deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-21266
Published: 2023-10-06
Description: In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/fa94ce5c7738e449cb6bd68c77af4858018e49e0; https://source.android.com/security/bulletin/2024-06-01; https://android.googlesource.com/platform/frameworks/base/+/fa94ce5c7738e449cb6bd68c77af4858018e49e0
CVE: CVE-2023-21291
Published: 2023-10-06
Description: In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://android.googlesource.com/platform/frameworks/base/+/cb6282e8970f4c9db[PII_REDACTED]e68fb2038566e; https://source.android.com/security/bulletin/2023-10-01; https://android.googlesource.com/platform/frameworks/base/+/cb6282e8970f4c9db[PII_REDACTED]e68fb2038566e
CVE: CVE-2023-45282
Published: 2023-10-06
Description: In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://github.com/nasa/openmct/compare/v3.0.2...v3.1.0; https://github.com/nasa/openmct/pull/7094/commits/545a1770c523ecc3410dca884c6809d5ff0f9d52; https://nasa.github.io/openmct/
CVE: CVE-2023-45303
Published: 2023-10-06
Description: ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).
CVSS Score: 8.4 (HIGH)
CWE: CWE-74, CWE-74
References: https://freemarker.apache.org/docs/api/freemarker/template/utility/Execute.html; https://herolab.usd.de/security-advisories/usd-2023-0010/; https://freemarker.apache.org/docs/api/freemarker/template/utility/Execute.html
CVE: CVE-2023-5452
Published: 2023-10-06
Description: Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/snipe/snipe-it/commit/eea2eabaeef16fc8f3a1d61b19c06e9fc8ed942a; https://huntr.dev/bounties/d6ed5ac1-2ad6-45fd-9492-979820bf60c8; https://github.com/snipe/snipe-it/commit/eea2eabaeef16fc8f3a1d61b19c06e9fc8ed942a
CVE: CVE-2022-34355
Published: 2023-10-06
Description: IBM Jazz Foundation (IBM Engineering Lifecycle Management 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) could disclose sensitive version information to a user that could be used in further attacks against the system.  IBM X-Force ID:  230498.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230498; https://www.ibm.com/support/pages/node/7046995; https://exchange.xforce.ibmcloud.com/vulnerabilities/230498
CVE: CVE-2023-3725
Published: 2023-10-06
Description: Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem
CVSS Score: 7.6 (HIGH)
CWE: CWE-120, CWE-121, CWE-787
References: http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html; http://seclists.org/fulldisclosure/2023/Nov/1; http://www.openwall.com/lists/oss-security/2023/11/07/1
CVE: CVE-2023-45311
Published: 2023-10-06
Description: fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/atlassian/moo/blob/56ccbdd41b493332bc2cd7a4097a5802594cdb9c/package-lock.json#L1901-L1902; https://github.com/atlassian/react-immutable-proptypes/blob/ddb9fa5194b931bf7528eb4f2c0a8c3434f70edd/package-lock.json#L153; https://github.com/cloudflare/authr/blob/3f6129d97d06e61033a7f237d84e35e678db490f/ts/package-lock.json#L1512
CVE: CVE-2022-33160
Published: 2023-10-06
Description: IBM Security Directory Suite 8.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  228568.
