deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4840
Published: 2023-09-12
Description: The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to, and including, 2.88.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/tags/2.88.4/mappress_map.php#L381; https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/tags/2.88.5/mappress.php?rev=2965022#L919; https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d2c9a4-32f7-484f-86ce-a33ef1174b28?source=cve
CVE: CVE-2023-4887
Published: 2023-09-12
Description: The Google Maps Plugin by Intergeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/intergeo-maps/tags/2.3.2/index.php#L1146; https://www.wordfence.com/threat-intel/vulnerabilities/id/cb6d11ad-0983-4a4b-b52b-824eae8b8e3c?source=cve; https://plugins.trac.wordpress.org/browser/intergeo-maps/tags/2.3.2/index.php#L1146
CVE: CVE-2023-4890
Published: 2023-09-12
Description: The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/jquery-vertical-accordion-menu/tags/3.1.2/dcwp_jquery_accordion.php#L112; https://plugins.trac.wordpress.org/browser/jquery-vertical-accordion-menu/tags/3.1.2/dcwp_jquery_accordion.php#L94; https://www.wordfence.com/threat-intel/vulnerabilities/id/b0cf3015-cdc9-4ac9-82f3-e9b4d1203e22?source=cve
CVE: CVE-2023-4893
Published: 2023-09-12
Description: The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortcode in versions up to, and including, 2.8.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/crayon-syntax-highlighter/trunk/crayon_highlighter.class.php#L83; https://www.wordfence.com/threat-intel/vulnerabilities/id/527f75f1-6361-4e16-8ae4-d38ca4589811?source=cve; https://plugins.trac.wordpress.org/browser/crayon-syntax-highlighter/trunk/crayon_highlighter.class.php#L83
CVE: CVE-2023-40309
Published: 2023-09-12
Description: SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://me.sap.com/notes/3340576; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3340576
CVE: CVE-2023-40621
Published: 2023-09-12
Description: SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. The application has a security option to disable or prompt users before untrusted scripts are executed, but this is not set as default.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://me.sap.com/notes/3357163; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3357163
CVE: CVE-2023-40622
Published: 2023-09-12
Description: SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-732
References: https://me.sap.com/notes/3320355; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3320355
CVE: CVE-2023-40623
Published: 2023-09-12
Description: SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the operating system files causing a limited impact on integrity and completely compromising the availability of the system.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1386
References: https://me.sap.com/notes/3317702; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3317702
CVE: CVE-2023-40624
Published: 2023-09-12
Description: SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can be executed in the web-application. An attacker could thereby control the behavior of this web-application.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3323163; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3323163
CVE: CVE-2023-40625
Published: 2023-09-12
Description: S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and integrity with no impact on availibility of the system.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3326361; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3326361
CVE: CVE-2023-26142
Published: 2023-09-12
Description: All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set_header and add_header functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-113, CWE-74
References: https://gist.github.com/dellalibera/9247769cc90ed96c0d72ddbcba88c65c; https://security.snyk.io/vuln/SNYK-UNMANAGED-CROW-5665556; https://gist.github.com/dellalibera/9247769cc90ed96c0d72ddbcba88c65c
CVE: CVE-2023-3039
Published: 2023-09-12
Description: 
SD ROM Utility, versions prior to 1.0.2.0 contain an Improper Access Control vulnerability. A low-privileged malicious user may potentially exploit this vulnerability to perform arbitrary code execution with limited access.


CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000216282/dsa-2023-274; https://www.dell.com/support/kbdoc/en-us/000216282/dsa-2023-274
CVE: CVE-2022-24093
Published: 2023-09-12
Description: Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/magento/apsb22-13.html; https://helpx.adobe.com/security/products/magento/apsb22-13.html
CVE: CVE-2022-48474
Published: 2023-09-12
Description: Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Sending a malicious request could cause the server to check if an unrecognized component is up to date, causing a memory failure error that shuts down the process.
CVSS Score: 8.2 (HIGH)
CWE: CWE-400, CWE-400
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-control-de-ciber; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-control-de-ciber
CVE: CVE-2022-48475
Published: 2023-09-12
Description: Buffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function. Sending a modified request by the attacker could cause a Buffer Overflow when the adminitrator tries to accept or delete the print query created by the request.
CVSS Score: 8.2 (HIGH)
CWE: CWE-400, CWE-120
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-control-de-ciber; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-control-de-ciber
CVE: CVE-2022-4896
Published: 2023-09-12
Description: Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows with the messages "PNTMEDIDAS", "PEDIR", "HAYDISCOA" or "SPOOLER". A complete denial of service can be achieved by sending multiple requests simultaneously on a core.
CVSS Score: 8.2 (HIGH)
CWE: CWE-400, CWE-400
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-control-de-ciber; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-control-de-ciber
CVE: CVE-2023-37875
Published: 2023-09-12
Description: Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0.


