rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-23431 

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.


Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Honor
product: NTH-AN00
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2023-12-29T01:32:38.086Z
CVE-2023-23432 

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.


Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Honor
product: NTH-AN00
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2023-12-29T01:20:05.826Z
CVE-2023-23433 

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.


Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Honor
product: NTH-AN00
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-12-29T01:49:15.081Z
CVE-2023-23434 

Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.


Affected products: vendor: Honor
product: HonorBoardApp
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-12-29T02:05:48.279Z
CVE-2023-23435 

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file


Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Honor
product: Magic OS	
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-12-29T02:08:26.355Z
CVE-2023-23436 

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file





Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Honor
product: Magic OS	
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Published: 2023-12-29T02:12:01.783Z
CVE-2023-23437 

Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak


Affected products: vendor: Honor
product: com.hihonor.vmall	
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-12-29T02:15:09.314Z
CVE-2023-23438 

Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions


Affected products: vendor: Honor
product: LGE-AN00	
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-12-29T02:19:58.450Z
CVE-2023-23439 

Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.


Affected products: vendor: Honor
product: LGE-AN00	
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-12-29T02:44:27.460Z
CVE-2023-23440 

Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
Affected products: vendor: Honor
product: LGE-AN00
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-12-29T02:47:56.978Z
CVE-2023-23441 

Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.


Affected products: vendor: Honor
product: Magic UI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2023-12-29T03:11:48.552Z
CVE-2023-23442 

Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.


Affected products: vendor: Honor
product: Magic OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L
version: 3.1
Published: 2023-12-29T03:15:52.271Z
CVE-2023-23443 

Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.