CVSS Score: 3.7 (LOW)
CWE: CWE-757, CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228568; https://www.ibm.com/support/pages/node/7047071; https://exchange.xforce.ibmcloud.com/vulnerabilities/228568
CVE: CVE-2023-45322
Published: 2023-10-06
Description: libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2023/10/06/5; https://gitlab.gnome.org/GNOME/libxml2/-/issues/344; https://gitlab.gnome.org/GNOME/libxml2/-/issues/583
CVE: CVE-2023-44061
Published: 2023-10-06
Description: File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit profile component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/soundarkutty/File-upload-Restriction-bypass/blob/main/poc.md; https://github.com/soundarkutty/File-upload-Restriction-bypass/blob/main/poc.md
CVE: CVE-2023-44860
Published: 2023-10-06
Description: An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/Improper%20Authentication%20Mechanism%20Leading%20to%20Denial-of-Service%20%28DoS%29.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/Improper%20Authentication%20Mechanism%20Leading%20to%20Denial-of-Service%20%28DoS%29.md
CVE: CVE-2023-36123
Published: 2023-10-07
Description: Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code and gain sensitive information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://gist.github.com/9Bakabaka/d4559b081ce0577dbf415917afc0efb5; https://github.com/9Bakabaka/CVE-2023-36123; https://gist.github.com/9Bakabaka/d4559b081ce0577dbf415917afc0efb5
CVE: CVE-2023-5182
Published: 2023-10-07
Description: Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwords and possibly escalate their privilege.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5182; https://github.com/canonical/subiquity/pull/1820/commits/62e126896fb063808767d74d00886001e38eaa1c; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5182
CVE: CVE-2023-43615
Published: 2023-10-07
Description: Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDSHAANRULB57GVS5B3DZHXL5KCC7OWQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGRB5MO2KUJKYPMGXMIZH2WRH6QR5UZS/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7SB7L6A56QZALDTOZ6O4X7PTC4I647R/
CVE: CVE-2023-45199
Published: 2023-10-07
Description: Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2023-10-2/; https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2023-10-2/
CVE: CVE-2023-40631
Published: 2023-10-08
Description: In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40632
Published: 2023-10-08
Description: In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execution privileges needed
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40633
Published: 2023-10-08
Description: In phasecheckserver, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40634
Published: 2023-10-08
Description: In phasechecksercer, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40635
Published: 2023-10-08
Description: In linkturbo, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40636
Published: 2023-10-08
Description: In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40637
Published: 2023-10-08
Description: In telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40638
Published: 2023-10-08
Description: In Telecom service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40639
Published: 2023-10-08
Description: In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40640
Published: 2023-10-08
Description: In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40641
Published: 2023-10-08
Description: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40642
Published: 2023-10-08
Description: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40643
Published: 2023-10-08
Description: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40644
Published: 2023-10-08
Description: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40645
Published: 2023-10-08
Description: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40646
Published: 2023-10-08
Description: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40647
Published: 2023-10-08
Description: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40648
Published: 2023-10-08
Description: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40649
Published: 2023-10-08
Description: In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40650
Published: 2023-10-08
Description: In Telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40651
Published: 2023-10-08
Description: In urild service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40652
Published: 2023-10-08
Description: In jpg driver, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with System execution privileges needed
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40653
Published: 2023-10-08
Description: In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-40654
Published: 2023-10-08
Description: In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074; https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]18531074
CVE: CVE-2023-45349
Published: 2023-10-09
Description: Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.34.7, 4000 Assistant V10 R1.42.0, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.34.7, 4000 Manager V10 R1.42.0, and 4000 Manager V10 R0 expose sensitive information that may allow lateral movement to the backup system via AShbr. This is also known as OSFOURK-23722.
CVSS Score: 7.5 (HIGH)
References: https://networks.unify.com/security/advisories/OBSO-2306-01.pdf; https://www.news.de/technik/856969401/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/; https://networks.unify.com/security/advisories/OBSO-2306-01.pdf
CVE: CVE-2023-45350
Published: 2023-10-09
Description: Atos Unify OpenScape 4000 Manager V10 R1 before V10 R1.42.1 and 4000 Manager V10 R0 allow Privilege escalation that may lead to the ability of an authenticated attacker to run arbitrary code via AScm. This is also known as OSFOURK-24034.
CVSS Score: 8.8 (HIGH)
References: https://networks.unify.com/security/advisories/OBSO-2306-01.pdf; https://www.news.de/technik/856969401/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/; https://networks.unify.com/security/advisories/OBSO-2306-01.pdf
CVE: CVE-2023-45351
Published: 2023-10-09
Description: Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.42.1, and 4000 Manager V10 R0 allow Authenticated Command Injection via AShbr. This is also known as OSFOURK-24039.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://networks.unify.com/security/advisories/OBSO-2306-01.pdf; https://www.news.de/technik/856969401/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/; https://networks.unify.com/security/advisories/OBSO-2306-01.pdf
CVE: CVE-2023-45352
Published: 2023-10-09
Description: Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating system via a Common Management Portal web interface Path traversal vulnerability allowing write access outside the intended folders. This is also known as OCMP-6592.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://networks.unify.com/security/advisories/OBSO-2306-02.pdf; https://www.news.de/technik/857003738/unify-openscape-common-management-platform-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-update-zu-bekannten-schwachstellen-und-sicherheitsluecken-vom-03-07-2023/1/; https://networks.unify.com/security/advisories/OBSO-2306-02.pdf