CVSS Score: 3.0 (LOW)
CWE: CWE-116, CWE-79, CWE-116
References: https://www.wftpserver.com/serverhistory.htm; https://www.wftpserver.com/serverhistory.htm
CVE: CVE-2023-37878
Published: 2023-09-12
Description: Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.wftpserver.com/serverhistory.htm; https://www.wftpserver.com/serverhistory.htm
CVE: CVE-2023-37879
Published: 2023-09-12
Description: Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://www.wftpserver.com/serverhistory.htm; https://www.wftpserver.com/serverhistory.htm
CVE: CVE-2023-37881
Published: 2023-09-12
Description: Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.wftpserver.com/serverhistory.htm; https://www.wftpserver.com/serverhistory.htm
CVE: CVE-2023-28831
Published: 2023-09-12
Description: The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application to run into an infinite loop during certificate validation.

This could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://cert-portal.siemens.com/productcert/html/ssa-118850.html; https://cert-portal.siemens.com/productcert/html/ssa-711309.html; https://cert-portal.siemens.com/productcert/pdf/ssa-118850.pdf
CVE: CVE-2023-38070
Published: 2023-09-12
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application is vulnerable to stack-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20818)
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-478780.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf
CVE: CVE-2023-38071
Published: 2023-09-12
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20824)
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-478780.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf
CVE: CVE-2023-38072
Published: 2023-09-12
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20825)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-478780.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf
CVE: CVE-2023-38073
Published: 2023-09-12
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains a type confusion vulnerability while parsing WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20826)
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-478780.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf
CVE: CVE-2023-38074
Published: 2023-09-12
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains a type confusion vulnerability while parsing WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20840)
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-478780.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf
CVE: CVE-2023-38075
Published: 2023-09-12
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains a use-after-free vulnerability that could be triggered while parsing specially crafted WRL files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-20842)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-478780.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf
CVE: CVE-2023-38076
Published: 2023-09-12
Description: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21041)
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-478780.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-278349.pdf
CVE: CVE-2023-40724
Published: 2023-09-12
Description: A vulnerability has been identified in QMS Automotive (All versions < V12.39). User credentials are found in memory as plaintext. An attacker could perform a memory dump, and get access to credentials, and use it for impersonation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-316
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
CVE: CVE-2023-40725
Published: 2023-09-12
Description: A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages in response to invalid user credentials during login session. This allows an attacker to enumerate usernames, and identify valid usernames.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-209
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
CVE: CVE-2023-40726
Published: 2023-09-12
Description: A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application server responds with sensitive information about the server. This could allow an attacker to directly access the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-550
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
CVE: CVE-2023-40727
Published: 2023-09-12
Description: A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application uses weak outdated application signing mechanism. This could allow an attacker to tamper the application code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
CVE: CVE-2023-40728
Published: 2023-09-12
Description: A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensitive application data in an external insecure storage. This could allow an attacker to alter content, leading to arbitrary code execution or denial-of-service condition.
CVSS Score: 7.3 (HIGH)
CWE: CWE-922
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
CVE: CVE-2023-40729
Published: 2023-09-12
Description: A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unencrypted communication without HTTPS. An attacker who managed to gain machine-in-the-middle position could manipulate, or steal confidential information.
CVSS Score: 7.3 (HIGH)
CWE: CWE-319
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
CVE: CVE-2023-40730
Published: 2023-09-12
Description: A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application lacks sufficient authorization checks. This could allow an attacker to access confidential information, perform administrative functions, or lead to a denial-of-service condition.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
CVE: CVE-2023-40731
Published: 2023-09-12
Description: A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to upload arbitrary file types. This could allow an attacker to upload malicious files, that could potentially lead to code tampering.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-434
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
CVE: CVE-2023-40732
Published: 2023-09-12
Description: A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks.
CVSS Score: 3.9 (LOW)
CWE: CWE-613
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf