rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-23077 
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23078 
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23080 
Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906024_2025 and Tenda IT7-PCS Tenda IT7-PCS<=V2209020914 and Tenda IT7-LCS Tenda IT7-LCS<=V2209020914 and Tenda IT7-PRS Tenda IT7-PRS<=V2209020908.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-23082 
A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2023-23086 
Buffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2023-23087 
An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2023-23088 
Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2023-23108 
In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a NULL pointer dereference in the function Xasc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-23109 
In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a divide by zero fault in the function opdiv.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-23110 
An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured with a fixed checksum number. Therefore, an attacker can conduct a MITM attack to modify the user-uploaded firmware image and bypass the checksum verification. This affects WNR612v2 Wireless Routers 1.0.0.3 and earlier, DGN1000v3 Modem Router 1.0.0.22 and earlier, D6100 WiFi DSL Modem Routers 1.0.0.63 and earlier, WNR1000v2 Wireless Routers 1.1.2.60 and earlier, XAVN2001v2 Wireless-N Extenders 0.4.0.7 and earlier, WNR2200 Wireless Routers 1.0.1.102 and earlier, WNR2500 Wireless Routers 1.0.0.34 and earlier, R8900 Smart WiFi Routers 1.0.3.6 and earlier, and R9000 Smart WiFi Routers 1.0.3.6 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-02T00:00:00.000Z
CVE-2023-23119 
The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-02T00:00:00.000Z
CVE-2023-23120 
The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1.07.01 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-02T00:00:00.000Z
CVE-2023-23126 
Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23127 
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23128 
Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and that there is no risk from this behavior. The vulnerability report is thus not valid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23130 
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23131 
Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23132 
Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23135 
An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23136 
lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-23143 
Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC version 2.3-DEV-rev1-g4669ba229-master.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2023-23144 
Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2023-23145 
GPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in lsr_read_rare_full function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2023-23149 
DEK-1705 <=Firmware:34.23.1 device was discovered to have a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-24T00:00:00.000Z
CVE-2023-23150 
SA-WR915ND router firmware v17.35.1 was discovered to be vulnerable to code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-16T00:00:00.000Z
CVE-2023-23151 
bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc_content_media.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-25T00:00:00.000Z
CVE-2023-23155 
Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the username parameter in the Admin Login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-23156 
Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the pid parameter in the single-product page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-23157 
A stored cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fullname parameter on the enquiry page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-23158 
A stored cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the message parameter on the enquiry page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-23161 
A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the artname parameter under ART TYPE option in the navigation bar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-10T00:00:00.000Z
CVE-2023-23162 
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-10T00:00:00.000Z
CVE-2023-23163 
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-10T00:00:00.000Z
CVE-2023-23169 
Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-12T00:00:00.000Z
CVE-2023-23192 
IS Decisions UserLock MFA 11.01 is vulnerable to authentication bypass using scheduled task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-23T00:00:00.000Z
CVE-2023-23205 
An issue was discovered in lib60870 v2.3.2. There is a memory leak in lib60870/lib60870-C/examples/multi_client_server/multi_client_server.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-24T00:00:00.000Z
CVE-2023-23208 
Genesys Administrator Extension (GAX) before 9.0.105.15 is vulnerable to Cross Site Scripting (XSS) via the Business Structure page of the iWD plugin, aka GAX-11261.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-13T00:00:00.000Z
CVE-2023-23277 
Snippet-box 1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote attackers can render arbitrary web script or HTML from the "Snippet code" form field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2023-23279 
Canteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2023-23286 
Cross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via username field from the login form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-10T00:00:00.000Z
CVE-2023-23294 
Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-23T00:00:00.000Z
CVE-2023-23295 
Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-23T00:00:00.000Z
CVE-2023-23296 
Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-23T00:00:00.000Z
CVE-2023-23298 
The `Toybox.Graphics.BufferedBitmap.initialize` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which can result in integer overflows when allocating the underlying bitmap buffer. A malicious application could call the API method with specially crafted parameters and hijack the execution of the device's firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-23299 
The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data such as user profile information and GPS coordinates, among others.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-23300 
The `Toybox.Cryptography.Cipher.initialize` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overflows when copying data. A malicious application could call the API method with specially crafted parameters and hijack the execution of the device's firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-23301 
The `news` MonkeyC operation code in CIQ API version 1.0.0 through 4.1.7 fails to check that string resources are not extending past the end of the expected sections. A malicious CIQ application could craft a string that starts near the end of a section, and whose length extends past its end. Upon loading the string, the GarminOS TVM component may read out-of-bounds memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-23302 
The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-23303 
The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-23304 
The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` module without permission. A malicious application could call any functions from the `Toybox.SensorHistory` module without the user's consent and disclose potentially private or sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-23305 
The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources. A malicious application embedding specially crafted resources could hijack the execution of the device's firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-23306 
The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bounds write operation. A malicious application could create a specially crafted `Toybox.Ant.BurstPayload` object, call its `add` method, override arbitrary memory and hijack the execution of the device's firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-23313 
Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915, Vigor2765, Vigor2766, Vigor2135 v4.4.2.0; Vigor2763 v4.4.2.1; Vigor2862 and Vigor2926 v3.9.9.0; Vigor2925 v3.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-03T00:00:00.000Z
CVE-2023-23314 
An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary code via a crafted .ssh file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-23T00:00:00.000Z
CVE-2023-23315 
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-01T00:00:00.000Z
CVE-2023-23324 
Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-29T00:00:00.000Z
CVE-2023-23325 
Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the NetHostname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-29T00:00:00.000Z
CVE-2023-23326 
A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an administrator's session cookie and hijacking their session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-10T00:00:00.000Z
CVE-2023-23327 
An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stored using the current date as the filename and hosted on the web server without access controls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-10T00:00:00.000Z
CVE-2023-23328 
A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-10T00:00:00.000Z
CVE-2023-23330 
amano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-28T00:00:00.000Z
CVE-2023-23331 
Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-24T00:00:00.000Z
CVE-2023-23333 
There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-23342 HCL Nomad for web is affected by cryptographic validation of local data access that can be circumvented
If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented. 


Affected products: vendor: HCL Software
product: HCL Nomad for web
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2023-08-10T18:46:23.638Z
CVE-2023-23343 HCL BigFix OSD Bare Metal Server version 311.12 or lower is affected by a clickjacking vulnerability.
A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled domain.

Affected products: vendor: HCL Software
product: HCL BigFix OSD Bare Metal Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 2.4
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-06-22T21:57:37.702Z
CVE-2023-23344 HCL BigFix WebUI Insights is susceptible to a lack of sufficient authorization
A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.

Affected products: vendor: HCL Software
product: HCL BigFix WebUI Insights
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-06-23T05:02:52.769Z
CVE-2023-23346 Use of a broken cryptographic algorithm affects HCL DRYiCE MyCloud 
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm.  An attacker can potentially compromise the confidentiality and integrity of sensitive information.

Affected products: vendor: HCL Software
product: HCL DRYiCE MyCloud 
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Published: 2023-08-09T18:52:37.771Z