deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-34458
Published: 2023-02-01
Description: 
Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in download operation component. A local malicious user could potentially exploit this vulnerability leading to the disclosure of confidential data.






CVSS Score: 6.6 (MEDIUM)
CWE: CWE-497
References: https://www.dell.com/support/kbdoc/en-us/000204950/dsa-2022-298; https://www.dell.com/support/kbdoc/en-us/000204950/dsa-2022-298
CVE: CVE-2022-34459
Published: 2023-02-01
Description: 
Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature in get applicable driver component. A local malicious user could potentially exploit this vulnerability leading to malicious payload execution.






CVSS Score: 7.8 (HIGH)
CWE: CWE-347, CWE-347
References: https://www.dell.com/support/kbdoc/en-us/000204950/dsa-2022-298; https://www.dell.com/support/kbdoc/en-us/000204950/dsa-2022-298
CVE: CVE-2022-45095
Published: 2023-02-01
Description: 
Dell PowerScale OneFS, 8.2.x-9.4.x, contain a command injection vulnerability. An authenticated user having access local shell and having the privilege to gather logs from the cluster could potentially exploit this vulnerability, leading to execute arbitrary commands, denial of service, information disclosure, and data deletion.






CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
CVE: CVE-2022-45096
Published: 2023-02-01
Description: 
Dell PowerScale OneFS, 8.2.0 through 9.3.0, contain an User Interface Security Issue. An unauthenticated remote user could unintentionally lead an administrator to enable this vulnerability, leading to disclosure of information.






CVSS Score: 5.4 (MEDIUM)
CWE: CWE-355, CWE-1021
References: https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
CVE: CVE-2022-45097
Published: 2023-02-01
Description: 
Dell PowerScale OneFS 9.0.0.x-9.4.0.x contains an Incorrect User Management vulnerability. A low privileged network attacker could potentially exploit this vulnerability, leading to escalation of privileges, and information disclosure.






CVSS Score: 6.3 (MEDIUM)
CWE: CWE-842
References: https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
CVE: CVE-2022-45101
Published: 2023-02-01
Description: 
Dell PowerScale OneFS 9.0.0.x - 9.4.0.x, contains an Improper Handling of Insufficient Privileges vulnerability in NFS. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure and remote execution.






CVSS Score: 7.3 (HIGH)
CWE: CWE-274, CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
CVE: CVE-2022-32482
Published: 2023-02-01
Description: 
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable.






CVSS Score: 5.6 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000205717/dsa-2022-326; https://www.dell.com/support/kbdoc/en-us/000205717/dsa-2022-326
CVE: CVE-2022-34396
Published: 2023-02-01
Description: 
Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability. A local low privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges. Exploitation may lead to a complete system compromise.






CVSS Score: 7.0 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.dell.com/support/kbdoc/en-us/000206609/dsa-2022-321-dell-openmanage-server-administrator-omsa-security-update-for-dll-injection-vulnerability; https://www.dell.com/support/kbdoc/en-us/000206609/dsa-2022-321-dell-openmanage-server-administrator-omsa-security-update-for-dll-injection-vulnerability
CVE: CVE-2022-34398
Published: 2023-02-01
Description: 
Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system.






CVSS Score: 7.5 (HIGH)
CWE: CWE-367, CWE-367
References: https://www.dell.com/support/kbdoc/000206038; https://www.dell.com/support/kbdoc/000206038
CVE: CVE-2022-34403
Published: 2023-02-01
Description: 
Dell BIOS contains a Stack based buffer overflow vulnerability. A local authenticated attacker could potentially exploit this vulnerability by using an SMI to send larger than expected input to a parameter to gain arbitrary code execution in SMRAM.






CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/000205716; https://www.dell.com/support/kbdoc/000205716
CVE: CVE-2022-45098
Published: 2023-02-01
Description: 
Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 component. An authenticated local attacker could potentially exploit this vulnerability, leading to information disclosure.






CVSS Score: 6.1 (MEDIUM)
CWE: CWE-532, CWE-312
References: https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
CVE: CVE-2022-45099
Published: 2023-02-01
Description: 
Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit this vulnerability, leading to a full system compromise






CVSS Score: 7.8 (HIGH)
CWE: CWE-261, CWE-276
References: https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
CVE: CVE-2022-45100
Published: 2023-02-01
Description: 
Dell PowerScale OneFS, versions 8.2.x-9.3.x, contains an Improper Certificate Validation vulnerability. An remote unauthenticated attacker could potentially exploit this vulnerability, leading to a full compromise of the system.






CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
CVE: CVE-2022-45102
Published: 2023-02-01
Description: 
Dell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary \u2018Host\u2019 header values to poison a web cache or trigger redirections.






CVSS Score: 5.4 (MEDIUM)
CWE: CWE-644, CWE-116
References: https://www.dell.com/support/kbdoc/en-us/000206329/dsa-2022-348-dell-emc-data-protection-central-security-update-for-proprietary-code-vulnerability; https://www.dell.com/support/kbdoc/en-us/000206329/dsa-2022-348-dell-emc-data-protection-central-security-update-for-proprietary-code-vulnerability
CVE: CVE-2022-46679
Published: 2023-02-01
Description: 
Dell PowerScale OneFS 8.2.x, 9.0.0.x - 9.4.0.x, contain an insufficient resource pool vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.






CVSS Score: 6.5 (MEDIUM)
CWE: CWE-410
References: https://www.dell.com/support/kbdoc/en-us/000206927/dsa-2022-323-dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000206927/dsa-2022-323-dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
CVE: CVE-2022-46756
Published: 2023-02-01
Description: 
Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the container's underlying OS. Exploitation may lead to a system take over by an attacker.






CVSS Score: 8.2 (HIGH)
CWE: CWE-668, CWE-668
References: https://www.dell.com/support/kbdoc/000206943; https://www.dell.com/support/kbdoc/000206943
CVE: CVE-2023-0608
Published: 2023-02-01
Description: Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/commit/20df56615e61624f5fff[PII_REDACTED]9e4b3b936; https://huntr.dev/bounties/02a86e0d-dff7-4e27-89d5-2f7dcd4b580c; https://github.com/microweber/microweber/commit/20df56615e61624f5fff[PII_REDACTED]9e4b3b936
CVE: CVE-2020-14395
Published: 2023-02-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2021-3439
Published: 2023-02-01
Description: HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vulnerabilities.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_3[PII_REDACTED]351-16/hpsbhf03735; https://support.hp.com/us-en/document/ish_3[PII_REDACTED]351-16/hpsbhf03735
CVE: CVE-2021-3808
Published: 2023-02-01
Description: Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]761-16/hpsbhf03788; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]761-16/hpsbhf03788
CVE: CVE-2021-3809
Published: 2023-02-01
Description: Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]761-16/hpsbhf03788; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]761-16/hpsbhf03788
CVE: CVE-2022-23453
Published: 2023-02-01
Description: Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16/hpsbgn03762; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16/hpsbgn03762
CVE: CVE-2022-23454
Published: 2023-02-01
Description: Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16/hpsbgn03762; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16/hpsbgn03762
CVE: CVE-2022-23455
Published: 2023-02-01
Description: Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16/hpsbgn03762; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16/hpsbgn03762
CVE: CVE-2022-27537
Published: 2023-02-01
Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these potential vulnerabilities.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]458-16/hpsbhf03806; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]458-16/hpsbhf03806
CVE: CVE-2022-27538
Published: 2023-02-01
Description: A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]107-16/hpsbhf03827; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]107-16/hpsbhf03827
CVE: CVE-2022-3990
Published: 2023-02-01
Description: HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates should have already received the remediation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]658-16; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]658-16
CVE: CVE-2023-0115
Published: 2023-02-01
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-24977
Published: 2023-02-01
Description: Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick  https://github.com/apache/inlong/pull/7214 https://github.com/apache/inlong/pull/7214  to solve it.


CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://lists.apache.org/thread/ggozxorctn3tdll7bgmpwwcbjnd0s6w7; https://lists.apache.org/thread/ggozxorctn3tdll7bgmpwwcbjnd0s6w7
CVE: CVE-2023-0609
Published: 2023-02-01
Description: Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/wallabag/wallabag/commit/0f7460dbab9e29f4f7d2944aca20210f828b6abb; https://huntr.dev/bounties/3adef66f-fc86-4e6d-a540-2ffa59342ff0; https://github.com/wallabag/wallabag/commit/0f7460dbab9e29f4f7d2944aca20210f828b6abb
CVE: CVE-2023-0610
Published: 2023-02-01
Description: Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/wallabag/wallabag/commit/5ac6b6bff9e2e3a87fd88c2904ff3c6aac40722e; https://huntr.dev/bounties/8fdd9b31-d89b-4bbe-9557-20b960faf926; https://github.com/wallabag/wallabag/commit/5ac6b6bff9e2e3a87fd88c2904ff3c6aac40722e
CVE: CVE-2023-22572
Published: 2023-02-01
Description: 
Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A low privilege local attacker could potentially exploit this vulnerability, leading to system takeover.


