rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-1504 SourceCodester Alphaware Simple E-Commerce System sql injection
A vulnerability classified as critical was found in SourceCodester Alphaware Simple E-Commerce System 1.0. This vulnerability affects unknown code. The manipulation of the argument email/password with the input test1%40test.com ' AND (SELECT 6077 FROM (SELECT(SLEEP(5)))dltn) AND 'PhRa'='PhRa leads to sql injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223408.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Alphaware Simple E-Commerce System
CVSS v3.1: version: 3.1
baseScore: 5.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: WWesleywww (VulDB User)
Published: 2023-03-20T08:31:03.956Z
CVE-2023-1505 SourceCodester E-Commerce System setDiscount.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester E-Commerce System 1.0. This issue affects some unknown processing of the file /ecommerce/admin/settings/setDiscount.php. The manipulation of the argument id with the input 201737 AND (SELECT 8973 FROM (SELECT(SLEEP(5)))OoAD) leads to sql injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-223409 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: E-Commerce System
CVSS v3.1: version: 3.1
baseScore: 5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: WWesleywww (VulDB User)
Published: 2023-03-20T09:00:06.223Z
CVE-2023-1506 SourceCodester E-Commerce System login.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester E-Commerce System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument U_USERNAME leads to sql injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-223410 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: E-Commerce System
CVSS v3.1: version: 3.1
baseScore: 5.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: WWesleywww (VulDB User)
Published: 2023-03-20T09:31:04.091Z
CVE-2023-1507 SourceCodester E-Commerce System Category Name controller.php cross site scripting
A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /ecommerce/admin/category/controller.php of the component Category Name Handler. The manipulation of the argument CATEGORY leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223411.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: E-Commerce System
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: WWesleywww (VulDB User)
Published: 2023-03-20T10:00:04.240Z
CVE-2023-1508 SQLi in AdamPOS's Mobilmen Terminal Software
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adam Retail Automation Systems Mobilmen Terminal Software allows SQL Injection.

This issue affects Mobilmen Terminal Software: before 3.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Adam Retail Automation Systems
product: Mobilmen Terminal Software
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Omer Fatih YEGIN
Published: 2023-05-23T20:00:41.023Z
CVE-2023-1509 GMAce <= 1.5.2 - Cross-Site Request Forgery to Arbitrary File Modification (Creation/Overwrite/Deletion)
The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing nonce validation on the gmace_manager_server function called via the wp_ajax_gmace_manager AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: gmdragonx
product: GMAce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-03-29T10:14:35.275Z
CVE-2023-1513 
A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.
Problem types: cwe_id: CWE-665
description: CWE-665
Affected products: vendor: n/a
product: Linux kernel (KVM)
Published: 2023-03-23T00:00:00.000Z
CVE-2023-1514 
A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Hitachi Energy
product: RTU500 Scripting Interface
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2023-12-19T14:22:37.619Z
CVE-2023-1515 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2023-03-20T00:00:00.000Z
CVE-2023-1516 
RoboDK versions 5.5.3 and prior contain an insecure permission 
assignment to critical directories vulnerability, which could allow a 
local user to escalate privileges and write files to the RoboDK process 
and achieve code execution.  


Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: RoboDK 
product: RoboDK 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Noam Moshe of Claroty reported this vulnerability to CISA. 
Published: 2023-03-28T20:34:52.453Z
CVE-2023-1517 Cross-site Scripting (XSS) - DOM in pimcore/pimcore
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2023-03-20T00:00:00.000Z
CVE-2023-1518 
CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to 
sensitive credentials being leaked because they are insufficiently 
protected.   


Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: CP Plus
product: KVMS Pro
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Harshit Shukla reported this vulnerability to CISA. 
Published: 2023-03-28T20:51:54.826Z
CVE-2023-1521 Local Privilege Escalation in sccache
On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.


