rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-34409 
In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticated API routes, to access otherwise protected API routes leading to escalation of privileges and information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-06T00:00:00.000Z
CVE-2023-34410 
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-05T00:00:00.000Z
CVE-2023-34411 
The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-05T00:00:00.000Z
CVE-2023-34412 Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250
A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an
authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Red Lion Europe
product: mbNET
default_status: unaffected
vendor: Red Lion Europe
product: mbNET.rokey
default_status: unaffected
vendor: Helmholz
product: REX 200
default_status: unaffected
vendor: Helmholz
product: REX 250
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-08-17T13:07:01.697Z
CVE-2023-34414 
The error page for sites with invalid TLS certificates was missing the
activation-delay Firefox uses to protect prompts and permission dialogs
from attacks that exploit human response time delays. If a malicious
page elicited user clicks in precise locations immediately before
navigating to a site with a certificate error and made the renderer
extremely busy at the same time, it could create a gap between when
the error page was loaded and when the display actually refreshed.
With the right timing the elicited clicks could land in that gap and 
activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.
Problem types: description: Click-jacking certificate exceptions through rendering lag
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Irvan Kurniawan
Published: 2023-06-19T10:14:49.519Z
CVE-2023-34415 
When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same process as the site that issued the redirect. This bypassed the site-isolation protections against Spectre-like attacks on sites that host an "open redirect". Firefox no longer follows HTTP redirects to data: URLs. This vulnerability affects Firefox < 114.
Problem types: description: Site-isolation bypass on sites that allow open redirects to data: urls
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Jun Kokatsu
Published: 2023-06-19T10:40:49.021Z
CVE-2023-34416 
Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.
Problem types: description: Memory safety bugs fixed in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12
Affected products: vendor: Mozilla
product: Firefox ESR
default_status: unaffected
vendor: Mozilla
product: Firefox
default_status: unaffected
vendor: Mozilla
product: Thunderbird
default_status: unaffected
Credits: lang: en
value: Mozilla developers and community members Gabriele Svelto, Andrew McCreight, the Mozilla Fuzzing Team, Sean Feng, and Sebastian Hengst
Published: 2023-06-19T10:17:18.830Z
CVE-2023-34417 
Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 114.
Problem types: description: Memory safety bugs fixed in Firefox 114
Affected products: vendor: Mozilla
product: Firefox
default_status: unaffected
Credits: lang: en
value: Mozilla developers and community members Andrew McCreight, Randell Jesup, and the Mozilla Fuzzing Team
Published: 2023-06-19T10:42:55.747Z
CVE-2023-34418 
A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Lenovo
product: Lenovo XClarity Administrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2023-06-26T19:45:05.363Z
CVE-2023-34419 
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Lenovo
product: Lenovo Notebook
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Zichuan Li (@Ri7erLi) from Indiana University Bloomington for reporting this vulnerability.
Published: 2023-08-17T16:49:12.282Z
CVE-2023-34420 
A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Lenovo
product: Lenovo XClarity Administrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-06-26T19:45:12.130Z
CVE-2023-34421 
A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lenovo
product: Lenovo XClarity Administrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2023-06-26T19:45:26.406Z
CVE-2023-34422 
A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lenovo
product: Lenovo XClarity Administrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2023-06-26T19:45:31.576Z
CVE-2023-34423 
Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product with the administrative privilege.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: AYS Pro Plugins
product: Survey Maker
Published: 2024-04-03T07:09:42.923Z
CVE-2023-34424 
Improper input validation in firmware for some Intel(R) CSME may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) CSME
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2024-08-14T13:45:42.453Z
CVE-2023-34425 
The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
Problem types: description: An app may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
Published: 2023-07-28T04:30:39.127Z
CVE-2023-34426 
A stack-based buffer overflow vulnerability exists in the httpd manage_request functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to stack-based buffer overflow. An attacker can send a network request to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Yifan
product: YF325
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Discovered by Francesco Benvenuto of Cisco Talos.
Published: 2023-10-11T15:14:29.500Z
CVE-2023-34427 
Protection mechanism failure in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-693
description: Protection mechanism failure
Affected products: vendor: n/a
product: Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
Published: 2023-08-11T02:37:24.682Z
CVE-2023-34429 Weintek Weincloud Improper Handling of Structural Elements



Weintek Weincloud v0.13.6

 

could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.










