deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-24681
Published: 2024-02-02
Description: Incorrect Permission Assignment for Critical Resource vulnerability in B&R Industrial Automation Automation Studio allows Privilege Escalation.This issue affects Automation Studio: from 4.6.0 through 4.6.X, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP.


CVSS Score: 8.2 (HIGH)
CWE: CWE-732
References: https://www.br-automation.com/fileadmin/2021-14-BR-AS-NET-PVI-Service-Issues-c3710fbf.pdf; https://www.br-automation.com/fileadmin/2021-14-BR-AS-NET-PVI-Service-Issues-c3710fbf.pdf
CVE: CVE-2021-22282
Published: 2024-02-02
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in B&R Industrial Automation Automation Studio allows Local Execution of Code.This issue affects Automation Studio: from 4.0 through 4.12.


CVSS Score: 8.3 (HIGH)
CWE: CWE-94
References: https://www.br-automation.com/fileadmin/2021-12_RCE_Vulnerability_in_BnR_Automation_Studio-1b993aeb.pdf; https://www.br-automation.com/fileadmin/2021-12_RCE_Vulnerability_in_BnR_Automation_Studio-1b993aeb.pdf
CVE: CVE-2023-43756
Published: 2024-02-02
Description: 
in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read.


CVSS Score: 2.9 (LOW)
CWE: CWE-125, CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md
CVE: CVE-2023-45734
Published: 2024-02-02
Description: 
in OpenHarmony v3.2.4 and prior versions allow an adjacent attacker arbitrary code execution through out-of-bounds write.


CVSS Score: 4.2 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md
CVE: CVE-2023-49118
Published: 2024-02-02
Description: 
in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read.


CVSS Score: 2.9 (LOW)
CWE: CWE-125, CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md
CVE: CVE-2024-0285
Published: 2024-02-02
Description: 
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md
CVE: CVE-2024-21780
Published: 2024-02-02
Description: Stack-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. Processing a specially crafted command may result in a denial of service (DoS) condition. Note that the affected products are no longer supported.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://jvn.jp/en/vu/JVNVU93740658/; https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/; https://jvn.jp/en/vu/JVNVU93740658/
CVE: CVE-2024-21845
Published: 2024-02-02
Description: 
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through  integer overflow.
CVSS Score: 2.9 (LOW)
CWE: CWE-190, CWE-190
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md
CVE: CVE-2024-21851
Published: 2024-02-02
Description: 
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through  integer overflow.
CVSS Score: 2.9 (LOW)
CWE: CWE-190, CWE-190
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md
CVE: CVE-2024-21860
Published: 2024-02-02
Description: 
in OpenHarmony v4.0.0 and prior versions

allow an adjacent attacker arbitrary code execution in any apps through use after free.
CVSS Score: 8.2 (HIGH)
CWE: CWE-416, CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md
CVE: CVE-2024-21863
Published: 2024-02-02
Description: 
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-02.md
CVE: CVE-2024-23978
Published: 2024-02-02
Description: Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be executed. Note that the affected products are no longer supported.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://jvn.jp/en/vu/JVNVU93740658/; https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/; https://jvn.jp/en/vu/JVNVU93740658/
CVE: CVE-2020-24682
Published: 2024-02-02
Description: Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Elevated Privileges.This issue affects Automation Studio: from 4.0 through 4.6, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP; NET/PVI: from 4.0 through 4.6, from 4.7.0 before 4.7.7, from 4.8.0 before 4.8.6, from 4.9.0 before 4.9.4.


