rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-39063 
Buffer Overflow vulnerability in RaidenFTPD 2.4.4005 allows a local attacker to execute arbitrary code via the Server name field of the Step by step setup wizard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2023-39067 
Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to execute arbitrary code via a crafted script to the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2023-39068 
Buffer Overflow vulnerability in NBD80S09S-KLC v.YK_HZXM_NBD80S09S-KLC_V4.03.R11.7601.Nat.OnvifC.20230414.bin and NBD80N32RA-KL-V3 v.YK_HZXM_NBD80N32RA-KL_V4.03.R11.7601.Nat.OnvifC.20220120.bin allows a remote attacker to casue a denial of service via a crafted request to the service.XM component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2023-39069 
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2023-39070 
An issue in Cppcheck 2.12 dev allows a local attacker to execute arbitrary code via the removeContradiction parameter in token.cpp:1934.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2023-39073 
An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-12T00:00:00.000Z
CVE-2023-39075 
Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) allows attackers to crash the infotainment system by sending arbitrary USB data via a USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-39076 
Injecting random data into the USB memory area on a General Motors (GM) Chevrolet Equinox 2021 Software. 2021.03.26 (build version) vehicle causes a Denial of Service (DoS) in the in-car infotainment system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-08T00:00:00.000Z
CVE-2023-39086 
ASUS RT-AC66U B1 3.0.0.4.286_51665 was discovered to transmit sensitive information in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-39094 
Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username parameter in the student list function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-39096 
WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and output encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-39097 
WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-39106 
An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-39107 
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-04T00:00:00.000Z
CVE-2023-39108 
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-01T00:00:00.000Z
CVE-2023-39109 
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-01T00:00:00.000Z
CVE-2023-39110 
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-01T00:00:00.000Z
CVE-2023-39112 
ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-04T00:00:00.000Z
CVE-2023-39113 
ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c. This vulnerability is triggered when running the program gif2tga.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-02T00:00:00.000Z
CVE-2023-39114 
ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerability is triggered when running the program SDLaffgif.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-02T00:00:00.000Z
CVE-2023-39115 
install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-16T00:00:00.000Z
CVE-2023-39121 
emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-39122 
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-31T00:00:00.000Z
CVE-2023-39125 
NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c because a file's width, height, and BPP are not validated. NOTE: the vendor's perspective is "this main application was not intended to be a well tested program, it's just something to demonstrate it works and for the user to see how to integrate it into their own programs."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-17T00:00:00.000Z
CVE-2023-39128 
GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-25T00:00:00.000Z
CVE-2023-39129 
GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-25T00:00:00.000Z
CVE-2023-39130 
GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-25T00:00:00.000Z
CVE-2023-39135 
An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-30T00:00:00.000Z
CVE-2023-39136 
An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-30T00:00:00.000Z
CVE-2023-39137 
An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-30T00:00:00.000Z
CVE-2023-39138 
An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-30T00:00:00.000Z
CVE-2023-39139 
An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-30T00:00:00.000Z
CVE-2023-39141 
webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2023-39143 
PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-04T00:00:00.000Z
CVE-2023-39144 
Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-39147 
An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-01T00:00:00.000Z
CVE-2023-39150 
ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-12T00:00:00.000Z
CVE-2023-39151 
Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.
Affected products: vendor: Jenkins Project
product: Jenkins
default_status: affected
Published: 2023-07-26T13:54:52.297Z
CVE-2023-39152 
Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.
Affected products: vendor: Jenkins Project
product: Jenkins Gradle Plugin
default_status: unaffected
Published: 2023-07-26T13:54:52.912Z
CVE-2023-39153 
A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.
Affected products: vendor: Jenkins Project
product: Jenkins GitLab Authentication Plugin
default_status: unaffected
Published: 2023-07-26T13:54:53.558Z
CVE-2023-39154 
Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins Qualys Web App Scanning Connector Plugin
default_status: unaffected
Published: 2023-07-26T13:54:54.206Z
CVE-2023-39155 
Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.