Affected products: vendor: Honor
product: Magic OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L
version: 3.1
Published: 2023-12-29T03:18:41.853Z
CVE-2023-23445 
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers
1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote
attacker to gain unauthorized access to data fields by using a therefore unpriviledged account via the
REST interface.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: SICK AG
product: SICK FTMG-ESD15AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD20AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD25AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN50SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR50SXX AIR FLOW SENSOR
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2023-05-15T10:51:44.194Z
CVE-2023-23446 
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers
1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the REST interface.
Problem types: cwe_id: CWE-284
description: CWE-284 (Improper Access Control)
Affected products: vendor: SICK AG
product: SICK FTMG-ESD15AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD20AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD25AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN50SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR50SXX AIR FLOW SENSOR
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2023-05-15T10:52:30.269Z
CVE-2023-23447 
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged
remote attacker to influence the availability of the webserver by invocing several open file requests via
the REST interface.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: SICK AG
product: SICK FTMG-ESD15AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD20AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD25AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN50SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR50SXX AIR FLOW SENSOR
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2023-05-15T10:53:05.800Z
CVE-2023-23448 
Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a
remote attacker to gain information about valid usernames via analysis of source code.
Problem types: cwe_id: CWE-540
description: CWE-540: Inclusion of Sensitive Information in Source Code
Affected products: vendor: SICK AG
product: SICK FTMG-ESD15AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD20AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD25AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN50SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR50SXX AIR FLOW SENSOR
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: 2023-05-15T10:53:31.506Z
CVE-2023-23449 
Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker
to gain information about valid usernames by analyzing challenge responses from the server via the
REST interface.
Problem types: cwe_id: CWE-204
description: CWE-204: Observable Response Discrepancy
Affected products: vendor: SICK AG
product: SICK FTMG-ESD15AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD20AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD25AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN50SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR50SXX AIR FLOW SENSOR
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: 2023-05-15T10:54:46.463Z
CVE-2023-23450 
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR
FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526
allows an unprivileged remote attacker to use a password hash instead of an actual password to login
to a valid user account via the REST interface.
Problem types: cwe_id: CWE-836
description: CWE-836 (Use of Password Hash Instead of Password for Authentication)
Affected products: vendor: SICK AG
product: SICK FTMG-ESD15AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD20AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD25AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN50SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR50SXX AIR FLOW SENSOR
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.2
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2023-05-15T10:55:10.687Z
CVE-2023-23451 
The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN1 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN3S04 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN4 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK FX0-GENT00000 FLEXISOFT EIP GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GMOD00000 FLEXISOFT MOD GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GPNT00000 FLEXISOFT PNET GATEW. with serial number <=2311xxxx with Firmware <=V2.12.0, SICK FX0-GENT00030 FLEXISOFT EIP GATEW.V2 with serial number <=2311xxxx all Firmware versions, SICK FX0-GPNT00030 FLEXISOFT PNET GATEW.V2 with serial number <=2311xxxx all Firmware versions and SICK FX0-GMOD00010 FLEXISOFT MOD GW with serial number <=2311xxxx with Firmware <=V2.11.0 all have Telnet enabled by factory default. No password is set in the default configuration.
Problem types: cwe_id: CWE-477
description: CWE-477
Affected products: vendor: N/A
product: SICK FX0-GENT00000, SICK FX0-GENT00030, SICK FX0-GMOD00000, SICK FX0-GMOD00010, SICK FX0-GPNT00000, SICK FX0-GPNT00030, SICK UE410-EN1, SICK UE410-EN3, SICK UE410-EN3S04, SICK UE410-EN4
Published: 2023-04-19T00:00:00.000Z
CVE-2023-23452 
Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution via maliciously crafted RK512 commands to the listener on TCP port 9000.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: n/a
product: FX0-GPNT v3 Firmware
Published: 2023-02-20T00:00:00.000Z
CVE-2023-23453 
Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary remote code execution via maliciously crafted RK512 commands to the listener on TCP port 9000.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: n/a
product: FX0-GENT v3 Firmware
Published: 2023-02-20T00:00:00.000Z
CVE-2023-23454 
cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-12T00:00:00.000Z
CVE-2023-23455 
atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-12T00:00:00.000Z
CVE-2023-23456 Upx: heap-buffer-overflow in packtmt::pack()
A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Chenweijia for reporting this issue.
Published: 2023-01-12T00:00:00.000Z
CVE-2023-23457 Upx: segv on packlinuxelf64::invert_pt_dynamic() in p_lx_elf.cpp
A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.
Problem types: cwe_id: CWE-119
description: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Chenweijia for reporting this issue.
Published: 2023-01-12T00:00:00.000Z
CVE-2023-23458 Sunell DVR – Exposure of Sensitive Information
Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Sunell
product: DVR
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Moriel Harush, Dudu Moyal
Published: 2023-02-15T00:00:00.000Z
CVE-2023-23459 Priority Windows – Command Execution via SQL Injection 
Priority Windows may allow Command Execution via SQL Injection using an unspecified method.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Priority
product: Priority for Windows
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
Credits: lang: en
value: Gad Abuhatzeira- Sophtix Security LTD
Published: 2023-02-15T00:00:00.000Z
CVE-2023-23460 Priority Web – Authentication bypass 
Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass.
Problem types: description: Authentication bypass 
Affected products: vendor: Priority
product: Priority Web
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
Credits: lang: en
value: Gad Abuhatzeira- Sophtix Security LTD
Published: 2023-02-15T00:00:00.000Z
CVE-2023-23461 Libpeconv – access violation
Libpeconv – access violation, before commit b076013 (30/11/2022).
Problem types: description: access violation
Affected products: vendor: Hasherezade (github)
product: Libpeconv
Credits: lang: en
value: Tomer Dricker
Published: 2023-02-15T00:00:00.000Z
CVE-2023-23462 Libpeconv – integer overflow
Libpeconv – integer overflow, before commit 75b1565 (30/11/2022).
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Hasherezade (github)
product: Libpeconv
Credits: lang: en
value: Tomer Dricker
Published: 2023-02-15T00:00:00.000Z
CVE-2023-23463  Sunell DVR – Insufficiently Protected Credentials
Sunell DVR, latest version, Insufficiently Protected Credentials (CWE-522) may be exposed through an unspecified request.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Sunell 
product: DVR
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Dudu Moyal
Published: 2023-02-15T00:00:00.000Z