CVSS Score: 7.2 (HIGH)
CWE: CWE-428
References: https://www.br-automation.com/fileadmin/2021-14-BR-AS-NET-PVI-Service-Issues-c3710fbf.pdf; https://www.br-automation.com/fileadmin/2021-14-BR-AS-NET-PVI-Service-Issues-c3710fbf.pdf
CVE: CVE-2021-22281
Published: 2024-02-02
Description: : Relative Path Traversal vulnerability in B&R Industrial Automation Automation Studio allows Relative Path Traversal.This issue affects Automation Studio: from 4.0 through 4.12.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.br-automation.com/fileadmin/2021-11_ZipSlip_Vulnerability_in_Automation_Studio_Project_Import-b90d2f42.pdf; https://www.br-automation.com/fileadmin/2021-11_ZipSlip_Vulnerability_in_Automation_Studio_Project_Import-b90d2f42.pdf
CVE: CVE-2024-24524
Published: 2024-02-02
Description: Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.php component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/harryrabbit5651/cms/blob/main/1.md; https://github.com/harryrabbit5651/cms/blob/main/1.md
CVE: CVE-2023-48645
Published: 2024-02-02
Description: An issue was discovered in the Archibus app 4.0.3 for iOS. It uses a local database that is synchronized with a Web central server instance every time the application is opened, or when the refresh button is used. There is a SQL injection in the search work request feature in the Maintenance module of the app. This allows performing queries on the local database.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48645; https://excellium-services.com/cert-xlm-advisory/CVE-2023-48645; https://excellium-services.com/cert-xlm-advisory/CVE-2023-48645
CVE: CVE-2024-22851
Published: 2024-02-02
Description: Directory Traversal Vulnerability in LiveConfig before v.2.5.2 allows a remote attacker to obtain sensitive information via a crafted request to the /static/ endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://raeph123.github.io/BlogPosts/LiveConfig/LiveConfig_Advisory_CVE-2024-22851_en.html; https://www.drive-byte.de/en/blog/liveconfig-advisory-cve-2024-22851; https://www.liveconfig.com/de/kb/cve/cve-2024-22851/
CVE: CVE-2024-25001
Published: 2024-02-02
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID. ConsultIDs: none. Reason: This CVE ID is unused by its CNA. Notes: none.
CVE: CVE-2023-39611
Published: 2024-02-02
Description: An issue in Software FX Chart FX 7 version 7.0.4962.20829 allows attackers to enumerate and read files from the local filesystem by sending crafted web requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://medium.com/%40arielbreisacher/my-chart-fx-7-software-investigation-journey-leading-to-a-directory-traversal-vulnerability-067cdcd3f2e9; https://medium.com/%40arielbreisacher/my-chart-fx-7-software-investigation-journey-leading-to-a-directory-traversal-vulnerability-067cdcd3f2e9
CVE: CVE-2023-50488
Published: 2024-02-02
Description: An issue in Blurams Lumi Security Camera (A31C) v23.0[PII_REDACTED] allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/roman-mueller/PoC/tree/master/CVE-2023-50488; https://infosec.rm-it.de/2024/02/01/blurams-lumi-security-camera-analysis/; https://github.com/roman-mueller/PoC/tree/master/CVE-2023-50488
CVE: CVE-2023-51072
Published: 2024-02-02
Description: A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged users to execute malicious HTML or JavaScript code via the audio file upload functionality from the Operation Center section. This allows any authenticated user to execute arbitrary JavaScript code on behalf of other users, including the administrators.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.nagios.com/products/security/#nagios-xi; https://www.nagios.com/products/security/#nagios-xi
CVE: CVE-2023-51820
Published: 2024-02-02
Description: An issue in Blurams Lumi Security Camera (A31C) v.2.3.38.12558 allows a physically proximate attackers to execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://github.com/roman-mueller/PoC/tree/master/CVE-2023-51820; https://infosec.rm-it.de/2024/02/01/blurams-lumi-security-camera-analysis/; https://github.com/roman-mueller/PoC/tree/master/CVE-2023-51820
CVE: CVE-2024-0338
Published: 2024-02-02
Description: A buffer overflow vulnerability has been found in XAMPP affecting version 8.2.4 and earlier. An attacker could execute arbitrary code through a long file debug argument that controls the Structured Exception Handler (SEH).
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://www.incibe.es/en/incibe-cert/notices/aviso/buffer-overflow-vulnerability-xampp; https://www.incibe.es/en/incibe-cert/notices/aviso/buffer-overflow-vulnerability-xampp
CVE: CVE-2024-23895
Published: 2024-02-02
Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/locationcreate.php, in the locationid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE: CVE-2024-24388
Published: 2024-02-02
Description: Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.cnblogs.com/rxtycc/p/17948379; https://www.cnblogs.com/rxtycc/p/17948379
CVE: CVE-2024-0844
Published: 2024-02-02
Description: The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementData() function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files ending with "Form.php" on the server , allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/popup-more/trunk/classes/Ajax.php#L184; https://www.wordfence.com/threat-intel/vulnerabilities/id/7894a19c-b873-4c5b-8c82-6656cc306ee2?source=cve; https://plugins.trac.wordpress.org/browser/popup-more/trunk/classes/Ajax.php#L184
CVE: CVE-2024-0963
Published: 2024-02-02
Description: The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3029782/calculated-fields-form/trunk/inc/cpcff_main.inc.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3029782%40calculated-fields-form&new=3029782%40calculated-fields-form&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d870ff8d-ea4b-4777-9892-0d9982182b9f?source=cve
CVE: CVE-2024-1201
Published: 2024-02-02
Description: Search path or unquoted item vulnerability in HDD Health affecting versions 4.2.0.112 and earlier. This vulnerability could allow a local attacker to store a malicious executable file within the unquoted search path, resulting in privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://www.incibe.es/en/incibe-cert/notices/aviso/panterasoft-hdd-health-search-path-or-unquoted-item-vulnerability; https://www.incibe.es/en/incibe-cert/notices/aviso/panterasoft-hdd-health-search-path-or-unquoted-item-vulnerability
CVE: CVE-2023-47143
Published: 2024-02-02
Description: IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.  IBM X-Force ID:  270270.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-644, CWE-116
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270270; https://www.ibm.com/support/pages/node/7105139; https://exchange.xforce.ibmcloud.com/vulnerabilities/270270
CVE: CVE-2023-47144
Published: 2024-02-02
Description: IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  270271.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270271; https://www.ibm.com/support/pages/node/7105139; https://exchange.xforce.ibmcloud.com/vulnerabilities/270271
CVE: CVE-2023-47148
Published: 2024-02-02
Description: IBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper validation of unsecured endpoints which could be used in further attacks against the system.  IBM X-Force ID:  270599.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270599; https://www.ibm.com/support/pages/node/7096482; https://exchange.xforce.ibmcloud.com/vulnerabilities/270599
CVE: CVE-2023-6672
Published: 2024-02-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in National Keep Cyber Security Services CyberMath allows Stored XSS.This issue affects CyberMath: from v1.4 before v1.5.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-0080; https://www.usom.gov.tr/bildirim/tr-24-0080
CVE: CVE-2023-6673
Published: 2024-02-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in National Keep Cyber Security Services CyberMath allows Reflected XSS.This issue affects CyberMath: from v.1.4 before v.1.5.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-0080; https://www.usom.gov.tr/bildirim/tr-24-0080
CVE: CVE-2023-6675
Published: 2024-02-02
Description: Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows Upload a Web Shell to a Web Server.This issue affects CyberMath: from v.1.4 before v.1.5.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.usom.gov.tr/bildirim/tr-24-0080; https://www.usom.gov.tr/bildirim/tr-24-0080
CVE: CVE-2023-6676
Published: 2024-02-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in National Keep Cyber Security Services CyberMath allows Cross Site Request Forgery.This issue affects CyberMath: from v1.4 before v1.5.


CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.usom.gov.tr/bildirim/tr-24-0080; https://www.usom.gov.tr/bildirim/tr-24-0080
CVE: CVE-2024-0253
Published: 2024-02-02
Description: ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in home Graph-Data.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html; https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html
CVE: CVE-2024-0269
Published: 2024-02-02
Description: ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown. This issue has been fixed and released in version 7271.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html; https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html
CVE: CVE-2024-1184
Published: 2024-02-02
Description: A vulnerability was found in Nsasoft Network Sleuth 3.0.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Registration Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-252674 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-404
References: https://fitoxs.com/vuldb/10-exploit-perl.txt; https://vuldb.com/?ctiid.252674; https://vuldb.com/?id.252674
CVE: CVE-2023-47142
Published: 2024-02-02
Description: IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization's local network to escalate their privileges due to unauthorized API access.  IBM X-Force ID:  270267.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270267; https://www.ibm.com/support/pages/node/7105139; https://exchange.xforce.ibmcloud.com/vulnerabilities/270267
CVE: CVE-2023-38273
Published: 2024-02-02
Description: IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.  IBM X-Force ID:  260733.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260733; https://www.ibm.com/support/pages/node/7105357; https://exchange.xforce.ibmcloud.com/vulnerabilities/260733
CVE: CVE-2020-29504
Published: 2024-02-02
Description: 
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Missing Required Cryptographic Step Vulnerability.


CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities
CVE: CVE-2021-21575
Published: 2024-02-02
Description: 
Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://www.dell.com/support/kbdoc/en-us/000189462/dsa-2021-131-dell-bsafetm-micro-edition-suite-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000189462/dsa-2021-131-dell-bsafetm-micro-edition-suite-multiple-vulnerabilities
CVE: CVE-2022-34381
Published: 2024-02-02
Description: 
Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain an unmaintained third-party component vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to the compromise of the impacted system. This is a Critical vulnerability and Dell recommends customers to upgrade at the earliest opportunity.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1329
References: https://www.dell.com/support/kbdoc/en-us/000203278/dsa-2022-208-dell-bsafe-ssl-j-6-5-and-7-1-and-dell-bsafe-crypto-j-6-2-6-1-and-7-0-security-vulnerability; https://www.dell.com/support/kbdoc/en-us/000203278/dsa-2022-208-dell-bsafe-ssl-j-6-5-and-7-1-and-dell-bsafe-crypto-j-6-2-6-1-and-7-0-security-vulnerability
CVE: CVE-2023-32967
Published: 2024-02-02
Description: An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.
QTS 5.x, QuTS hero are not affected.

We have already fixed the vulnerability in the following versions:
QuTScloud c5.1.5.2651 and later
QTS 4.5.4.2627 build 20231225 and later

CVSS Score: 5.0 (MEDIUM)
CWE: CWE-285, CWE-863, CWE-863
References: https://www.qnap.com/en/security-advisory/qsa-24-01; https://www.qnap.com/en/security-advisory/qsa-24-01
CVE: CVE-2023-39297
Published: 2024-02-02
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QTS 4.5.4.2627 build 20231225 and later
QuTS hero h5.1.4.2596 build 20231128 and later
QuTS hero h4.5.4.2626 build 20231225 and later
QuTScloud c5.1.5.2651 and later

CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-23-30; https://www.qnap.com/en/security-advisory/qsa-23-30
CVE: CVE-2023-39302
Published: 2024-02-02
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QuTS hero h5.1.3.2578 build 20231110 and later
QuTScloud c5.1.5.2651 and later

CVSS Score: 6.6 (MEDIUM)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-23-33; https://www.qnap.com/en/security-advisory/qsa-23-33