rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-1099 SourceCodester Online Student Management System edit-class-detail.php sql injection
A vulnerability was found in SourceCodester Online Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file eduauth/edit-class-detail.php. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-222002 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Online Student Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: 0chen (VulDB User)
Published: 2023-02-28T20:03:21.662Z
CVE-2023-1100 SourceCodester Online Catering Reservation System POST Parameter add_message.php sql injection
A vulnerability classified as critical has been found in SourceCodester Online Catering Reservation System 1.0. This affects an unknown part of the file /reservation/add_message.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222003.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Online Catering Reservation System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: jackswordsz (VulDB User)
Published: 2023-02-28T20:07:24.304Z
CVE-2023-1101 
SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes.
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: SonicWall
product: SonicOS
Published: 2023-03-02T00:00:00.000Z
CVE-2023-1104 Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: flatpressblog
product: flatpressblog/flatpress
Published: 2023-03-01T00:00:00.000Z
CVE-2023-1105 External Control of File Name or Path in flatpressblog/flatpress
External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: flatpressblog
product: flatpressblog/flatpress
Published: 2023-03-01T00:00:00.000Z
CVE-2023-1106 Cross-site Scripting (XSS) - Reflected in flatpressblog/flatpress
Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: flatpressblog
product: flatpressblog/flatpress
Published: 2023-03-02T00:00:00.000Z
CVE-2023-1107 Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: flatpressblog
product: flatpressblog/flatpress
Published: 2023-03-02T00:00:00.000Z
CVE-2023-1109 PHOENIX CONTACT: Directory Traversal Vulnerability in ENERGY AXC PU Web service
In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: PHOENIX CONTACT
product: ENERGY AXC PU (1264327)
default_status: unaffected
vendor: PHOENIX CONTACT
product: SMARTRTU AXC SG (1110435)
default_status: unaffected
vendor: PHOENIX CONTACT
product: SMARTRTU AXC IG (1264328)
default_status: unaffected
vendor: PHOENIX CONTACT
product: Infobox (1169323 )
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Laokoon SecurITy GmbH on behalf of E.ON Digital Technology GmbH
Published: 2023-04-17T07:32:24.262Z
CVE-2023-1110 Yellow Yard < 2.8.12 - Contributor+ Stored XSS
The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Yellow Yard Searchbar
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-08-16T11:03:26.120Z
CVE-2023-1111 FastCMS New Article Tab cross site scripting
A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic. Affected by this issue is some unknown functionality of the component New Article Tab. The manipulation of the argument Title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266126 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: FastCMS
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB Gitee Analyzer
Published: 2024-05-24T06:31:07.931Z
CVE-2023-1112 Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: n/a
product: Drag and Drop Multiple File Upload Contact Form 7
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Nicholas Ferreira
lang: en
value: Nickguitar (VulDB User)
Published: 2023-03-01T09:54:38.579Z
CVE-2023-1113 SourceCodester Simple Payroll System POST Parameter cross site scripting
A vulnerability was found in SourceCodester Simple Payroll System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file admin/?page=admin of the component POST Parameter Handler. The manipulation of the argument fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222073 was assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: Simple Payroll System
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: lcg22266 (VulDB User)
Published: 2023-03-01T09:57:48.233Z
CVE-2023-1114 Improper Input Validation on e-Belediye
Missing Authorization vulnerability in Eskom e-Belediye allows Information Elicitation.

