deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-32707
Published: 2023-06-01
Description: In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://advisory.splunk.com/advisories/SVD-2023-0602; https://research.splunk.com/application/39e1c326-67d7-4c0d-8[PII_REDACTED]f6593/; https://advisory.splunk.com/advisories/SVD-2023-0602
CVE: CVE-2023-32708
Published: 2023-06-01
Description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily.
CVSS Score: 7.2 (HIGH)
CWE: CWE-113, CWE-436
References: https://advisory.splunk.com/advisories/SVD-2023-0603; https://research.splunk.com/application/e615a0e1-a1b2-4196-9865-8aa646e1708c/; https://advisory.splunk.com/advisories/SVD-2023-0603
CVE: CVE-2023-32709
Published: 2023-06-01
Description: In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by using the ‘rest’ SPL command against the ‘conf-user-seed’ REST endpoint.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://advisory.splunk.com/advisories/SVD-2023-0604; https://research.splunk.com/application/a1be424d-e59c-4583-b6f9-2dcc23be4875/; https://advisory.splunk.com/advisories/SVD-2023-0604
CVE: CVE-2023-32710
Published: 2023-06-01
Description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyresults’ command if they know the search ID (SID) of a  search job that has recently run.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-200
References: https://advisory.splunk.com/advisories/SVD-2023-0609; https://advisory.splunk.com/advisories/SVD-2023-0609
CVE: CVE-2023-32711
Published: 2023-06-01
Description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework (CVE-2019-8331) and build a stored cross-site scripting (XSS) payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://advisory.splunk.com/advisories/SVD-2023-0605; https://research.splunk.com/application/8a43558f-a53c-4ee4-86c1-30b1e8ef3606/; https://advisory.splunk.com/advisories/SVD-2023-0605
CVE: CVE-2023-32712
Published: 2023-06-01
Description: In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the vulnerable application. This attack requires a user to use a terminal application that supports the translation of ANSI escape codes to read the malicious log file locally in the vulnerable terminal, and to perform additional user interaction to exploit.
Universal Forwarder versions 9.1.0.1, 9.0.5, 8.2.11, and lower can be vulnerable in situations where they have management services active and accessible over the network. Universal Forwarder versions 9.0.x and 9.1.x bind management services to the local machine and are not vulnerable in this specific configuration. See SVD-2022-0605 for more information. Universal Forwarder versions 9.1 use Unix Domain Sockets (UDS) for communication, which further reduces the potential attack surface.
The vulnerability does not directly affect Splunk Enterprise or Universal Forwarder. The indirect impact on Splunk Enterprise and Universal Forwarder can vary significantly depending on the permissions in the vulnerable terminal application and where and how the user reads the malicious log file. For example, users can copy the malicious file from the Splunk Enterprise instance and read it on their local machine.
CVSS Score: 8.6 (HIGH)
CWE: CWE-117, CWE-116, CWE-117
References: https://advisory.splunk.com/advisories/SVD-2023-0606; https://research.splunk.com/application/de3908dc-1298-446d-84b9-fa81d37e959b; https://advisory.splunk.com/advisories/SVD-2023-0606
CVE: CVE-2023-32713
Published: 2023-06-01
Description: In Splunk App for Stream versions below 8.1.1, a low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to escalate their privileges on the machine that runs the Splunk Enterprise instance, up to and including the root user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://advisory.splunk.com/advisories/SVD-2023-0607; https://advisory.splunk.com/advisories/SVD-2023-0607
CVE: CVE-2023-32714
Published: 2023-06-01
Description: In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35, CWE-22
References: https://advisory.splunk.com/advisories/SVD-2023-0608; https://research.splunk.com/application/8ed58987-738d-4917-9e44-b8ef6ab948a6/; https://advisory.splunk.com/advisories/SVD-2023-0608
CVE: CVE-2023-32715
Published: 2023-06-01
Description: In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript code. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser, and requires additional user interaction to trigger. The attacker cannot exploit the vulnerability at will.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://advisory.splunk.com/advisories/SVD-2023-0610; https://advisory.splunk.com/advisories/SVD-2023-0610
CVE: CVE-2023-32716
Published: 2023-06-01
Description: In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by crashing the Splunk daemon.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://advisory.splunk.com/advisories/SVD-2023-0611; https://research.splunk.com/application/fb0e6823-365f-48ed-b09e-272ac4c1dad6/; https://advisory.splunk.com/advisories/SVD-2023-0611
CVE: CVE-2023-32717
Published: 2023-06-01
Description: On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://advisory.splunk.com/advisories/SVD-2023-0612; https://research.splunk.com/application/bbe26f95-1655-471d-8abd-3d32fafa86f8/; https://advisory.splunk.com/advisories/SVD-2023-0612
CVE: CVE-2023-33960
Published: 2023-06-01
Description: OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains publicly available.

Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-319
References: https://community.openproject.org/wp/48324; https://github.com/opf/openproject/pull/12708; https://github.com/opf/openproject/releases/tag/v12.5.6
CVE: CVE-2023-34091
Published: 2023-06-01
Description: Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://github.com/kyverno/kyverno/releases/tag/v1.10.0; https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cc; https://github.com/kyverno/kyverno/releases/tag/v1.10.0
CVE: CVE-2023-34092
Published: 2023-06-01
Description: Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, and vite@2.9.16.
CVSS Score: 7.5 (HIGH)
CWE: CWE-50, CWE-200, CWE-706
References: https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32; https://github.com/vitejs/vite/pull/13348; https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67
CVE: CVE-2023-34339
Published: 2023-06-01
Description: In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message
CVSS Score: 3.3 (LOW)
CWE: CWE-209
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-33754
Published: 2023-06-01
Description: The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers to brute force valid user accounts to gain access to login credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://github.com/Alkatraz97/CVEs/blob/main/CVE-2023-33754.md; https://github.com/Alkatraz97/CVEs/blob/main/CVE-2023-33754.md
CVE: CVE-2023-33764
Published: 2023-06-01
Description: eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component #/de/casting/show/detail/<ID>.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33764; https://github.com/rauschecker/CVEs/tree/main/CVE-2023-33764
CVE: CVE-2023-27639
Published: 2023-06-01
Description: An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). Only files that can be parsed in XML can be opened. This is exploited in the wild in March 2023.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://friends-of-presta.github.io/security-advisories/module/2023/03/30/tshirtecommerce_cwe-22.html; https://friends-of-presta.github.io/security-advisories/module/2023/03/30/tshirtecommerce_cwe-22.html
CVE: CVE-2023-27640
Published: 2023-06-01
Description: An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter type in the /tshirtecommerce/fonts.php endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). The content of the file is returned with base64 encoding. This is exploited in the wild in March 2023.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://friends-of-presta.github.io/security-advisories/module/2023/03/30/tshirtecommerce_cwe-22.html; https://friends-of-presta.github.io/security-advisories/module/2023/03/30/tshirtecommerce_cwe-22.html
CVE: CVE-2023-29722
Published: 2023-06-01
Description: The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with this data to cause an escalation of privilege attack.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29722/CVE%20detail.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29722/CVE%20detail.md
CVE: CVE-2023-29723
Published: 2023-06-01
Description: The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting data, the attacker can force the application to load malicious image URLs and display them in the UI. As the amount of data increases, it will eventually cause the application to trigger an OOM error and crash, resulting in a persistent denial of service attack.
CVSS Score: 7.5 (HIGH)
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29723/CVE%20detail.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29723/CVE%20detail.md
CVE: CVE-2023-29736
Published: 2023-06-01
Description: Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its internal storage and achieve arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29736/CVE%20detail.md; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29736/CVE%20detail.md
CVE: CVE-2015-10110
Published: 2023-06-02
Description: A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability affects the function wp_show_room_spy of the file room-spy.php. The manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.9 is able to address this issue. The name of the patch is ab72627a963d61fb3bc31018e3855b08dc94a979. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230392.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/tinychat-roomspy/commit/ab72627a963d61fb3bc31018e3855b08dc94a979; https://vuldb.com/?ctiid.230392; https://vuldb.com/?id.230392
CVE: CVE-2016-15032
Published: 2023-06-02
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This affects the function stopOutput of the file class.tx_mhhttpbl.php. The manipulation of the argument $_SERVER['REMOTE_ADDR'] leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is named a754bf306a433a8c18b55e25595593e8f19b9463. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230391. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/mback2k/mh_httpbl/commit/a754bf306a433a8c18b55e25595593e8f19b9463; https://github.com/mback2k/mh_httpbl/releases/tag/mh_httpbl_1.1.8_security; https://vuldb.com/?ctiid.230391
CVE: CVE-2023-28147
Published: 2023-06-02
Description: An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r29p0 through r32p0, Bifrost r17p0 through r42p0 before r43p0, Valhall r19p0 through r42p0 before r43p0, and Arm's GPU Architecture Gen5 r41p0 through r42p0 before r43p0.
