deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-26461
Published: 2023-03-14
Description: SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files and data. It allows the attacker to view sensitive data which is owned by certain privileges.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-611
References: https://launchpad.support.sap.com/#/notes/3284550; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3284550
CVE: CVE-2023-27268
Published: 2023-03-14
Description: SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability., resulting in escalation of privileges.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://launchpad.support.sap.com/#/notes/3288480; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3288480
CVE: CVE-2023-27269
Published: 2023-03-14
Description: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files.  In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.


CVSS Score: 9.6 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://launchpad.support.sap.com/#/notes/3294595; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3294595
CVE: CVE-2023-27270
Published: 2023-03-14
Description: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://launchpad.support.sap.com/#/notes/3296328; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3296328
CVE: CVE-2023-27271
Published: 2023-03-14
Description: In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://launchpad.support.sap.com/#/notes/3287120; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3287120
CVE: CVE-2023-27498
Published: 2023-03-14
Description: SAP Host Agent (SAPOSCOL) - version 7.22, allows an unauthenticated attacker with network access to a server port assigned to the SAP Start Service to submit a crafted request which results in a memory corruption error. This error can be used to reveal but not modify any technical information about the server. It can also make a particular service temporarily unavailable


CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://launchpad.support.sap.com/#/notes/3275727; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3275727
CVE: CVE-2023-27500
Published: 2023-03-14
Description: An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no data can be read but potentially critical OS files can be over-written making the system unavailable.


CVSS Score: 9.6 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://launchpad.support.sap.com/#/notes/3302162; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3302162
CVE: CVE-2023-27501
Published: 2023-03-14
Description: SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity


CVSS Score: 8.7 (HIGH)
CWE: CWE-22
References: https://launchpad.support.sap.com/#/notes/3294954; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3294954
CVE: CVE-2023-27893
Published: 2023-03-14
Description: An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions 2088_1_700, 2008_1_710, 740, can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform.  Depending on the function executed, the attack can read or modify any user or application data and can make the application unavailable.


CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://launchpad.support.sap.com/#/notes/3296476; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3296476
CVE: CVE-2023-27894
Published: 2023-03-14
Description: SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://launchpad.support.sap.com/#/notes/3287120; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3287120
CVE: CVE-2023-27895
Published: 2023-03-14
Description: SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-267
References: https://launchpad.support.sap.com/#/notes/3302710; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3302710
CVE: CVE-2023-27896
Published: 2023-03-14
Description: In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://launchpad.support.sap.com/#/notes/3287120; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3287120
CVE: CVE-2022-47155
Published: 2023-03-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Slider by Supsystic plugin <= 1.8.5 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/slider-by-supsystic/wordpress-slider-by-supsystic-plugin-1-8-4-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/slider-by-supsystic/wordpress-slider-by-supsystic-plugin-1-8-4-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47162
Published: 2023-03-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Dannie Herdyawan DH – Anti AdBlocker plugin <= 36 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/dh-anti-adblocker/wordpress-dh-anti-adblocker-plugin-36-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/dh-anti-adblocker/wordpress-dh-anti-adblocker-plugin-36-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47163
Published: 2023-03-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin <= 2.6 versions.
CVSS Score: 3.1 (LOW)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wp-csv-to-database/wordpress-wp-csv-to-database-plugin-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-csv-to-database/wordpress-wp-csv-to-database-plugin-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-47171
Published: 2023-03-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul C. Schroeder IP Vault – WP Firewall plugin <= 1.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ip-vault-wp-firewall/wordpress-ip-vault-wp-firewall-plugin-1-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/ip-vault-wp-firewall/wordpress-ip-vault-wp-firewall-plugin-1-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-47595
Published: 2023-03-14
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Go Maps (formerly WP Google Maps) plugin <= 9.0.15 versions.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/wp-google-maps/wordpress-wp-go-maps-formerly-wp-google-maps-plugin-9-0-15-directory-traversal?_s_id=cve; https://patchstack.com/database/vulnerability/wp-google-maps/wordpress-wp-go-maps-formerly-wp-google-maps-plugin-9-0-15-directory-traversal?_s_id=cve
CVE: CVE-2022-47154
Published: 2023-03-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pi Websolution CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce plugin <= 2.4.49 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/css-js-manager/wordpress-css-js-manager-async-javascript-defer-render-blocking-css-supports-woocommerce-plugin-2-4-49-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/css-js-manager/wordpress-css-js-manager-async-javascript-defer-render-blocking-css-supports-woocommerce-plugin-2-4-49-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2021-4195
Published: 2023-03-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows XSS Targeting HTML Attributes.This issue affects Customer Relation Manager: before 2022.03.13.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0145; https://www.usom.gov.tr/bildirim/tr-23-0145
CVE: CVE-2022-23790
Published: 2023-03-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS).This issue affects Customer Relation Manager: before 2022.03.13.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0145; https://www.usom.gov.tr/bildirim/tr-23-0145
CVE: CVE-2022-23791
Published: 2023-03-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS).This issue affects Customer Relation Manager: before 2022.03.13.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0145; https://www.usom.gov.tr/bildirim/tr-23-0145
CVE: CVE-2022-47141
Published: 2023-03-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Dynamic Keywords Injector plugin <= 2.3.15 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-dynamic-keywords-injector/wordpress-wp-dynamic-keywords-injector-plugin-2-3-15-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/wp-dynamic-keywords-injector/wordpress-wp-dynamic-keywords-injector-plugin-2-3-15-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47143
Published: 2023-03-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin – MPG plugin <= 3.3.9 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/multiple-pages-generator-by-porthas/wordpress-multiple-pages-generator-by-themeisle-plugin-3-3-9-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/multiple-pages-generator-by-porthas/wordpress-multiple-pages-generator-by-themeisle-plugin-3-3-9-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47147
Published: 2023-03-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kesz1 Technologies ipBlockList plugin <= 1.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ipblocklist/wordpress-ipblocklist-plugin-1-0-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/ipblocklist/wordpress-ipblocklist-plugin-1-0-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47422
Published: 2023-03-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin Accept Stripe Donation – AidWP plugin <= 3.1.5 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-stripe-donation/wordpress-wordpress-stripe-donation-plugin-3-1-5-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/wp-stripe-donation/wordpress-wordpress-stripe-donation-plugin-3-1-5-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47443
Published: 2023-03-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/multi-rating/wordpress-multi-rating-plugin-5-0-5-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/multi-rating/wordpress-multi-rating-plugin-5-0-5-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-25957
Published: 2023-03-14
Description: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.1.9 < V3.3.1), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.1.8 < V3.3.0), Mendix SAML (Mendix 9.6 compatible, New Track) (All versions >= V3.1.9 < V3.2.7), Mendix SAML (Mendix 9.6 compatible, Upgrade Track) (All versions >= V3.1.8 < V3.2.6). The affected versions of the module insufficiently verify the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application.

For compatibility reasons, fix versions still contain this issue, but only when the recommended, default configuration option `'Use Encryption'` is disabled.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-303, CWE-287
References: https://cert-portal.siemens.com/productcert/pdf/ssa-851884.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-851884.pdf
CVE: CVE-2023-27309
Published: 2023-03-14
Description: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions for specific write queries. This could allow an authenticated remote attacker to perform unauthorized actions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862
References: https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf
CVE: CVE-2023-27310
Published: 2023-03-14
Description: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to otherwise non-privileged user accounts.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-862
References: https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf
CVE: CVE-2023-27398
Published: 2023-03-14
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20304)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf
CVE: CVE-2023-27399
Published: 2023-03-14
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20299, ZDI-CAN-20346)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf
CVE: CVE-2023-27400
Published: 2023-03-14
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20300)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf
CVE: CVE-2023-27401
Published: 2023-03-14
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20308, ZDI-CAN-20345)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf
CVE: CVE-2023-27402
Published: 2023-03-14
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20334)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf
CVE: CVE-2023-27403
Published: 2023-03-14
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains a memory corruption vulnerability while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.  (ZDI-CAN-20303, ZDI-CAN-20348)
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf
CVE: CVE-2023-27404
Published: 2023-03-14
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to stack-based buffer while parsing specially crafted SPP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-20433)
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf
CVE: CVE-2023-27405
Published: 2023-03-14
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20432)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf
CVE: CVE-2023-27406
Published: 2023-03-14
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to stack-based buffer while parsing specially crafted SPP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-20449)
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf
CVE: CVE-2023-27462
Published: 2023-03-14
Description: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for specific read queries. This could allow authenticated remote attackers to access data they are not authorized for.
CVSS Score: 3.1 (LOW)
CWE: CWE-862
References: https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf
CVE: CVE-2023-27463
Published: 2023-03-14
Description: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The audit log form of affected applications is vulnerable to SQL injection. This could allow authenticated remote attackers to execute arbitrary SQL queries on the server database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf
CVE: CVE-2022-3678
Published: 2023-03-14
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-3680
Published: 2023-03-14
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-46743
Published: 2023-03-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.