deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27796
Published: 2023-03-26
Description: RG-EW1200G PRO Wireless Routers EW_3.0(1)B11P204, RG-EW1800GX PRO Wireless Routers EW_3.0(1)B11P204, and RG-EW3200GX PRO Wireless Routers EW_3.0(1)B11P204 were discovered to contain multiple command injection vulnerabilities via the data.ip, data.protocal, data.iface and data.package parameters in the runPackDiagnose function of diagnose.lua.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/winmt/my-vuls/tree/main/RG-EW%20PRO%20Series; https://github.com/winmt/my-vuls/tree/main/RG-EW%20PRO%20Series
CVE: CVE-2023-1640
Published: 2023-03-26
Description: A vulnerability classified as problematic was found in IObit Malware Fighter 9.4.0.776. This vulnerability affects the function 0x222010 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224020.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/file/d/1AcwSxTA0_zh7mmxU5J8WphRqg_mQsO-g/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1640; https://vuldb.com/?ctiid.224020
CVE: CVE-2023-1641
Published: 2023-03-26
Description: A vulnerability, which was classified as problematic, has been found in IObit Malware Fighter 9.4.0.776. This issue affects the function 0x222018 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-224021 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/file/d/1ncqfaxSdeu-mGVAOnYxqxYtyyFZClHBF/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1641; https://vuldb.com/?ctiid.224021
CVE: CVE-2023-1642
Published: 2023-03-26
Description: A vulnerability, which was classified as problematic, was found in IObit Malware Fighter 9.4.0.776. Affected is the function 0x222034/0x222038/0x22203C/0x222040 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. VDB-224022 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/file/d/1iWdqJ9PsBp1W5xINpUdQ28xbx_tB9xxf/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1642; https://vuldb.com/?ctiid.224022
CVE: CVE-2023-1643
Published: 2023-03-26
Description: A vulnerability has been found in IObit Malware Fighter 9.4.0.776 and classified as problematic. Affected by this vulnerability is the function 0x8001E000/0x8001E004/0x8001E018/0x8001E01C/0x8001E024/0x8001E040 in the library ImfHpRegFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224023.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/file/d/1dHdltwenfMdwAPeb3JPex0fHxfK_iLYh/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1643; https://vuldb.com/?ctiid.224023
CVE: CVE-2023-1644
Published: 2023-03-26
Description: A vulnerability was found in IObit Malware Fighter 9.4.0.776 and classified as problematic. Affected by this issue is the function 0x8018E010 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224024.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/file/d/1TVezyDiS9Kyw7ttNlLBCstpEUqxozha0/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1644; https://vuldb.com/?ctiid.224024
CVE: CVE-2023-1645
Published: 2023-03-26
Description: A vulnerability was found in IObit Malware Fighter 9.4.0.776. It has been classified as problematic. This affects the function 0x8018E008 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-224025 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/file/d/1RmFSm1sQWwQXPXjkeZtgf8q51hGD8tTf/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1645; https://vuldb.com/?ctiid.224025
CVE: CVE-2023-1646
Published: 2023-03-26
Description: A vulnerability was found in IObit Malware Fighter 9.4.0.776. It has been declared as critical. This vulnerability affects the function 0x8018E000/0x8018E004 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. VDB-224026 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://drive.google.com/file/d/1GITWzh29cRcycVqVJgMJuX6emE_f1KPV/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1646; https://vuldb.com/?ctiid.224026
CVE: CVE-2023-1647
Published: 2023-03-27
Description: Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.


CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/sbs20/scanservjs/pull/606/commits/d51fd52c[PII_REDACTED]b8f74e64ae6979c665dca1; https://huntr.dev/bounties/d6de3d6e-9551-47d1-b28c-7e965c1b82b6; https://github.com/sbs20/scanservjs/pull/606/commits/d51fd52c[PII_REDACTED]b8f74e64ae6979c665dca1
CVE: CVE-2023-28866
Published: 2023-03-27
Description: In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=95084403f8c070ccf5d7cbe72352519c1798a40a; https://lore.kernel.org/lkml/[PII_REDACTED]5[PII_REDACTED]-1-iam%40sung-woo.kim/; https://patchwork.kernel.org/project/bluetooth/patch/[PII_REDACTED]2[PII_REDACTED]-1-luiz.dentz%40gmail.com
CVE: CVE-2023-28867
Published: 2023-03-27
Description: In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/graphql-java/graphql-java/pull/3112; https://github.com/graphql-java/graphql-java/releases/tag/v17.5; https://github.com/graphql-java/graphql-java/releases/tag/v18.4
CVE: CVE-2018-25083
Published: 2023-03-27
Description: The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb; https://security.snyk.io/vuln/npm:pullit:20180214; https://github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb
CVE: CVE-2023-28883
Published: 2023-03-27
Description: In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/cerebrate-project/cerebrate/commit/5f1c99cd534442ec40c[PII_REDACTED]e3e61ff8be3; https://zigrin.com/advisories/cerebrate-blind-sql-injection/; https://github.com/cerebrate-project/cerebrate/commit/5f1c99cd534442ec40c[PII_REDACTED]e3e61ff8be3
CVE: CVE-2023-28884
Published: 2023-03-27
Description: In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/b94c7978e5e6b1db369abeedbbf00bca975b08b7; https://zigrin.com/advisories/misp-dom-based-xss/; https://github.com/MISP/MISP/commit/b94c7978e5e6b1db369abeedbbf00bca975b08b7
CVE: CVE-2022-39043
Published: 2023-03-27
Description: Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts.