This issue affects e-Belediye: from 1.0.0.95 before 1.0.0.100.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Eskom
product: e-Belediye
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Aybike VURAL
Published: 2023-03-01T11:50:52.988Z
CVE-2023-1115 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2023-03-01T00:00:00.000Z
CVE-2023-1116 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2023-03-01T00:00:00.000Z
CVE-2023-1117 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2023-03-01T00:00:00.000Z
CVE-2023-1118 
A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: Kernel
Published: 2023-03-02T00:00:00.000Z
CVE-2023-1119 Multiple Plugins - Cross-Site Scripting From Third-party Library
The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP-Optimize
default_status: unaffected
vendor: Unknown
product: SrbTransLatin
default_status: unaffected
Credits: lang: en
value: Paolo Elia
lang: en
value: WPScan
Published: 2023-07-10T12:40:23.149Z
CVE-2023-1120 Simple Giveaways < 2.45.1 - Admin+ Stored XSS
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Giveaways
default_status: unaffected
Credits: lang: en
value: ipatelsumit
lang: en
value: WPScan
Published: 2023-04-10T13:18:00.817Z
CVE-2023-1121 Simple Giveaways < 2.45.1 - Admin+ Stored Cross-Site Scripting
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Giveaways
default_status: unaffected
Credits: lang: en
value: Varun
lang: en
value: WPScan
Published: 2023-04-10T13:18:04.716Z
CVE-2023-1122 Simple Giveaways < 2.45.1 - Editor+ Stored Cross-Site Scripting
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Giveaways
default_status: unaffected
Credits: lang: en
value: Varun
lang: en
value: WPScan
Published: 2023-04-10T13:17:53.053Z
CVE-2023-1124 Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI
The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Shopping Cart & eCommerce Store
default_status: unaffected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2023-04-03T14:38:26.671Z
CVE-2023-1125 Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR
The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.
Problem types: description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: Ruby Help Desk
default_status: unaffected
Credits: lang: en
value: Ameen Alkurdy
lang: en
value: WPScan
Published: 2023-05-02T07:04:52.700Z
CVE-2023-1126 WP FEvents Book <= 0.46 - Subscriber+ Stored XSS
The WP FEvents Book WordPress plugin through 0.46 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP FEvents Book
default_status: affected
Credits: lang: en
value: Ameen Alkurdy
lang: en
value: WPScan
Published: 2023-04-24T18:30:55.522Z
CVE-2023-1127 Divide By Zero in vim/vim
Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
Problem types: cwe_id: CWE-369
description: CWE-369 Divide By Zero
Affected products: vendor: vim
product: vim/vim
Published: 2023-03-01T00:00:00.000Z
CVE-2023-1129 WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR
The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.
Problem types: description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: WP FEvents Book
default_status: affected
Credits: lang: en
value: Ameen Alkurdy
lang: en
value: WPScan
Published: 2023-04-24T18:30:52.240Z
CVE-2023-1130 SourceCodester Computer Parts Sales and Inventory System processlogin sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file processlogin. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222105 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Computer Parts Sales and Inventory System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: xiaohua_ruilong (VulDB User)
Published: 2023-03-01T19:34:48.882Z
CVE-2023-1131 SourceCodester Computer Parts Sales and Inventory System customer.php cross site scripting
A vulnerability has been found in SourceCodester Computer Parts Sales and Inventory System 1.0 and classified as problematic. This vulnerability affects unknown code of the file customer.php. The manipulation of the argument FIRST_NAME/LAST_NAME/PHONE_NUMBER leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222106 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: Computer Parts Sales and Inventory System
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: xiaohua_ruilong (VulDB User)
Published: 2023-03-01T19:36:23.778Z
CVE-2023-1132 Key duplication in GSDK

Compiler removal of buffer clearing in 

sli_se_driver_key_agreement

 in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


Problem types: cwe_id: CWE-14
description: CWE-14: Compiler Removal of Code to Clear Buffers
Affected products: vendor: silabs.com
product: Gecko Platform
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-05-18T18:44:04.702Z
CVE-2023-1133 CVE-2023-1133
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow an unauthenticated attacker to remotely execute arbitrary code.
Problem types: description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-03-27T14:33:18.921Z
CVE-2023-1134 CVE-2023-1134
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a path traversal vulnerability, which could allow an attacker to read local files, disclose plaintext credentials, and escalate privileges.
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
baseScore: 7.1
baseSeverity: HIGH
Published: 2023-03-27T14:47:43.501Z
CVE-2023-1135 

























In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which could result in local privilege escalation.
























Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Piotr Bazydlo (@chudypd) of Trend Micro and Anonymous working with Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2023-03-27T14:59:57.462Z
CVE-2023-1136 CVE-2023-1136
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authentication bypass.
Problem types: description: CWE-287 Improper Authentication
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-03-27T14:50:18.966Z
CVE-2023-1137 CVE-2023-1137
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation.
Problem types: description: CWE-284
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2023-03-27T14:44:40.332Z
CVE-2023-1138 CVE-2023-1138
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain an improper access control vulnerability, which could allow an attacker to retrieve Gateway configuration files to obtain plaintext credentials.
Problem types: description: CWE-284
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Published: 2023-03-27T14:41:48.610Z
CVE-2023-1139 CVE-2023-1139
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
Problem types: description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Published: 2023-03-27T14:36:28.810Z
CVE-2023-1140 CVE-2023-1140
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauthenticated remote code execution in the context of an administrator.
Problem types: description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-03-27T14:54:53.192Z