Affected products: vendor: Jenkins Project
product: Jenkins Chef Identity Plugin
default_status: unknown
Published: 2023-07-26T13:54:54.847Z
CVE-2023-39156 
A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.
Affected products: vendor: Jenkins Project
product: Jenkins Bazaar Plugin
default_status: unknown
Published: 2023-07-26T13:54:55.468Z
CVE-2023-39157 WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)
Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Crocoblock
product: JetElements For Elementor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2023-12-31T10:04:01.077Z
CVE-2023-39158 WordPress Woocommerce Category Banner Management Plugin <= 2.4.2 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Banner Management For WooCommerce plugin <= 2.4.2 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: theDotstore
product: Banner Management For WooCommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2023-10-03T13:20:37.333Z
CVE-2023-39159 WordPress Fraud Prevention For Woocommerce Plugin <= 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin <= 2.1.5 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: theDotstore
product: Fraud Prevention For Woocommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2023-10-03T12:39:47.588Z
CVE-2023-39161 WordPress Discussion Board plugin <= 2.4.8 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Discussion Board Discussion Board allows Content Spoofing, Cross-Site Scripting (XSS).This issue affects Discussion Board: from n/a through 2.4.8.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: WP Discussion Board
product: Discussion Board
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Abdi Pranata (Patchstack Alliance)
Published: 2024-06-04T07:14:51.890Z
CVE-2023-39162 WordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in XLPlugins User Email Verification for WooCommerce plugin <= 3.5.0 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: XLPlugins
product: User Email Verification for WooCommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien (Patchstack Alliance)
Published: 2023-09-04T09:46:44.189Z
CVE-2023-39163 WordPress Phlox Shop plugin <= 2.0.0 - Unauthenticated Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Shop allows PHP Local File Inclusion.This issue affects Phlox Shop: from n/a through 2.0.0.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Averta
product: Phlox Shop
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2024-05-17T06:52:32.047Z
CVE-2023-39164 WordPress Molongui Plugin <= 4.6.19 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Molongui Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui plugin <= 4.6.19 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Molongui
product: Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: LEE SE HYOUNG (Patchstack Alliance)
Published: 2023-09-04T09:30:53.026Z
CVE-2023-39165 WordPress Sign-up Sheets Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets plugin <= 2.2.8 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Fetch Designs
product: Sign-up Sheets
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien (Patchstack Alliance)
Published: 2023-10-03T11:09:06.622Z
CVE-2023-39166 WordPress tagDiv Composer Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in tagDiv tagDiv Composer allows Cross-Site Scripting (XSS).This issue affects tagDiv Composer: from n/a before 4.4.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: tagDiv
product: tagDiv Composer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Truoc Phan (Patchstack Alliance)
Published: 2023-11-13T16:58:54.003Z
CVE-2023-39167 SENEC: Storage Box V1,V2 and V3 affected by improper access control vulnerability
In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: SENEC
product: Storage Box V1
default_status: unaffected
vendor: SENEC
product: Storage Box V2
default_status: unaffected
vendor: SENEC
product: Storage Box V3
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Ph0s[4]
lang: en
value: R0ckE7
Published: 2023-12-07T14:05:01.746Z
CVE-2023-39169 SENEC: Storage Box V1,V2 and V3 using default credentials
The affected devices use publicly available default credentials with administrative privileges.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: SENEC
product: Storage Box V1
default_status: unaffected
vendor: SENEC
product: Storage Box V2
default_status: unaffected
vendor: SENEC
product: Storage Box V3
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ph0s[4]
lang: en
value: R0ckE7
Published: 2023-12-07T14:14:43.336Z
CVE-2023-39171 SENEC Storage Box V1,V2 and V3 accidentially expose a management interface
SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.
Problem types: cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
Affected products: vendor: SENEC
product: Storage Box V1
default_status: unaffected
vendor: SENEC
product: Storage Box V2
default_status: unaffected
vendor: SENEC
product: Storage Box V3
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ph0s[4]
lang: en
value: R0ckE7
Published: 2023-12-07T14:23:57.124Z