CVSS Score: 2.4 (LOW)
CWE: CWE-200, CWE-532, CWE-922
References: https://www.twcert.org.tw/tw/cp-132-6922-4a37a-1.html; https://www.twcert.org.tw/tw/cp-132-6922-4a37a-1.html
CVE: CVE-2023-22902
Published: 2023-03-27
Description: Openfind Mail2000 file uploading function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject JavaScript, conducting an XSS attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-6953-79236-1.html; https://www.twcert.org.tw/tw/cp-132-6953-79236-1.html
CVE: CVE-2023-24834
Published: 2023-03-27
Description: WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://www.twcert.org.tw/tw/cp-132-6954-ed16b-1.html; https://www.twcert.org.tw/tw/cp-132-6954-ed16b-1.html
CVE: CVE-2023-24835
Published: 2023-03-27
Description: Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker with administrator privilege can exploit this vulnerability to execute arbitrary system command to perform arbitrary system operation or disrupt service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://www.twcert.org.tw/tw/cp-132-6955-c7612-1.html; https://www.twcert.org.tw/tw/cp-132-6955-c7612-1.html
CVE: CVE-2023-24837
Published: 2023-03-27
Description: HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-6956-fbd85-1.html; https://www.twcert.org.tw/tw/cp-132-6956-fbd85-1.html
CVE: CVE-2023-24838
Published: 2023-03-27
Description: HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain the administrator's credential. This credential can then be used to login PowerStation or Secure Shell to achieve remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-306
References: https://www.twcert.org.tw/tw/cp-132-6957-d8f67-1.html; https://www.twcert.org.tw/tw/cp-132-6957-d8f67-1.html
CVE: CVE-2023-24839
Published: 2023-03-27
Description: HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript, conducting a reflected XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-6958-e1a8e-1.html; https://www.twcert.org.tw/tw/cp-132-6958-e1a8e-1.html
CVE: CVE-2023-24840
Published: 2023-03-27
Description: HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject SQL commands to read, modify, and delete the database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/tw/cp-132-6959-cdecb-1.html; https://www.twcert.org.tw/tw/cp-132-6959-cdecb-1.html
CVE: CVE-2023-24841
Published: 2023-03-27
Description: HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-6960-fc2fe-1.html; https://www.twcert.org.tw/tw/cp-132-6960-fc2fe-1.html
CVE: CVE-2023-24842
Published: 2023-03-27
Description: HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access partial content of another user’s mail by changing user ID and mail ID within URL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.twcert.org.tw/tw/cp-132-6961-12444-1.html; https://www.twcert.org.tw/tw/cp-132-6961-12444-1.html
CVE: CVE-2023-25017
Published: 2023-03-27
Description: RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://www.twcert.org.tw/tw/cp-132-6962-34ac1-1.html; https://www.twcert.org.tw/tw/cp-132-6962-34ac1-1.html
CVE: CVE-2023-25018
Published: 2023-03-27
Description: RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can inject JavaScript to perform reflected XSS (Reflected Cross-site scripting) attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-6963-7d2ee-1.html; https://www.twcert.org.tw/tw/cp-132-6963-7d2ee-1.html
CVE: CVE-2023-25909
Published: 2023-03-27
Description: HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary command or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.twcert.org.tw/tw/cp-132-6973-45872-1.html; https://www.twcert.org.tw/tw/cp-132-6973-45872-1.html
CVE: CVE-2023-28885
Published: 2023-03-27
Description: The MyLink infotainment system (build 2021.3.26) in General Motors Chevrolet Equinox 2021 vehicles allows attackers to cause a denial of service (temporary failure of Media Player functionality) via a crafted MP3 file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/zj3t/Automotive-vulnerabilities/tree/main/GM/Chevrolet_Equinox2021; https://github.com/zj3t/GM_Vulnerability; https://github.com/zj3t/Automotive-vulnerabilities/tree/main/GM/Chevrolet_Equinox2021
CVE: CVE-2022-4126
Published: 2023-03-27
Description: Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: before 4.40 230207.