CVSS Score: 5.5 (MEDIUM)
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2022-45938
Published: 2023-06-02
Description: An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation..
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://my.xfinity.com/vulnerabilityreport; https://pensecure.medium.com/cve-2022-45938-f4c0d441da6f; https://my.xfinity.com/vulnerabilityreport
CVE: CVE-2023-27744
Published: 2023-06-02
Description: An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf; https://www.whiteoaksecurity.com/blog/titanftp-vulnerability-disclosure/; https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf
CVE: CVE-2023-27745
Published: 2023-06-02
Description: An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending requests to the user server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346
References: https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf; https://www.whiteoaksecurity.com/blog/titanftp-vulnerability-disclosure/; https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf
CVE: CVE-2023-29724
Published: 2023-06-02
Description: The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with this data to cause an escalation of privilege attack.
CVSS Score: 7.8 (HIGH)
References: http://bungaakpstudio007.com; https://apkpure.com/cn/bt21-x-bts-wallpaper-hd-4k/com.bungaakp007.bt21wallpaperoffline130920/download/12-APK; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29724/CVE%20detail.md
CVE: CVE-2023-29725
Published: 2023-06-02
Description: The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting data, the attacker can force the application to load malicious image URLs and display them in the UI. As the amount of data increases, it will eventually cause the application to trigger an OOM error and crash, resulting in a persistent denial of service attack.
CVSS Score: 5.5 (MEDIUM)
References: http://bungaakpstudio007.com; https://apkpure.com/cn/bt21-x-bts-wallpaper-hd-4k/com.bungaakp007.bt21wallpaperoffline130920/download/12-APK; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29725/CVE%20detail.md
CVE: CVE-2023-29746
Published: 2023-06-02
Description: An issue found in The Thaiger v.1.2 for Android allows unauthorized apps to cause a code execution attack by manipulating the SharedPreference files.
CVSS Score: 9.8 (CRITICAL)
References: https://apksos.com/app/story.saver.downloader.photo.video.repost.byrk; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29746/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.TheThaiger.android
CVE: CVE-2023-2201
Published: 2023-06-02
Description: The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.6.8  due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers with contributor-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/web-directory-free/tags/1.6.6/search/plugin/classes/search/search_forms_manager.php#L1425; https://plugins.trac.wordpress.org/browser/web-directory-free/tags/1.6.8/search/plugin/classes/search/search_forms_manager.php#L1391; https://plugins.trac.wordpress.org/changeset/3023559/web-directory-free/trunk/search/plugin/classes/search/search_forms_manager.php
CVE: CVE-2023-2060
Published: 2023-06-02
Description: Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to access to the module via FTP by dictionary attack or password sniffing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521, CWE-521
References: https://jvn.jp/vu/JVNVU92908006; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2023-004.pdf; https://jvn.jp/vu/JVNVU92908006
CVE: CVE-2023-2061
Published: 2023-06-02
Description: Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to obtain a hard-coded password and access to the module via FTP.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-259, CWE-798
References: https://jvn.jp/vu/JVNVU92908006; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2023-004.pdf; https://jvn.jp/vu/JVNVU92908006
CVE: CVE-2023-2062
Published: 2023-06-02
Description: Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a remote unauthenticated attacker to know the password for MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP. This vulnerability results in authentication bypass vulnerability, which allows the attacker to access MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP via FTP.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-549, CWE-668
References: https://jvn.jp/vu/JVNVU92908006; https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-02; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2023-004.pdf