rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-31162 Improper Input Validation in Web Interface
An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to arbitrarily alter the content of a configuration file.

See SEL Service Bulletin dated 2022-11-15 for more details.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-3505
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3505-3
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3530
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3530-4
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3532
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3555
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3560S
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3560E
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-2241 RTAC module
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3350
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Andrea Palanca, Nozomi Networks
Published: 2023-05-10T19:24:20.480Z
CVE-2023-31163 Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.


See SEL Service Bulletin dated 2022-11-15 for more details.






Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-3505
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3505-3
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3530
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3530-4
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3532
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3555
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3560S
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3560E
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-2241 RTAC module
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3350
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Andrea Palanca, Nozomi Networks
Published: 2023-05-10T19:24:45.965Z
CVE-2023-31164 Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.


See SEL Service Bulletin dated 2022-11-15 for more details.






Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-3505
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3505-3
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3530
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3530-4
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3532
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3555
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3560S
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3560E
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-2241 RTAC module
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3350
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Andrea Palanca, Nozomi Networks
Published: 2023-05-10T19:25:16.534Z
CVE-2023-31165 Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.


See SEL Service Bulletin dated 2022-11-15 for more details.






Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-3505
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3505-3
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3530
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3530-4
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3532
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3555
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3560S
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3560E
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-2241 RTAC module
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3350
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Andrea Palanca, Nozomi Networks
Published: 2023-05-10T19:25:34.186Z
CVE-2023-31166 Improper Limitation of a Pathname to a Restricted Directory
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to create folders in arbitrary paths of the file system.

See SEL Service Bulletin dated 2022-11-15 for more details.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-3505
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3505-3
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3530
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3530-4
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3532
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3555
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3560S
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3560E
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-2241 RTAC module
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3350
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Andrea Palanca, Nozomi Networks
Published: 2023-05-10T19:25:59.606Z
CVE-2023-31167 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Screen Builder Software on Windows allows Relative Path Traversal.



SEL acSELerator Bay Screen Builder software is distributed by SEL-5033 SEL acSELerator RTAC, SEL-5030 Quickset, and SEL Compass. CVE-2023-31167 and was patched in the acSELerator Bay Screen Builder release available on 20230602. Please contact SEL for additional details.


This issue affects SEL-5036 acSELerator Bay Screen Builder Software: before 1.0.49152.778.


Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5036 acSELerator Bay Screen Builder Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Reid Wightman of Dragos
Published: 2023-08-31T15:29:11.745Z
CVE-2023-31168  Inclusion of Functionality from Untrusted Control Sphere

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.



See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.






This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


Problem types: cwe_id: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5030 acSELerator QuickSet Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Gabriele Quagliarella of Nozomi Networks
Published: 2023-08-31T15:30:14.809Z
CVE-2023-31169 Improper Handling of Unicode Encoding

An Improper Handling of Unicode Encoding vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.
This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


Problem types: cwe_id: CWE-176
description: CWE-176 Improper Handling of Unicode Encoding
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5030 acSELerator QuickSet Software
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Gabriele Quagliarella of Nozomi Networks
Published: 2023-08-31T15:30:23.541Z
CVE-2023-31170  Inclusion of Functionality from Untrusted Control Sphere

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.



See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.




This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


Problem types: cwe_id: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5030 acSELerator QuickSet Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Gabriele Quagliarella of Nozomi Networks
Published: 2023-08-31T15:30:32.665Z
CVE-2023-31171 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5030 acSELerator QuickSet Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Gabriele Quagliarella of Nozomi Networks
Published: 2023-08-31T15:30:41.030Z
CVE-2023-31172 Incomplete Filtering of Special Elements

An Incomplete Filtering of Special Elements vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.


Problem types: cwe_id: CWE-791
description: CWE-791: Incomplete Filtering of Special Elements
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5030 acSELerator QuickSet Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Gabriele Quagliarella of Nozomi Networks
Published: 2023-08-31T15:30:49.213Z
CVE-2023-31173 Use of Hard-coded Credentials
Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass.



See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.


Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5037 SEL Grid Configurator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Gabriele Quagliarella of Nozomi Networks
Published: 2023-08-31T15:30:58.262Z
CVE-2023-31174 Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed instructions that could be executed by an authorized device operator.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.


Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5037 SEL Grid Configurator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Andrea Palanca of Nozomi Networks
Published: 2023-08-31T15:31:26.657Z
CVE-2023-31175 Execution with Unnecessary Privileges

An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system.





See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.


This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.


Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecesary Privileges
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5037 SEL Grid Configurator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Andrea Palanca of Nozomi Networks
Published: 2023-08-31T15:31:33.536Z
CVE-2023-31176 Insufficient entropy vulnerability could lead to authentication bypass
An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication. 


See product Instruction Manual Appendix A dated 20230830 for more details.




Problem types: cwe_id: CWE-331
description: CWE-331 Insufficient Entropy
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-451
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Andrea Palanca and Gabriele Quagliarella of Nozomi Networks
Published: 2023-11-30T16:53:11.383Z
CVE-2023-31177 Improper neutralizataion of input could lead to execution of arbitrary code
An Improper Neutralization of Input During Web Page Generation  ('Cross-site Scripting') in the Schweitzer Engineering Laboratories SEL-451 could allow an attacker to craft a link that could execute arbitrary code on a victim's system.



See product Instruction Manual Appendix A dated 20230830 for more details.



Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-451
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Andrea Palanca and Gabriele Quagliarella of Nozomi Networks
Published: 2023-11-30T16:53:34.046Z
CVE-2023-31178 AgilePoint NX v8.0 SU2.2 & SU2.3 – Arbitrary File Delete
AgilePoint NX v8.0 SU2.2 & SU2.3 – Arbitrary File Delete Vulnerability allows arbitrary file deletion, by an unspecified request.


Problem types: description: Arbitrary File Delete
Affected products: vendor: AgilePoint
product: NX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Aleksandar Marčeta-Pavlović, Ingo Izumi Schittra
Published: 2023-05-08T00:00:00.000Z
CVE-2023-31179 AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversal
AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversal - Vulnerability allows path traversal and downloading files from the server, by an unspecified request.


Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: AgilePoint
product: NX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Aleksandar Marčeta-Pavlović
Published: 2023-05-08T00:00:00.000Z
CVE-2023-31180  WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS)

WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS) through an unspecified request.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor:  WJJ Software
product:  InnoKB Server, InnoKB/Console
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Moshe Mizrahi
Published: 2023-05-08T00:00:00.000Z