Problem types: cwe_id: CWE-237
description: CWE-237 Improper Handling of Structural Elements
Affected products: vendor: Weintek
product: Weincloud
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: ​Hank Chen (PSIRT and Threat Research of TXOne Networks) reported these vulnerabilities to CISA.
Published: 2023-07-19T21:45:39.544Z
CVE-2023-34430 
Uncontrolled search path in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path
Affected products: vendor: n/a
product: Intel Battery Life Diagnostic Tool software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-11-14T19:05:02.864Z
CVE-2023-34431 
Improper input validation in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access
Problem types: description: escalation of privilege
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) Server Board BIOS firmware
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-11-14T19:05:08.245Z
CVE-2023-34432 Heap-buffer-overflow in src/formats_i.c
A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure.
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: sox
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
vendor: Fedora
product: Fedora
default_status: affected
vendor: Fedora
product: Extra Packages for Enterprise Linux
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-07-10T20:05:39.681Z
CVE-2023-34433 PiiGAB M-Bus Use of Password Hash With Insufficient Computational Effort













PiiGAB M-Bus stores passwords using a weak hash algorithm.


Problem types: cwe_id: CWE-916
description: CWE-916 Use of Password Hash With Insufficient Computational Effort
Affected products: vendor: PiiGAB 
product: M-Bus SoftwarePack
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Floris Hendriks and Jeroen Wijenbergh of Radboud University reported these vulnerabilities to CISA.
Published: 2023-07-06T23:06:34.227Z
CVE-2023-34434 Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. 

The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick  https://github.com/apache/inlong/pull/8130 .
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache InLong
default_status: unaffected
Credits: lang: en
value: sw0rd1ight and 4ra1n of Chaitin Tech
Published: 2023-07-25T07:09:58.676Z
CVE-2023-34435 
A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network packets can lead to arbitrary firmware update. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-347
description: CWE-347: Improper Verification of Cryptographic Signature
Affected products: vendor: LevelOne
product: WBR-6013
vendor: Realtek
product: rtl819x Jungle SDK
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Francesco Benvenuto of Cisco Talos.
Published: 2024-07-08T15:25:39.165Z
CVE-2023-34436 
An out-of-bounds write vulnerability exists in the LXT2 num_time_table_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: GTKWave
product: GTKWave
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2024-01-08T14:47:43.652Z
CVE-2023-34437 Baker Hughes Bently Nevada 3500 System  Incorrect Permission Assignment for Critical Resource
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05

 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Baker Hughes - Bently Nevada
product: Bently Nevada 3500 System
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Diego Zaffaroni of Nozomi Networks
Published: 2023-10-18T23:25:25.969Z
CVE-2023-34438 
Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-421
description: Race condition
Affected products: vendor: n/a
product: Intel(R) NUC BIOS firmware
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-08-11T02:37:29.580Z
CVE-2023-34439 
Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: Implem Inc.
product: Pleasanter
Published: 2023-12-06T08:40:53.373Z
CVE-2023-34440 
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: n/a
product: Intel(R) Processors
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-02-12T21:19:25.772Z
CVE-2023-34441 Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information



Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05

 contains a cleartext transmission vulnerability which could allow an attacker to 

steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.


Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Baker Hughes - Bently Nevada
product: Bently Nevada 3500 System
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Diego Zaffaroni of Nozomi Networks
Published: 2023-10-18T23:22:29.808Z
CVE-2023-34442 Apache Camel JIRA: Temporary file information disclosure in Camel-Jira
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3.

Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x update to 4.0.0-M1

Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Apache Software Foundation
product: Apache Camel JIRA
default_status: unaffected
Credits: lang: en
value: Jonathan Leitschuh of the Open Source Security Foundation: Project Alpha-Omega
Published: 2023-07-10T09:31:05.286Z