deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27983
Published: 2023-03-21
Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSS project report directory, this would lead to loss of data when an attacker abuses this functionality. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf
CVE: CVE-2023-25687
Published: 2023-03-21
Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files.  IBM X-Force ID:  247602.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209, CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247602; https://www.ibm.com/support/pages/node/6962729; https://exchange.xforce.ibmcloud.com/vulnerabilities/247602
CVE: CVE-2023-25689
Published: 2023-03-21
Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  247618.
CVSS Score: 2.7 (LOW)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247618; https://www.ibm.com/support/pages/node/6962729; https://exchange.xforce.ibmcloud.com/vulnerabilities/247618
CVE: CVE-2023-27842
Published: 2023-03-21
Description: Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via the index.php compenent
CVSS Score: 8.8 (HIGH)
CWE: CWE-277
References: http://blog.tristaomarinho.com/extplorer-2-1-15-insecure-permissions-following-remote-code-execution/; http://extplorer.net/; http://extplorer.net/attachments/download/99/eXtplorer_2.1.15.zip
CVE: CVE-2023-27871
Published: 2023-03-21
Description: IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query.  IBM X-Force ID:  249613.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249613; https://www.ibm.com/support/pages/node/6964694; https://exchange.xforce.ibmcloud.com/vulnerabilities/249613
CVE: CVE-2023-27873
Published: 2023-03-21
Description: 
IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654.


CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249654; https://www.ibm.com/support/pages/node/6964694; https://exchange.xforce.ibmcloud.com/vulnerabilities/249654
CVE: CVE-2023-27874
Published: 2023-03-21
Description: IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands.  IBM X-Force ID:  249845.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249845; https://www.ibm.com/support/pages/node/6964694; https://exchange.xforce.ibmcloud.com/vulnerabilities/249845
CVE: CVE-2022-45635
Published: 2023-03-21
Description: An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure password policy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521, CWE-521
References: https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45635; https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45635
CVE: CVE-2022-45637
Published: 2023-03-21
Description: An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 service via insecure expiry mechanism.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640, CWE-640
References: https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45637; https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45637; https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45637
CVE: CVE-2023-25686
Published: 2023-03-21
Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user.  IBM X-Force ID:  247601.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247601; https://www.ibm.com/support/pages/node/6962729; https://exchange.xforce.ibmcloud.com/vulnerabilities/247601
CVE: CVE-2023-25923
Published: 2023-03-21
Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service attack due to incorrect authorization.  IBM X-Force ID:  247629.
CVSS Score: 2.7 (LOW)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247629; https://www.ibm.com/support/pages/node/6962729; https://exchange.xforce.ibmcloud.com/vulnerabilities/247629
CVE: CVE-2023-27569
Published: 2023-03-21
Description: The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://profileo.com; https://security.profileo.com/cve/eo_tags_2023-27569-27570/; https://profileo.com
CVE: CVE-2023-27570
Published: 2023-03-21
Description: The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://profileo.com; https://security.profileo.com/cve/eo_tags_2023-27569-27570/; https://profileo.com
CVE: CVE-2023-1304
Published: 2023-03-21
Description: An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.


CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://docs.divvycloud.com/changelog/23321-release-notes; https://nephosec.com/exploiting-rapid7s-insightcloudsec/; https://docs.divvycloud.com/changelog/23321-release-notes
CVE: CVE-2023-1305
Published: 2023-03-21
Description: An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.


