deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-23851
Published: 2023-02-14
Description: SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the users without their consent impacting the confidentiality and integrity of the system.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://launchpad.support.sap.com/#/notes/3275841; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3275841
CVE: CVE-2023-23852
Published: 2023-02-14
Description: SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3266751; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3266751
CVE: CVE-2023-23853
Published: 2023-02-14
Description: An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, can craft a link which when clicked by an unsuspecting user can be used to redirect a user to a malicious site which could read or modify some sensitive information or expose the victim to a phishing attack.  Vulnerability has no direct impact on availability.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://launchpad.support.sap.com/#/notes/3271227; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3271227
CVE: CVE-2023-23854
Published: 2023-02-14
Description: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.


CVSS Score: 3.8 (LOW)
CWE: CWE-862, CWE-862
References: https://launchpad.support.sap.com/#/notes/3287291; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3287291
CVE: CVE-2023-23855
Published: 2023-02-14
Description: SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful attack could lead an attacker to read or modify the information or expose the user to a phishing attack. As a result, it has a low impact to confidentiality, integrity and availability.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601
References: https://launchpad.support.sap.com/#/notes/3270509; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3270509
CVE: CVE-2023-23856
Published: 2023-02-14
Description: In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intelligence DHTML may be vulnerable to XSS attacks. On successful exploitation an attacker can cause a low impact on integrity of the application.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3263863; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3263863
CVE: CVE-2023-23858
Published: 2023-02-14
Description: Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to send a crafted URL to a user, and by clicking the URL, the tricked user accesses SAP and might be directed with the response to somewhere out-side SAP and enter sensitive data. This could cause a limited impact on confidentiality and integrity of the application.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3293786; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3293786
CVE: CVE-2023-23859
Published: 2023-02-14
Description: SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3268959; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3268959
CVE: CVE-2023-23860
Published: 2023-02-14
Description: SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a link, which when clicked by an unsuspecting user can be used to redirect a user to a malicious site which could read or modify some sensitive information or expose the victim to a phishing attack.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://launchpad.support.sap.com/#/notes/3268959; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3268959
CVE: CVE-2023-24521
Published: 2023-02-14
Description: Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3269151; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3269151
CVE: CVE-2023-24522
Published: 2023-02-14
Description: Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3269118; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3269118
CVE: CVE-2023-24523
Published: 2023-02-14
Description: An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted ConfigureOutsideDiscovery request with an operating system command which will be executed with administrator privileges.  The OS command can read or modify any user or system data and can make the system unavailable.


CVSS Score: 8.8 (HIGH)
CWE: CWE-668, CWE-668
References: https://launchpad.support.sap.com/#/notes/3285757; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3285757
CVE: CVE-2023-24524
Published: 2023-02-14
Description: SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2985905; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/2985905
CVE: CVE-2023-24525
Published: 2023-02-14
Description: SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2788178; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/2788178
CVE: CVE-2023-24528
Published: 2023-02-14
Description: SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600,  allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. This endpoint is normally exposed over the network and successful exploitation can lead to exposure of data like travel documents.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/3290901; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3290901
CVE: CVE-2023-24529
Published: 2023-02-14
Description: Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a Reflected Cross-Site Scripting (XSS) attack. As a result, an attacker may be able to hijack a user session, read and modify some sensitive information.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3282663; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3282663
CVE: CVE-2023-24530
Published: 2023-02-14
Description: SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the application causing high impact on confidentiality, integrity and availability of the application.


CVSS Score: 8.4 (HIGH)
CWE: CWE-434
References: https://launchpad.support.sap.com/#/notes/3256787; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3256787
CVE: CVE-2023-25614
Published: 2023-02-14
Description: SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unauthenticated attacker to inject the code that can be executed by the application over the network. On successful exploitation it can gain access to the sensitive information which leads to a limited impact on the confidentiality and the integrity of the application.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3274585; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3274585
CVE: CVE-2022-43469
Published: 2023-02-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/corona-virus-covid-19-banner/wordpress-corona-virus-covid-19-banner-live-data-plugin-1-7-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/corona-virus-covid-19-banner/wordpress-corona-virus-covid-19-banner-live-data-plugin-1-7-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25066
Published: 2023-02-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-30-7212-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-30-7212-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-25758
Published: 2023-02-14
Description: Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase. The man-in-the-middle access can only be obtained after disassembling a device (i.e., here, "man-in-the-middle" does not refer to the attacker's position on an IP network). NOTE: the vendor states that "our hardware team has updated the security patch without anyone being affected."
CVSS Score: 4.2 (MEDIUM)
References: https://blog.onekey.so/our-response-to-recent-security-fix-reports-13914fea8afd; https://fortune.com/crypto/2023/02/09/cyber-firm-cracks-onekey-crypto-wallets-in-video-raises-questions-hardware-security/amp/; https://github.com/OneKeyHQ/firmware
CVE: CVE-2022-31808
Published: 2023-02-14
Description: A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions < V2.85.43). Affected devices improperly sanitize user input on the telnet command line interface.

This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-658793.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-658793.pdf
CVE: CVE-2022-35868
Published: 2023-02-14
Description: A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (All versions < V1.1), TIA Project-Server V16 (All versions), TIA Project-Server V17 (All versions < V17 Update 6). Affected applications contain an untrusted search path vulnerability that could allow an attacker to escalate privileges, when tricking a legitimate user to start the service from an attacker controlled path.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-426, CWE-426
References: https://cert-portal.siemens.com/productcert/html/ssa-640968.html; https://cert-portal.siemens.com/productcert/pdf/ssa-640968.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-640968.pdf
CVE: CVE-2022-47936
Published: 2023-02-14
Description: A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.1 (All versions < V35.1.150). The affected application contains a stack overflow vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/pdf/ssa-836777.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-836777.pdf
CVE: CVE-2022-47977
Published: 2023-02-14
Description: A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0). The affected application contains a memory corruption vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-836777.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-836777.pdf
CVE: CVE-2023-23835
Published: 2023-02-14
Description: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Applications using Mendix 8 (All versions < V8.18.23), Mendix Applications using Mendix 9 (All versions < V9.22.0), Mendix Applications using Mendix 9 (V9.12) (All versions < V9.12.10), Mendix Applications using Mendix 9 (V9.18) (All versions < V9.18.4), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.15). Some of the Mendix runtime API’s allow attackers to bypass XPath constraints and retrieve information using XPath queries that trigger errors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/pdf/ssa-252808.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-252808.pdf
CVE: CVE-2023-24482
Published: 2023-02-14
Description: A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versions < V10.3.3.2.33), COMOS V10.3.3.3 (All versions < V10.3.3.3.9), COMOS V10.3.3.4 (All versions < V10.3.3.4.6), COMOS V10.4.0.0 (All versions < V10.4.0.0.31), COMOS V10.4.1.0 (All versions < V10.4.1.0.32), COMOS V10.4.2.0 (All versions < V10.4.2.0.25). Cache validation service in COMOS is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-693110.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-693110.pdf
CVE: CVE-2023-24549
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected application is vulnerable to stack-based buffer while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2023-24550
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected application is vulnerable to heap-based buffer while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2023-24551
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected application is vulnerable to heap-based buffer underflow while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2023-24552
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected application contains an out of bounds read past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2023-24553
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2023-24554
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2023-24555
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2023-24556
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2023-24557
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2023-24558
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2023-24559
Published: 2023-02-14
Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf