rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-50434 
emdns_resolve_raw in emdns.c in emdns through fbd1eef calls strlen with an input that may not be '\0' terminated, leading to a stack-based buffer over-read. This can be triggered by a remote adversary that can send DNS requests to the emdns server. The impact could vary depending on the system libraries, compiler, and processor architecture. Code before be565c3 is unaffected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-29T00:00:00.000Z
CVE-2023-50436 
An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The earliest affected version is 7.1.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2023-50437 
An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2023-50439 
ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission), ZED! for Windows before Q.2021.2 (ANSSI qualification submission), ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission), ZONECENTRAL for Windows before 2023.5, or ZEDMAIL for Windows before 2023.5 disclose the original path in which the containers were created, which allows an unauthenticated attacker to obtain some information regarding the context of use (project name, etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-50440 
ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before 2023.5; ZEDMAIL for Windows before 2023.5; ZED! for Windows, Mac, Linux before 2023.5; ZEDFREE for Windows, Mac, Linux before 2023.5; or ZEDPRO for Windows, Mac, Linux before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger network access to an attacker-controlled computer when opened by the victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-50441 
Encrypted folders created by PRIMX ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission) or ZONECENTRAL for Windows before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger outbound network traffic from computers on which folders are opened.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-50442 
Encrypted folders created by PRIMX ZONECENTRAL through 2023.5 can be modified by a local attacker (with appropriate privileges) so that specific file types are excluded from encryption temporarily. (This modification can, however, be detected, as described in the Administrator Guide.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-50443 
Encrypted disks created by PRIMX CRYHOD for Windows before Q.2020.4 (ANSSI qualification submission) or CRYHOD for Windows before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger outbound network traffic from computers on which disks are opened.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-50444 
By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before 2023.5; ZEDMAIL for Windows before 2023.5; and ZED! for Windows, Mac, Linux before 2023.5 include an encrypted version of sensitive user information, which could allow an unauthenticated attacker to obtain it via brute force.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-50445 
Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-28T00:00:00.000Z
CVE-2023-50446 
An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate privileges to SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-10T00:00:00.000Z
CVE-2023-50447 
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2023-50448 
In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-28T00:00:00.000Z
CVE-2023-50449 
JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-10T00:00:00.000Z
CVE-2023-50450 
An issue was discovered in Sensopart VISOR Vision Sensors before 2.10.0.2 allows local users to perform unspecified actions with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-23T00:00:00.000Z
CVE-2023-50453 
An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration data of user object attributes, such as selectable values, which should not be visible to the public.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-10T00:00:00.000Z
CVE-2023-50454 
An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-10T00:00:00.000Z
CVE-2023-50455 
An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests for a known address to cause Denial Of Service (generation of many emails, which would also spam the victim).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-10T00:00:00.000Z
CVE-2023-50456 
An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-10T00:00:00.000Z
CVE-2023-50457 
An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-10T00:00:00.000Z
CVE-2023-50458 
In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs.
Problem types: cwe_id: CWE-1230
description: CWE-1230 Exposure of Sensitive Information Through Metadata
Affected products: vendor: dradisframework
product: Dradis
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.5
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Published: 2025-07-10T00:00:00.000Z
CVE-2023-50463 
The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in reverse_proxy or IP address range restrictions).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-10T00:00:00.000Z
CVE-2023-50465 
A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-11T00:00:00.000Z
CVE-2023-50466 
An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or access sensitive information via injecting a crafted payload into the HMI Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-19T00:00:00.000Z
CVE-2023-50469 
Shenzhen Libituo Technology Co., Ltd LBT-T300-T310 v2.2.2.6 was discovered to contain a buffer overflow via the ApCliEncrypType parameter at /apply.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-15T00:00:00.000Z
CVE-2023-50470 
A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-28T00:00:00.000Z
CVE-2023-50471 
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-50472 
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-50473 
Cross-Site Scripting (XSS) vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session identifiers (SID) in index.js file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-21T00:00:00.000Z
CVE-2023-50475 
An issue was discovered in bcoin-org bcoin version 2.2.0, allows remote attackers to obtain sensitive information via weak hashing algorithms in the component \vendor\faye-websocket.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-21T00:00:00.000Z
CVE-2023-50477 
An issue was discovered in nos client version 0.6.6, allows remote attackers to escalate privileges via getRPCEndpoint.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-21T00:00:00.000Z
CVE-2023-50481 
An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms in the component /presets/ssr-auth-chain.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-21T00:00:00.000Z
CVE-2023-50488 
An issue in Blurams Lumi Security Camera (A31C) v23.0406.435.4120 allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2023-50495 
NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-12T00:00:00.000Z
CVE-2023-50550 
layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-30T00:00:00.000Z
CVE-2023-50559 
An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-29T00:00:00.000Z
CVE-2023-50563 
Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-50564 
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-50565 
A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-50566 
A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-50570 
An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because an infinite loop occurs only for cases in which the developer supplies invalid arguments. The product is not intended to always halt for contrived inputs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-29T00:00:00.000Z
CVE-2023-50571 
easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-29T00:00:00.000Z
CVE-2023-50572 
An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-29T00:00:00.000Z
CVE-2023-50578 
Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-30T00:00:00.000Z
CVE-2023-50585 
Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-09T00:00:00.000Z
CVE-2023-50589 
Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-30T00:00:00.000Z
CVE-2023-50609 
Cross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via a crafted script to ajax.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-06T00:00:00.000Z
CVE-2023-50612 
Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-06T00:00:00.000Z
CVE-2023-50614 
An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-18T00:00:00.000Z
CVE-2023-50628 
Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive information via parser.c component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50630 
Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script to the click here function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-04T00:00:00.000Z
CVE-2023-50639 
Cross Site Scripting (XSS) vulnerability in CuteHttpFileServer v.1.0 and v.2.0 allows attackers to obtain sensitive information via the file upload function in the home page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50643 
An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-09T00:00:00.000Z
CVE-2023-50651 
TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-30T00:00:00.000Z
CVE-2023-50658 
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2023-50671 
In exiftags 1.01, nikon_prop1 in nikon.c has a heap-based buffer overflow (write of size 28) because snprintf can write to an unexpected address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-11T00:00:00.000Z
CVE-2023-50677 
An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file parameter to the /setup.cgi component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2023-50685 
An issue in Hipcam Cameras RealServer v.1.0 allows a remote attacker to cause a denial of service via a crafted script to the client_port parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-02T00:00:00.000Z
CVE-2023-50692 
File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-28T00:00:00.000Z
CVE-2023-50693 
An issue in Jester v.0.6.0 and before allows a remote attacker to send a malicious crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2023-50694 
An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to send a malicious crafted request due to insufficient parsing in the parser.nim component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2023-50700 
Insecure Permissions vulnerability in Deepin dde-file-manager 6.0.54 and earlier allows privileged operations to be called by unprivileged users via the D-Bus method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2023-50702 
Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged users have write access to %PROGRAMDATA%\SSCService). Consequently, low-privileged users can execute arbitrary code as LocalSystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-26T00:00:00.000Z
CVE-2023-50703  Cleartext Transmission of Sensitive Information in EFACEC UC 500E

An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized access to the application.





Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: EFACEC
product: UC 500E
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez of S21sec
Published: 2023-12-19T23:40:49.215Z
CVE-2023-50704 URL Redirection to Untrusted Site ('Open Redirect') in EFACEC UC 500E





An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate phishing attacks against application users.








Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: EFACEC
product: UC 500E
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez of S21sec
Published: 2023-12-19T23:43:11.595Z
CVE-2023-50705 Exposure of Sensitive Information to an Unauthorized Actor in EFACEC UC 500E









An attacker could create malicious requests to obtain sensitive information about the web server.







Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: EFACEC
product: UC 500E
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez of S21sec
Published: 2023-12-19T23:45:17.101Z
CVE-2023-50706   Improper Access Control in EFACEC UC 500E













A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or valid session tokens.




Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: EFACEC
product: UC 500E
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez of S21sec
Published: 2023-12-19T23:47:49.654Z