deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39963
Published: 2023-08-10
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully stealing a session from a logged in user, to create app passwords for the victim. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j4qm-5q5x-54m5; https://github.com/nextcloud/server/pull/39416; https://hackerone.com/reports/2067572
CVE: CVE-2023-39964
Published: 2023-08-10
Description: 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the `api/v1/file.go` file, there is a function called `LoadFromFile`, which directly reads the file by obtaining the requested path `parameter[path]`. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability. Version 1.5.0 has a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0; https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-pv7q-v9mv-9mh5; https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0
CVE: CVE-2023-39965
Published: 2023-08-10
Description: 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may cause a large amount of information leakage. Version 1.5.0 has a patch for this issue.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0; https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-85cf-gj29-f555; https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0
CVE: CVE-2023-39966
Published: 2023-08-10
Description: 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0; https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-hf7j-xj3w-87g4; https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0
CVE: CVE-2023-23342
Published: 2023-08-10
Description: If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented. 


CVSS Score: 6.6 (MEDIUM)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106600; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106600
CVE: CVE-2023-32566
Published: 2023-08-10
Description: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1.
CVSS Score: 9.1 (CRITICAL)
References: https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US; https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US
CVE: CVE-2023-32567
Published: 2023-08-10
Description: Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt; https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt
CVE: CVE-2023-35085
Published: 2023-08-10
Description: An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default settings enabled could allow a Remote Code Execution (RCE).

 

Affected Products:
All UniFi Access Points (Version 6.5.50 and earlier)
All UniFi Switches (Version 6.5.32 and earlier) 
-USW Flex Mini excluded.
 

Mitigation:
Update UniFi Access Points to Version 6.5.62 or later.
Update the UniFi Switches to Version 6.5.59 or later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/9[PII_REDACTED]-44df-b1c6-63c6499f6e56; https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/9[PII_REDACTED]-44df-b1c6-63c6499f6e56
CVE: CVE-2023-38034
Published: 2023-08-10
Description: A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE).

 
Affected Products:
All UniFi Access Points (Version 6.5.53 and earlier)
All UniFi Switches (Version 6.5.32 and earlier) 
-USW Flex Mini excluded.
 

Mitigation:
Update UniFi Access Points to Version 6.5.62 or later.
Update UniFi Switches to Version 6.5.59 or later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/9[PII_REDACTED]-44df-b1c6-63c6499f6e56; https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/9[PII_REDACTED]-44df-b1c6-63c6499f6e56
CVE: CVE-2023-28129
Published: 2023-08-10
Description: DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user.
CVSS Score: 7.8 (HIGH)
References: https://forums.ivanti.com/s/article/SA-2023-07-26-CVE-2023-28129; https://forums.ivanti.com/s/article/SA-2023-07-26-CVE-2023-28129
CVE: CVE-2023-32560
Published: 2023-08-10
Description: An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.

Thanks to a Researcher at Tenable for finding and reporting.

Fixed in version 6.4.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-20, CWE-787
References: http://packetstormsecurity.com/files/174459/Ivanti-Avalance-Remote-Code-Execution.html; http://packetstormsecurity.com/files/174698/Ivanti-Avalanche-MDM-Buffer-Overflow.html; https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US
CVE: CVE-2023-32561
Published: 2023-08-10
Description: A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed in version 6.4.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US; https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US
CVE: CVE-2023-32562
Published: 2023-08-10
Description: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US; https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US
CVE: CVE-2023-32563
Published: 2023-08-10
Description: An unauthenticated attacker could achieve the code execution through a RemoteControl server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US; https://twitter.com/wvuuuuuuuuuuuuu/status/[PII_REDACTED]42923939; https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US
CVE: CVE-2023-32564
Published: 2023-08-10
Description: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US; https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US
CVE: CVE-2023-32565
Published: 2023-08-10
Description: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1.
CVSS Score: 9.1 (CRITICAL)
References: https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US; https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US
CVE: CVE-2023-37625
Published: 2023-08-10
Description: A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Link templates.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/benjaminpsinclair/Netbox-CVE; https://github.com/benjaminpsinclair/Netbox-CVE-2023-37625; https://github.com/netbox-community/netbox/issues/12205
CVE: CVE-2023-39805
Published: 2023-08-10
Description: iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://icms.com; http://icmsdev.com; https://gist.github.com/ChubbyZ/3ad434bd5fc2ab1242dd32500384cfb5
CVE: CVE-2023-39806
Published: 2023-08-10
Description: iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://icms.com; http://icmsdev.com; https://gist.github.com/ChubbyZ/27fa6f43699c9964ddfa701614fc4d5e
CVE: CVE-2023-40014
Published: 2023-08-10
Description: OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-116
References: https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcd; https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5; https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481
CVE: CVE-2023-40224
Published: 2023-08-10
Description: MISP 2.4.174 allows XSS in app/View/Events/index.ctp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/0274f8b6332e82317c9529b583d03897adf5883e; https://github.com/MISP/MISP/commit/0274f8b6332e82317c9529b583d03897adf5883e
CVE: CVE-2023-38333
Published: 2023-08-10
Description: Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-38333.html; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-38333.html
CVE: CVE-2023-40225
Published: 2023-08-10
Description: HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-444
References: https://cwe.mitre.org/data/definitions/436.html; https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856; https://github.com/haproxy/haproxy/issues/2237
CVE: CVE-2023-4275
Published: 2023-08-10
Description: Rejected reason: It is invalid.
CVE: CVE-2023-40235
Published: 2023-08-10
Description: An NTLM Hash Disclosure was discovered in ArchiMate Archi before 5.1.0. When parsing the XMLNS value of an ArchiMate project file, if the namespace does not match the expected ArchiMate URL, the parser will access the provided resource. If the provided resource is a UNC path pointing to a share server that does not accept a guest account, the host will try to authenticate on the share by using the current user's session. NOTE: this issue occurs because Archi uses an unsafe configuration of the Eclipse Modeling Framework.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/archimatetool/archi/commit/bcab676beddfbeddffecacf755b6692f0b0151f1; https://github.com/archimatetool/archi/compare/release_5.0.2...release_5.1.0; https://github.com/archimatetool/archi/issues/946
CVE: CVE-2023-35179
Published: 2023-08-11
Description: 
A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 


CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-4-Hotfix-1?language=en_US; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35179; https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-4-Hotfix-1?language=en_US
CVE: CVE-2023-37511
Published: 2023-08-11
Description: If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.

CVSS Score: 3.5 (LOW)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106690; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106690
CVE: CVE-2023-37512
Published: 2023-08-11
Description: When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.

CVSS Score: 3.3 (LOW)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106691; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106691
CVE: CVE-2023-37513
Published: 2023-08-11
Description: When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.

CVSS Score: 3.3 (LOW)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106692; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106692
CVE: CVE-2023-4304
Published: 2023-08-11
Description: Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.


CVSS Score: 3.8 (LOW)
CWE: CWE-840
References: https://github.com/froxlor/froxlor/commit/ce9a5f97a3edb30c7d33878765d3c014a6583597; https://huntr.dev/bounties/59fe5037-b253-4b0f-be69-1d2e4af8b4a9; https://github.com/froxlor/froxlor/commit/ce9a5f97a3edb30c7d33878765d3c014a6583597
CVE: CVE-2022-25864
Published: 2023-08-11
Description: Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00873.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00873.html
CVE: CVE-2022-27635
Published: 2023-08-11
Description: Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00766.html; https://lists.debian.org/debian-lts-announce/2023/09/msg00043.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HUCYUR4WBTELCRHELISJ3RMZVHKIV5TN/
CVE: CVE-2022-27879
Published: 2023-08-11
Description: Improper buffer restrictions in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-92, CWE-119
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html
CVE: CVE-2022-29470
Published: 2023-08-11
Description: Improper access control in the Intel® DTT Software before version 8.7.10400.15482 may allow an authenticated user to potentially enable escalation of privilege via local access.


CVSS Score: 6.7 (MEDIUM)
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00875.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00875.html
CVE: CVE-2022-29871
Published: 2023-08-11
Description: Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284, CWE-863
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00783.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00783.html
CVE: CVE-2022-29887
Published: 2023-08-11
Description: Cross-site Scripting (XSS) in some Intel(R) Manageability Commander software before version 2.3 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00893.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00893.html
CVE: CVE-2022-34657
Published: 2023-08-11
Description: Improper input validation in firmware for some Intel(R) PCSD BIOS before version 02.01.0013 may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00742.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00742.html
CVE: CVE-2022-36351
Published: 2023-08-11
Description: Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00766.html; https://lists.debian.org/debian-lts-announce/2023/09/msg00043.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HUCYUR4WBTELCRHELISJ3RMZVHKIV5TN/
CVE: CVE-2022-36372
Published: 2023-08-11
Description: Improper buffer restrictions in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-92, CWE-119
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html
CVE: CVE-2022-36392
Published: 2023-08-11
Description: Improper input validation in some firmware for Intel(R) AMT and Intel(R) Standard Manageability before versions 11.8.94, 11.12.94, 11.22.94, 12.0.93, 14.1.70, 15.0.45, and 16.1.27 in Intel (R) CSME may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-116
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00783.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00783.html
CVE: CVE-2022-37336
Published: 2023-08-11
Description: Improper input validation in BIOS firmware for some Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.9 (HIGH)
CWE: CWE-20
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00892.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00892.html
CVE: CVE-2022-37343
Published: 2023-08-11
Description: Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html
CVE: CVE-2022-38076
Published: 2023-08-11
Description: Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 3.8 (LOW)
CWE: CWE-20
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00766.html; https://lists.debian.org/debian-lts-announce/2023/09/msg00043.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HUCYUR4WBTELCRHELISJ3RMZVHKIV5TN/
CVE: CVE-2022-38083
Published: 2023-08-11
Description: Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-665, CWE-665
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html
CVE: CVE-2022-38102
Published: 2023-08-11
Description: Improper Input validation in firmware for some Intel(R) Converged Security and Management Engine before versions 15.0.45, and 16.1.27 may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00783.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00783.html
CVE: CVE-2022-38973
Published: 2023-08-11
Description: Improper access control for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow an authenticated user to potentially enable denial of service or infomation disclosure via local access.
CVSS Score: 3.3 (LOW)
CWE: CWE-284
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00812.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00812.html