deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-1064
Published: 2023-02-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
CVE: CVE-2017-1065
Published: 2023-02-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
CVE: CVE-2017-1066
Published: 2023-02-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
CVE: CVE-2017-1067
Published: 2023-02-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
CVE: CVE-2017-1068
Published: 2023-02-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
CVE: CVE-2017-1069
Published: 2023-02-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
CVE: CVE-2022-48149
Published: 2023-02-22
Description: Online Student Admission System in PHP Free Source Code 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://medium.com/%40ahmedmehsania/cve-2022-48149-80e4139aa503; https://medium.com/%40ahmedmehsania/cve-2022-48149-80e4139aa503
CVE: CVE-2023-0884
Published: 2023-02-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-3759. Reason: This candidate is a reservation duplicate of CVE-2022-3759. Notes: All CVE users should reference CVE-2022-3759 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-0885
Published: 2023-02-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-0518. Reason: This candidate is a reservation duplicate of CVE-2023-0518. Notes: All CVE users should reference CVE-2023-0518 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-0886
Published: 2023-02-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-3411. Reason: This candidate is a reservation duplicate of CVE-2022-3411. Notes: All CVE users should reference CVE-2022-3411 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-26302
Published: 2023-02-22
Description: Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.
CVSS Score: 3.3 (LOW)
CWE: CWE-173, CWE-173
References: https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c; https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c
CVE: CVE-2023-26303
Published: 2023-02-23
Description: Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.
CVSS Score: 3.3 (LOW)
CWE: CWE-173, CWE-173
References: https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49; https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49
CVE: CVE-2021-45032
Published: 2023-02-23
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-48341
Published: 2023-02-23
Description: ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238543; https://thingsboard.io/docs/reference/releases/; https://exchange.xforce.ibmcloud.com/vulnerabilities/238543
CVE: CVE-2023-26462
Published: 2023-02-23
Description: ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application server or its source code.)
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238544; https://thingsboard.io/docs/reference/releases/; https://exchange.xforce.ibmcloud.com/vulnerabilities/238544
CVE: CVE-2023-0939
Published: 2023-02-23
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NTN Information Technologies Online Services Software allows SQL Injection.This issue affects Online Services Software: before 1.17.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0103; https://www.usom.gov.tr/bildirim/tr-23-0103
CVE: CVE-2023-25621
Published: 2023-02-23
Description: Privilege Escalation vulnerability in Apache Software Foundation Apache Sling.
Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or dialog in the product. For example an attacker might fool someone by changing the text on a delete button to "Info".
This issue affects the i18n module of Apache Sling up to version 2.5.18. Version 2.6.2 and higher limit by default i18m dictionaries to certain paths in the repository (/libs and /apps).

Users of the module are advised to update to version 2.6.2 or higher, check the configuration for resource loading and then adjust the access permissions for the configured path accordingly.



CVSS Score: 6.5 (MEDIUM)
References: https://sling.apache.org/news.html; https://sling.apache.org/news.html
CVE: CVE-2022-2504
Published: 2023-02-23
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SDD Computer Software SDD-Baro allows SQL Injection.This issue affects SDD-Baro: before 2.8.432.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0107; https://www.usom.gov.tr/bildirim/tr-23-0107
CVE: CVE-2023-0980
Published: 2023-02-23
Description: A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/registrations/update_status.php of the component Status Update Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221675.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.221675; https://vuldb.com/?id.221675; https://vuldb.com/?ctiid.221675
CVE: CVE-2023-0981
Published: 2023-02-23
Description: A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been classified as critical. Affected is an unknown function of the component Delete User. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-221676.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.221676; https://vuldb.com/?id.221676; https://vuldb.com/?ctiid.221676
CVE: CVE-2023-0982
Published: 2023-02-23
Description: A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Add Class Entry. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-221677 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.221677; https://vuldb.com/?id.221677; https://vuldb.com/?ctiid.221677
CVE: CVE-2023-0815
Published: 2023-02-23
Description: Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization's private networks and should not be directly accessible
from the Internet.







CVSS Score: 6.8 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13; https://github.com/OpenNMS/opennms/pull/5741/files; https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13
CVE: CVE-2023-0867
Published: 2023-02-23
Description: Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization's private networks and should not be directly accessible
from the Internet.








CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-79, CWE-79
References: https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13; https://github.com/OpenNMS/opennms/pull/5765; https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13
CVE: CVE-2023-0868
Published: 2023-02-23
Description: Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users
should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and
Horizon installation instructions state that they are intended for installation
within an organization's private networks and should not be directly accessible
from the Internet.











CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-79, CWE-79
References: https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13; https://github.com/OpenNMS/opennms/pull/5740; https://docs.opennms.com/meridian/2022/releasenotes/changelog.html#releasenotes-changelog-Meridian-2022.1.13
CVE: CVE-2023-0869
Published: 2023-02-23
Description: Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. 











Meridian
and Horizon installation instructions state that they are intended for
installation within an organization's private networks and should not be
directly accessible from the Internet.


CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-79, CWE-79
References: https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.0; https://github.com/OpenNMS/opennms/pull/5734; https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.0
CVE: CVE-2023-23659
Published: 2023-02-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/mainwp-piwik-extension/wordpress-mainwp-matomo-extension-plugin-4-0-4-csrf-leading-to-plugin-settings-change-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mainwp-piwik-extension/wordpress-mainwp-matomo-extension-plugin-4-0-4-csrf-leading-to-plugin-settings-change-vulnerability?_s_id=cve
CVE: CVE-2023-24384
Published: 2023-02-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart <= 1.4.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/organization-chart/wordpress-wpdevart-organization-chart-plugin-1-4-4-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/organization-chart/wordpress-wpdevart-organization-chart-plugin-1-4-4-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-48342
Published: 2023-02-23
Description: In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-1188, CWE-1188
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-48343
Published: 2023-02-23
Description: In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-48344
Published: 2023-02-23
Description: In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-0986
Published: 2023-02-23
Description: A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/?page=user/manage_user of the component Edit User. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-221679.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.221679; https://vuldb.com/?id.221679; https://vuldb.com/?ctiid.221679
CVE: CVE-2023-0987
Published: 2023-02-23
Description: A vulnerability classified as problematic was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file index.php?page=checkout. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221680.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/1MurasaKi/PizzeXSS_Report/blob/main/Online%20Pizza%20Ordering%20System/README.md; https://vuldb.com/?ctiid.221680; https://vuldb.com/?id.221680
CVE: CVE-2023-0988
Published: 2023-02-23
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Online Pizza Ordering System 1.0. This issue affects some unknown processing of the file admin/ajax.php?action=save_user. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221681 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/1MurasaKi/PizzaCSRF_report/tree/main/vender/Online%20Pizza%20Ordering%20System; https://vuldb.com/?ctiid.221681; https://vuldb.com/?id.221681
CVE: CVE-2023-24104
Published: 2023-02-23
Description: Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets.
CVSS Score: 9.8 (CRITICAL)
References: https://attack.mitre.org/techniques/T1090/004/; https://github.com/f1veT/BUG/issues/1; https://attack.mitre.org/techniques/T1090/004/
CVE: CVE-2023-24415
Published: 2023-02-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/chatbot/wordpress-chatbot-plugin-4-2-8-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/chatbot/wordpress-chatbot-plugin-4-2-8-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-2176
Published: 2023-02-23
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-22476
Published: 2023-02-23
Description: Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*. This issue is fixed in version 2.25.6. There are no workarounds.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-hf4x-6h87-hm79; https://www.mantisbt.org/bugs/view.php?id=31086; https://github.com/mantisbt/mantisbt/security/advisories/GHSA-hf4x-6h87-hm79
CVE: CVE-2022-3219
Published: 2023-02-23
Description: GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.
CVSS Score: 3.3 (LOW)
CWE: CWE-787, CWE-787
References: https://access.redhat.com/security/cve/CVE-2022-3219; https://bugzilla.redhat.com/show_bug.cgi?id=2127010; https://dev.gnupg.org/D556
CVE: CVE-2022-46786
Published: 2023-02-23
Description: SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 2 of 2).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://scomsupport.squaredup.com/hc/en-us/articles/[PII_REDACTED]005-CVE-2022-46786-Stored-Cross-Site-Scripting; https://support.squaredup.com; https://scomsupport.squaredup.com/hc/en-us/articles/[PII_REDACTED]005-CVE-2022-46786-Stored-Cross-Site-Scripting
CVE: CVE-2022-4492
Published: 2023-02-23
Description: The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://access.redhat.com/security/cve/CVE-2022-4492; https://bugzilla.redhat.com/show_bug.cgi?id=2153260; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-0044
Published: 2023-02-23
Description: If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/CVE-2023-0044; https://bugzilla.redhat.com/show_bug.cgi?id=2158081; https://access.redhat.com/security/cve/CVE-2023-0044
CVE: CVE-2023-0597
Published: 2023-02-23
Description: A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-401, CWE-401
References: http://www.openwall.com/lists/oss-security/2023/07/28/1; https://git.kernel.org/linus/97e3d26b5e5f371b3ee223d94dd123e6c442ba80; http://www.openwall.com/lists/oss-security/2023/07/28/1
CVE: CVE-2023-20011
Published: 2023-02-23
Description: A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the affected user has administrative privileges, these actions could include modifying the system configuration and creating new privileged accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-csrfv-DMx6KSwV; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-csrfv-DMx6KSwV
CVE: CVE-2023-20012
Published: 2023-02-23
Description: A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability is due to the improper implementation of the password validation function. An attacker could exploit this vulnerability by logging in to the console port on an affected device. A successful exploit could allow the attacker to bypass authentication and execute a limited set of commands local to the FEX, which could cause a device reboot and denial of service (DoS) condition.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-elyfex-dos-gfvcByx; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-elyfex-dos-gfvcByx
CVE: CVE-2023-20015
Published: 2023-02-23
Description: A vulnerability in the CLI of Cisco Firepower 4100 Series, Cisco Firepower 9300 Security Appliances, and Cisco UCS 6200, 6300, 6400, and 6500 Series Fabric Interconnects could allow an authenticated, local attacker to inject unauthorized commands. This vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command. A successful exploit could allow the attacker to execute unauthorized commands within the CLI. An attacker with Administrator privileges could also execute arbitrary commands on the underlying operating system of Cisco UCS 6400 and 6500 Series Fabric Interconnects with root-level privileges.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxfp-cmdinj-XXBZjtR; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxfp-cmdinj-XXBZjtR
CVE: CVE-2023-20016
Published: 2023-02-23
Description: A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an unauthenticated attacker with access to a backup file to decrypt sensitive information stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method used for the backup function. An attacker could exploit this vulnerability by leveraging a static key used for the backup configuration feature. A successful exploit could allow the attacker to decrypt sensitive information that is stored in full state and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and other credentials.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-321, CWE-330
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsm-bkpsky-H8FCQgsA; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsm-bkpsky-H8FCQgsA