maxview application on affected devices is using a non-unique TLS certificate across installations to protect the communication from the local browser to the local application.
A local attacker may use this key to decrypt intercepted local traffic between the browser and the application and could perform a man-in-the-middle attack in order to modify data in transit.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200, CWE-295
References: https://cert-portal.siemens.com/productcert/pdf/ssa-511182.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-511182.pdf
CVE: CVE-2023-26293
Published: 2023-04-11
Description: A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-22
References: https://cert-portal.siemens.com/productcert/html/ssa-116924.html; https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf
CVE: CVE-2023-27464
Published: 2023-04-11
Description: A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.1), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.1.1). The affected versions of the module contain an observable response discrepancy issue that could allow an attacker to retrieve sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://cert-portal.siemens.com/productcert/pdf/ssa-699404.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-699404.pdf
CVE: CVE-2023-28489
Published: 2023-04-11
Description: A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter “Remote Operation” is enabled. The parameter is disabled by default.
The vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html; http://seclists.org/fulldisclosure/2023/Jul/14; https://cert-portal.siemens.com/productcert/pdf/ssa-472454.pdf
CVE: CVE-2023-28828
Published: 2023-04-11
Description: A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-611
References: https://cert-portal.siemens.com/productcert/pdf/ssa-632164.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-632164.pdf
CVE: CVE-2023-29053
Published: 2023-04-11
Description: A vulnerability has been identified in JT Open (All versions < V11.3.2.0), JT Utilities (All versions < V13.3.0.0). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-642810.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-642810.pdf
CVE: CVE-2023-29054
Published: 2023-04-11
Description: A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SIPLUS NET SCALANCE X202-2P IRT (All versions < V5.5.2). The SSH server on affected devices is configured to offer weak ciphers by default.

This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data
passed over the connection between legitimate clients and the affected device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-326
References: https://cert-portal.siemens.com/productcert/pdf/ssa-479249.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-479249.pdf
CVE: CVE-2023-1976
Published: 2023-04-11
Description: Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-263
References: https://github.com/answerdev/answer/commit/813ad0b9894673b1bdd489a2e9ab60a44fe990af; https://huntr.dev/bounties/469bcabf-b315-4750-b63c-82ac86d153de; https://github.com/answerdev/answer/commit/813ad0b9894673b1bdd489a2e9ab60a44fe990af
CVE: CVE-2022-47335
Published: 2023-04-11
Description: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2022-47336
Published: 2023-04-11
Description: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2022-47337
Published: 2023-04-11
Description: In media service, there is a missing permission check. This could lead to local denial of service in media service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2022-47338
Published: 2023-04-11
Description: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS Score: 7.1 (HIGH)
CWE: CWE-668, CWE-668
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2022-47362
Published: 2023-04-11
Description: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2022-47463
Published: 2023-04-11
Description: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2022-47464
Published: 2023-04-11
Description: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2022-47465
Published: 2023-04-11
Description: In vdsp service, there is a missing permission check. This could lead to local denial of service in vdsp service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2022-47466
Published: 2023-04-11
Description: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2022-47467
Published: 2023-04-11
Description: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2022-47468
Published: 2023-04-11
Description: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]35218690
CVE: CVE-2023-26917
Published: 2023-04-11
Description: libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/CESNET/libyang/issues/1987; https://github.com/CESNET/libyang/issues/1987
CVE: CVE-2023-27179
Published: 2023-04-11
Description: GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434, CWE-434
References: http://packetstormsecurity.com/files/171894/GDidees-CMS-3.9.1-Local-File-Disclosure-Directory-Traversal.html; https://gist.github.com/Hadi999/516aa25b953b0cba57089a0c11b1305b; https://knowledge-base.secureflag.com/vulnerabilities/unrestricted_file_download/unrestricted_file_download_vulnerability.html