CVSS Score: 9.6 (CRITICAL)
CWE: CWE-1393, CWE-287
References: https://search.abb.com/library/Download.aspx?DocumentID=2CMT006099_EN&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2CMT006099_EN&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2022-32199
Published: 2023-03-27
Description: db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/Toxich4/CVE-2022-32199; https://www.scriptcase.net/download/; https://github.com/Toxich4/CVE-2022-32199
CVE: CVE-2022-30705
Published: 2023-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wordpress-ping-optimizer/wordpress-ping-optimizer-plugin-2-35-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wordpress-ping-optimizer/wordpress-ping-optimizer-plugin-2-35-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-41354
Published: 2023-03-27
Description: An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: http://argo.com; https://github.com/argoproj/argo-cd/security/advisories/GHSA-2q5c-qw9c-fmvq; https://github.com/chunklhit/cve/blob/master/argo/argo-cd/application_enumeration.md
CVE: CVE-2022-46843
Published: 2023-03-27
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Le Van Toan Woocommerce Vietnam Checkout plugin <= 2.0.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-vietnam-checkout/wordpress-woocommerce-vietnam-checkout-plugin-2-0-4-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/woo-vietnam-checkout/wordpress-woocommerce-vietnam-checkout-plugin-2-0-4-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-47924
Published: 2023-03-27
Description: An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wich can result in arbitrary code execution and DoS once the users triggers the validation.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0004.json; https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0004.json
CVE: CVE-2022-47925
Published: 2023-03-27
Description: The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insufficient input validation of requests by an unauthenticated remote user might lead to a partial DoS of the service. Only the request of the attacker is affected by this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0004.json; https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0004.json
CVE: CVE-2023-24094
Published: 2023-03-27
Description: An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: http://mikrotik.com; http://routeros.com; https://github.com/ZYen12138/RouterOS/blob/main/CVE-2023-24094.md
CVE: CVE-2023-26958
Published: 2023-03-27
Description: Phpgurukul Park Ticketing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Admin Name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40shiva.infocop/stored-xss-park-ticketing-management-system-phpgurukul-893583dc2e20; https://medium.com/%40shiva.infocop/stored-xss-park-ticketing-management-system-phpgurukul-893583dc2e20
CVE: CVE-2023-26959
Published: 2023-03-27
Description: Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://medium.com/%40shiva.infocop/authentication-bypass-park-ticketing-management-system-phpgurukul-427045159c05; https://medium.com/%40shiva.infocop/authentication-bypass-park-ticketing-management-system-phpgurukul-427045159c05
CVE: CVE-2023-27096
Published: 2023-03-27
Description: Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyController function of the Tenant Management module.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://github.com/opengoofy/hippo4j/issues/1060; https://github.com/opengoofy/hippo4j/issues/1060
CVE: CVE-2022-47146
Published: 2023-03-27
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/realestate-7/wordpress-real-estate-7-theme-3-3-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/realestate-7/wordpress-real-estate-7-theme-3-3-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-1133
Published: 2023-03-27
Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow an unauthenticated attacker to remotely execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://packetstormsecurity.com/files/172799/Delta-Electronics-InfraSuite-Device-Master-Deserialization.html; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; http://packetstormsecurity.com/files/172799/Delta-Electronics-InfraSuite-Device-Master-Deserialization.html
CVE: CVE-2023-1134
Published: 2023-03-27
Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a path traversal vulnerability, which could allow an attacker to read local files, disclose plaintext credentials, and escalate privileges.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1135
Published: 2023-03-27
Description: 
























In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which could result in local privilege escalation.
























CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1136
Published: 2023-03-27
Description: In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authentication bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1137
Published: 2023-03-27
Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1138
Published: 2023-03-27
Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain an improper access control vulnerability, which could allow an attacker to retrieve Gateway configuration files to obtain plaintext credentials.
CVSS Score: 7.5 (HIGH)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02
CVE: CVE-2023-1139
Published: 2023-03-27
Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-02