If the server is run as root (which is the default when installing the  snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.
Problem types: cwe_id: CWE-426
description: CWE-426 Untrusted Search Path
Affected products: vendor: Mozilla
product: sccache
default_status: unknown
Credits: lang: en
value: Paolo Tranquilli (@redsun82)
Published: 2024-11-26T11:15:59.434Z
CVE-2023-1522 
SQL Injection in the Hardware Inventory report of Security Center 5.11.2.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Genetec Inc.
product: Genetec Security Center
default_status: unaffected
Published: 2023-04-05T18:51:02.590Z
CVE-2023-1523 
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.
Affected products: vendor: Canonical Ltd.
product: snapd
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
baseScore: 10
baseSeverity: CRITICAL
Published: 2023-09-01T18:41:47.820Z
CVE-2023-1524 Download Manager < 3.2.71 - Broken Access Controls
The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's password.
Problem types: description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: Download Manager
default_status: unaffected
Credits: lang: en
value: Johan Kragt
lang: en
value: WPScan
Published: 2023-05-30T07:49:11.466Z
CVE-2023-1525 Site Reviews < 6.7.1 - Admin+ Stored XSS
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Site Reviews
default_status: unaffected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2023-05-02T07:04:49.421Z
CVE-2023-1526 
Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard disk drive is physically removed from the printer.
Affected products: vendor: HP Inc.
product: HP DesignJet and PageWide XL
Published: 2023-04-28T16:04:13.185Z
CVE-2023-1527 Cross-site Scripting (XSS) - Generic in tsolucio/corebos
Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tsolucio
product: tsolucio/corebos
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1528 
Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2023-03-21T20:50:55.704Z
CVE-2023-1529 
Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a malicious HID device. (Chromium security severity: High)
Problem types: description: Out of bounds memory access
Affected products: vendor: Google
product: Chrome
Published: 2023-03-21T20:50:55.930Z
CVE-2023-1530 
Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2023-03-21T20:50:56.042Z
CVE-2023-1531 
Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2023-03-21T20:50:56.155Z
CVE-2023-1532 
Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2023-03-21T20:50:56.271Z
CVE-2023-1533 
Use after free in WebProtect in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2023-03-21T20:50:56.386Z
CVE-2023-1534 
Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2023-03-21T20:50:56.608Z
CVE-2023-1535 Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: answerdev
product: answerdev/answer
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1536 Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: answerdev
product: answerdev/answer
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1537 Authentication Bypass by Capture-replay in answerdev/answer
Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
Problem types: cwe_id: CWE-294
description: CWE-294 Authentication Bypass by Capture-replay
Affected products: vendor: answerdev
product: answerdev/answer
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1538 Observable Timing Discrepancy in answerdev/answer
Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
Problem types: cwe_id: CWE-208
description: CWE-208 Observable Timing Discrepancy
Affected products: vendor: answerdev
product: answerdev/answer
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1539 Improper Restriction of Excessive Authentication Attempts in answerdev/answer
Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.
Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: answerdev
product: answerdev/answer
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1540 Observable Response Discrepancy in answerdev/answer
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
Problem types: cwe_id: CWE-204
description: CWE-204 Observable Response Discrepancy
Affected products: vendor: answerdev
product: answerdev/answer
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1541 Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: answerdev
product: answerdev/answer
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1542 Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: answerdev
product: answerdev/answer
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1543 Insufficient Session Expiration in answerdev/answer
Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: answerdev
product: answerdev/answer
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1544 Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read()
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read
Affected products: default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank SorryMybad (Kunlun Lab) for reporting this issue.
Published: 2023-03-23T00:00:00.000Z
CVE-2023-1545  SQL Injection in nilsteampassnet/teampass
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: nilsteampassnet
product: nilsteampassnet/teampass
Published: 2023-03-21T00:00:00.000Z
CVE-2023-1546 MyCryptoCheckout  < 2.124 - Reflected XSS
The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: MyCryptoCheckout
default_status: unaffected
Credits: lang: en
value: Pablo Sanchez
lang: en
value: WPScan
Published: 2023-05-02T07:05:00.258Z
CVE-2023-1547 SQLi in Elra Computers Parkmatik
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Elra Parkmatik allows SQL Injection through SOAP Parameter Tampering, Command Line Execution through SQL Injection.

This issue affects Parkmatik: before 02.01-a51.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Elra
product: Parkmatik
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Resul Melih MACIT
Published: 2023-07-13T07:42:44.365Z
CVE-2023-1548 

A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to
perform a denial of service through the console server service that is part of EcoStruxure Control Expert. Affected Products: EcoStruxure Control Expert (V15.1 and above)
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Schneider Electric
product: EcoStruxure Control Expert
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-04-18T16:42:18.451Z
CVE-2023-1549 Ad Inserter < 2.7.27 - Admin+ PHP Object Injection
The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Problem types: description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Unknown
product: Ad Inserter
default_status: unaffected
Credits: lang: en
value: Nguyen Huu Do
lang: en
value: WPScan
Published: 2023-05-15T12:15:30.894Z
CVE-2023-1550 NGINX Agent vulnerability CVE-2023-1550
Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: F5
product: NGINX Agent
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-03-29T16:34:38.119Z