deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-22130
Published: 2024-02-13
Description: Print preview option in SAP CRM WebClient UI - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. An attacker with low privileges can cause limited impact to confidentiality and integrity of the appliaction data after successful exploitation.


CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://me.sap.com/notes/3410875; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3410875
CVE: CVE-2024-22131
Published: 2024-02-13
Description: In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a vulnerable interface. This allows the attacker to use the interface to invoke an application function to perform actions which they would not normally be permitted to perform.  Depending on the function executed, the attack can read or modify any user/business data and can make the entire system unavailable.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://me.sap.com/notes/3420923; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3420923
CVE: CVE-2024-22132
Published: 2024-02-13
Description: SAP IDES ECC-systems contain code that permits the execution of arbitrary program code of user's choice.An attacker can therefore control the behaviour of the system by executing malicious code which can potentially escalate privileges with low impact on confidentiality, integrity and availability of the system.


CVSS Score: 7.4 (HIGH)
CWE: CWE-78
References: https://me.sap.com/notes/3421659; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3421659
CVE: CVE-2024-24739
Published: 2024-02-13
Description: SAP Bank Account Management (BAM) allows an authenticated user with restricted access to use functions which can result in escalation of privileges with low impact on confidentiality, integrity and availability of the application.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/2637727; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/2637727
CVE: CVE-2024-24740
Published: 2024-02-13
Description: SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, under certain conditions, allows an attacker to access information which could otherwise be restricted with low impact on confidentiality of the application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://me.sap.com/notes/3360827; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3360827
CVE: CVE-2024-24742
Published: 2024-02-13
Description: SAP CRM WebClient UI - version S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to integrity of the application data after successful exploitation. There is no impact on confidentiality and availability.


CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3158455; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3158455
CVE: CVE-2024-24743
Published: 2024-02-13
Description: SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so that availability is not affected.


CVSS Score: 8.6 (HIGH)
CWE: CWE-611
References: https://me.sap.com/notes/3426111; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3426111
CVE: CVE-2024-25642
Published: 2024-02-13
Description: Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the mutual authentication. Hence, the attacker can intercept the request to view/modify sensitive information. There is no impact on the availability of the system.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://seclists.org/fulldisclosure/2024/May/26; https://me.sap.com/notes/3424610; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE: CVE-2024-22024
Published: 2024-02-13
Description: An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
CVSS Score: 8.3 (HIGH)
CWE: CWE-611, CWE-611
References: https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US; https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
CVE: CVE-2024-22129
Published: 2024-02-13
Description: SAP Companion - version <3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integrity of the web application.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3404025; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3404025
CVE: CVE-2024-24741
Published: 2024-02-13
Description: SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read some sensitive information but no impact to integrity and availability.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/2897391; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/2897391
CVE: CVE-2024-25643
Published: 2024-02-13
Description: The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an escalation of privileges. It is possible to manipulate the URLs of data requests to access information that the user should not have access to. There is no impact on integrity and availability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3237638; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3237638
CVE: CVE-2022-48623
Published: 2024-02-13
Description: The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/briandfoy/cpan-security-advisory/blob/9374f98bef51e1ae887f[PII_REDACTED]51c079776f/cpansa/CPANSA-Cpanel-JSON-XS.yml#L25-L36; https://github.com/rurban/Cpanel-JSON-XS/commit/41f32396eee9395a40f9ed80145c37622560de9b; https://github.com/rurban/Cpanel-JSON-XS/issues/208
CVE: CVE-2023-52431
Published: 2024-02-13
Description: The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty cookie (if signed cookies are disabled).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-269
References: https://github.com/briandfoy/cpan-security-advisory/blob/9374f98bef51e1ae887f[PII_REDACTED]51c079776f/cpansa/CPANSA-Plack-Middleware-XSRFBlock.yml#L2-L15; https://metacpan.org/release/DAKKAR/Plack-Middleware-XSRFBlock-0.0.19/source/Changes; https://github.com/briandfoy/cpan-security-advisory/blob/9374f98bef51e1ae887f[PII_REDACTED]51c079776f/cpansa/CPANSA-Plack-Middleware-XSRFBlock.yml#L2-L15
CVE: CVE-2024-21491
Published: 2024-02-13
Description: Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.**Note:**The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-288, CWE-347, CWE-288
References: https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6; https://github.com/svix/svix-webhooks/pull/1190; https://rustsec.org/advisories/RUSTSEC-2024-0010.html
CVE: CVE-2024-25914
Published: 2024-02-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in Photoboxone SMTP Mail.This issue affects SMTP Mail: from n/a through 1.3.20.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/smtp-mail/wordpress-smtp-mail-plugin-1-3-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smtp-mail/wordpress-smtp-mail-plugin-1-3-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-6815
Published: 2024-02-13
Description: Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266
References: https://jvn.jp/vu/JVNVU95085830/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf
CVE: CVE-2024-22445
Published: 2024-02-13
Description: 
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.


CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000222025/dsa-2024-061-dell-power-protect-data-manager-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222025/dsa-2024-061-dell-power-protect-data-manager-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-22454
Published: 2024-02-13
Description: 
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the compromised account. The attacker could retrieve the reset password token without authorization and then perform the password change


CVSS Score: 8.8 (HIGH)
CWE: CWE-640
References: https://www.dell.com/support/kbdoc/en-us/000222025/dsa-2024-061-dell-power-protect-data-manager-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222025/dsa-2024-061-dell-power-protect-data-manager-update-for-multiple-security-vulnerabilities
CVE: CVE-2023-48363
Published: 2024-02-13
Description: A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 15), SIMATIC WinCC V8.0 (All versions < V8.0 Update 4). The implementation of the RPC (Remote Procedure call) 
communication protocol in the affected products do not 
properly handle certain unorganized RPC messages. An 
attacker could use this vulnerability to cause a denial of service 
condition in the RPC server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/html/ssa-753746.html; https://cert-portal.siemens.com/productcert/html/ssa-753746.html
CVE: CVE-2023-48364
Published: 2024-02-13
Description: A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 15), SIMATIC WinCC V8.0 (All versions < V8.0 Update 4). The implementation of the RPC (Remote Procedure call) communication protocol in the affected products do not properly handle certain malformed RPC messages. An attacker could use this vulnerability to cause a denial of service condition in the RPC server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/html/ssa-753746.html; https://cert-portal.siemens.com/productcert/html/ssa-753746.html
CVE: CVE-2023-49125
Published: 2024-02-13
Description: A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.263), Parasolid V35.1 (All versions < V35.1.252), Parasolid V36.0 (All versions < V36.0.198), Solid Edge SE2023 (All versions < V223.0 Update 11), Solid Edge SE2024 (All versions < V224.0 Update 3). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted files containing XT format. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-382651.html; https://cert-portal.siemens.com/productcert/html/ssa-797296.html; https://cert-portal.siemens.com/productcert/html/ssa-382651.html
CVE: CVE-2023-50236
Published: 2024-02-13
Description: A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The affected product is vulnerable due to weak file and folder permissions in the installation path. An attacker with local access could exploit this vulnerability to escalate privileges to NT AUTHORITY\SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://cert-portal.siemens.com/productcert/html/ssa-871717.html; https://cert-portal.siemens.com/productcert/html/ssa-871717.html
CVE: CVE-2023-51440
Published: 2024-02-13
Description: A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (All versions), SIPLUS NET CP 343-1 (6AG1343-1EX30-7XE0) (All versions), SIPLUS NET CP 343-1 Lean (6AG1343-1CX10-2XE0) (All versions). Affected products incorrectly validate TCP sequence numbers. This could allow an unauthenticated remote attacker to create a denial of service condition by injecting spoofed TCP RST packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-940
References: https://cert-portal.siemens.com/productcert/html/ssa-516818.html; https://cert-portal.siemens.com/productcert/html/ssa-516818.html
CVE: CVE-2024-22042
Published: 2024-02-13
Description: A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used in affected product contains incorrect use of privileged APIs that trigger the Windows Console Host (conhost.exe) as a child process with SYSTEM privileges. This could be exploited by an attacker to perform a local privilege escalation attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-648
References: https://cert-portal.siemens.com/productcert/html/ssa-543502.html; https://cert-portal.siemens.com/productcert/html/ssa-543502.html
CVE: CVE-2024-22043
Published: 2024-02-13
Description: A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.251), Parasolid V35.1 (All versions < V35.1.170). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted XT files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/html/ssa-797296.html; https://cert-portal.siemens.com/productcert/html/ssa-797296.html
CVE: CVE-2024-23795
Published: 2024-02-13
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted WRL file. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-017796.html; https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE: CVE-2024-23796
Published: 2024-02-13
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-017796.html; https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE: CVE-2024-23797
Published: 2024-02-13
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-017796.html; https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE: CVE-2024-23798
Published: 2024-02-13
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-017796.html; https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE: CVE-2024-23799
Published: 2024-02-13
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/html/ssa-017796.html; https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE: CVE-2024-23800
Published: 2024-02-13
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/html/ssa-017796.html; https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE: CVE-2024-23801
Published: 2024-02-13
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/html/ssa-017796.html; https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE: CVE-2024-23802
Published: 2024-02-13
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-017796.html; https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE: CVE-2024-23803
Published: 2024-02-13
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-017796.html; https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE: CVE-2024-23804
Published: 2024-02-13
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted PSOBJ files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-017796.html; https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE: CVE-2024-23810
Published: 2024-02-13
Description: A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application is vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-943925.html; https://cert-portal.siemens.com/productcert/html/ssa-943925.html