CVSS Score: 8.1 (HIGH)
CWE: CWE-653
References: https://docs.divvycloud.com/changelog/23321-release-notes; https://nephosec.com/exploiting-rapid7s-insightcloudsec/; https://docs.divvycloud.com/changelog/23321-release-notes
CVE: CVE-2023-1306
Published: 2023-03-21
Description: An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://docs.divvycloud.com/changelog/23321-release-notes; https://nephosec.com/exploiting-rapid7s-insightcloudsec/; https://docs.divvycloud.com/changelog/23321-release-notes
CVE: CVE-2023-25684
Published: 2023-03-21
Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.  IBM X-Force ID:  247597.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247597; https://www.ibm.com/support/pages/node/6962729; https://exchange.xforce.ibmcloud.com/vulnerabilities/247597
CVE: CVE-2018-25082
Published: 2023-03-21
Description: A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://github.com/zwczou/weixin-python/commit/e54abadc777715b6dcb545c13214d1dea63df6c9; https://github.com/zwczou/weixin-python/pull/30; https://github.com/zwczou/weixin-python/releases/tag/v0.5.5
CVE: CVE-2022-36429
Published: 2023-03-21
Description: A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON object can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-912
References: https://kb.netgear.com/000065424/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0188; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1597; https://kb.netgear.com/000065424/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0188
CVE: CVE-2022-37337
Published: 2023-03-21
Description: A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://kb.netgear.com/000065417/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0187; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1596; https://kb.netgear.com/000065417/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0187
CVE: CVE-2022-38452
Published: 2023-03-21
Description: A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-912
References: https://kb.netgear.com/000065567/Security-Advisory-for-Post-authentication-Command-Injection-on-the-RBR750-PSV-2022-0186; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1595; https://kb.netgear.com/000065567/Security-Advisory-for-Post-authentication-Command-Injection-on-the-RBR750-PSV-2022-0186
CVE: CVE-2022-38458
Published: 2023-03-21
Description: A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311, CWE-319
References: https://kb.netgear.com/000065428/Security-Advisory-for-Cleartext-Transmission-on-Some-Orbi-WiFi-Systems-PSV-2022-0189; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1598; https://kb.netgear.com/000065428/Security-Advisory-for-Cleartext-Transmission-on-Some-Orbi-WiFi-Systems-PSV-2022-0189
CVE: CVE-2022-45636
Published: 2023-03-21
Description: An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) without authorization via arbitrary API requests.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45636; https://labs.withsecure.com/advisories/insecure-authorization-scheme-for-api-requests-in-dbd--mobile-co; https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45636
CVE: CVE-2023-25134
Published: 2023-03-21
Description: McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee specific Component Object Model (COM) in the Windows Registry. This can result in the loading of a malicious payload.
CVSS Score: 6.7 (MEDIUM)
References: https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html; https://www.mcafee.com/support/?articleId=TS103398&page=shell&shell=article-view; https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html
CVE: CVE-2023-27087
Published: 2023-03-21
Description: Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-280
References: https://github.com/xuxueli/xxl-job/issues/3096; https://github.com/xuxueli/xxl-job/issues/3096
CVE: CVE-2023-0391
Published: 2023-03-21
Description: MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor this has been addressed in version 2.2.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-321, CWE-798
References: https://www.bleepingcomputer.com/news/security/cloudpanel-installations-use-the-same-ssl-certificate-private-key/; https://www.rapid7.com/blog/post/2023/03/21/cve-2023-0391-mgt-commerce-cloudpanel-shared-certificate-vulnerability-and-weak-installation-procedures/; https://www.bleepingcomputer.com/news/security/cloudpanel-installations-use-the-same-ssl-certificate-private-key/
CVE: CVE-2023-1261
Published: 2023-03-21
Description: 
Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network.


CVSS Score: 8.2 (HIGH)
CWE: CWE-862, CWE-862
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000SMyfRQAT?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000SMyfRQAT?operationContext=S1
CVE: CVE-2023-1262
Published: 2023-03-21
Description: 
Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages through network.


CVSS Score: 8.2 (HIGH)
CWE: CWE-862, CWE-862
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000SMyfRQAT?operationContext=S1; https://github.com/SiliconLabs/wisun-br-linux; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000SMyfRQAT?operationContext=S1
CVE: CVE-2023-1528
Published: 2023-03-21
Description: Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html; https://crbug.com/1421773; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1529
Published: 2023-03-21
Description: Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a malicious HID device. (Chromium security severity: High)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html; https://crbug.com/1419718; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1530
Published: 2023-03-21
Description: Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html; https://crbug.com/1419831; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1531
Published: 2023-03-21
Description: Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html; https://crbug.com/1415330; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1532
Published: 2023-03-21
Description: Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: http://packetstormsecurity.com/files/171959/Chrome-media-mojom-VideoFrame-Missing-Validation.html; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html; https://crbug.com/1421268
CVE: CVE-2023-1533
Published: 2023-03-21
Description: Use after free in WebProtect in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html; https://crbug.com/1422183; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
CVE: CVE-2023-1534
Published: 2023-03-21
Description: Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: http://packetstormsecurity.com/files/171961/Chrome-GL_ShaderBinary-Untrusted-Process-Exposure.html; http://packetstormsecurity.com/files/171965/Chrome-SpvGetMappedSamplerName-Out-Of-Bounds-String-Copy.html; https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html
CVE: CVE-2023-26497
Published: 2023-03-21
Description: An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T5125. Memory corruption can occur when processing Session Description Negotiation for Video Configuration Attribute.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787, CWE-787
References: https://semiconductor.samsung.com/processor/mobile-processor/; https://semiconductor.samsung.com/processor/modem/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2022-41696
Published: 2023-03-21
Description: Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05
CVE: CVE-2022-43512
Published: 2023-03-21
Description: Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05
CVE: CVE-2022-45121
Published: 2023-03-21
Description: Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05
CVE: CVE-2022-45468
Published: 2023-03-21
Description: Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05
CVE: CVE-2022-46286
Published: 2023-03-21
Description: Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVSS Score: 5.5 (MEDIUM)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05
CVE: CVE-2022-46300
Published: 2023-03-21
Description: Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05
CVE: CVE-2023-24709
Published: 2023-03-21
Description: An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/171783/Paradox-Security-Systems-IPR512-Denial-Of-Service.html; https://github.com/SlashXzerozero/Injection-vulnerability-in-Paradox-Security-Systems-IPR512; https://github.com/sunktitanic/Injection-vulnerability-in-Paradox-Security-Systems-IPR512
CVE: CVE-2023-27855
Published: 2023-03-22
Description: 
In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. The attacker could overwrite existing executable files with attacker-controlled, malicious contents, potentially causing remote code execution. 


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640
CVE: CVE-2023-27856
Published: 2023-03-22
Description: 


In affected versions, path traversal exists when processing a message of type 8

 in Rockwell Automation's ThinManager ThinServer. 

An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.

 


CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640