CVSS Score: 7.8 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security; https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security
CVE: CVE-2023-23692
Published: 2023-02-01
Description: 
Dell EMC prior to version DDOS 7.9 contain(s) an OS command injection Vulnerability. An authenticated non admin attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application.


CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000201296/dsa-2022-187-dell-technologies-powerprotect-data-domain-security-update-for-multiple-third-party-component-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201296/dsa-2022-187-dell-technologies-powerprotect-data-domain-security-update-for-multiple-third-party-component-vulnerabilities
CVE: CVE-2022-47002
Published: 2023-02-01
Description: A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/MasaCMS/MasaCMS/releases/tag/7.3.10; https://www.hoyahaxa.com/2023/01/preliminary-security-advisory.html; https://www.hoyahaxa.com/2023/03/authentication-bypass-mura-masa.html
CVE: CVE-2022-47003
Published: 2023-02-01
Description: A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://mura.com; https://hoyahaxa.blogspot.com/2023/01/preliminary-security-advisory.html; https://hoyahaxa.blogspot.com/2023/03/authentication-bypass-mura-masa.html
CVE: CVE-2022-47714
Published: 2023-02-01
Description: Last Yard 22.09.8-1 does not enforce HSTS headers
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319, CWE-319
References: https://github.com/l00neyhacker/CVE-2022-47714; https://github.com/l00neyhacker/CVE-2022-47714
CVE: CVE-2022-47715
Published: 2023-02-01
Description: In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://github.com/l00neyhacker/CVE-2022-47715; https://github.com/l00neyhacker/CVE-2022-47715
CVE: CVE-2022-47717
Published: 2023-02-01
Description: Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-942
References: https://github.com/l00neyhacker/CVE-2022-47717; https://github.com/l00neyhacker/CVE-2022-47717
CVE: CVE-2023-0611
Published: 2023-02-01
Description: A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing of the file get_set.ccp of the component Web Management Interface. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219935.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://vuldb.com/?ctiid.219935; https://vuldb.com/?id.219935; https://vuldb.com/?ctiid.219935
CVE: CVE-2023-0612
Published: 2023-02-01
Description: A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /wireless/basic.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219936.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://vuldb.com/?ctiid.219936; https://vuldb.com/?id.219936; https://vuldb.com/?ctiid.219936
CVE: CVE-2023-0613
Published: 2023-02-01
Description: A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /wireless/security.asp of the component httpd. The manipulation leads to memory corruption. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219937 was assigned to this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://vuldb.com/?ctiid.219937; https://vuldb.com/?id.219937; https://vuldb.com/?ctiid.219937
CVE: CVE-2023-22573
Published: 2023-02-01
Description: Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. A low privileged local attacker could potentially exploit this vulnerability, leading to sensitive information disclosure.


CVSS Score: 7.9 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security; https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security
CVE: CVE-2023-22574
Published: 2023-02-01
Description: 
Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI module. A low-privileged user with permission to read logs on the cluster could potentially exploit this vulnerability, leading to Information disclosure and denial of service.


CVSS Score: 8.1 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security; https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security
CVE: CVE-2023-22575
Published: 2023-02-01
Description: Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. A low privileges user could potentially exploit this vulnerability, leading to information disclosure and escalation of privileges.


CVSS Score: 8.7 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security; https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security
CVE: CVE-2023-23126
Published: 2023-02-01
Description: Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://github.com/l00neyhacker/CVE-2023-23126; https://github.com/l00neyhacker/CVE-2023-23126
CVE: CVE-2023-23127
Published: 2023-02-01
Description: In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://github.com/l00neyhacker/CVE-2023-23127; https://github.com/l00neyhacker/CVE-2023-23127
CVE: CVE-2023-23128
Published: 2023-02-01
Description: Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and that there is no risk from this behavior. The vulnerability report is thus not valid.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-942
References: https://github.com/l00neyhacker/CVE-2023-23128; https://github.com/l00neyhacker/CVE-2023-23128