rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-31345 
Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.
Problem types: cwe_id: CWE-1274
description: CWE-1274 Improper Access Control for Volatile Memory Containing Boot Code
Affected products: vendor: AMD
product: AMD EPYC™ 7003 Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9004 Processors
default_status: affected
vendor: AMD
product: AMD Instinct™ MI300A
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 5000WX- Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7000 Series Mobile Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 5000
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 7000
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V2000
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V3000
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-02-11T23:49:05.388Z
CVE-2023-31346 
Failure to initialize
memory in SEV Firmware may allow a privileged attacker to access stale data
from other guests.

















Affected products: vendor: AMD
product: 3rd Gen AMD EPYC™ Processors
default_status: affected
vendor:  AMD
product: 4th Gen AMD EPYC™ Processors 
default_status: affected
Published: 2024-02-13T19:18:19.089Z
CVE-2023-31347 
Due to a code bug in
Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a
guest to observe an incorrect TSC when Secure TSC is enabled potentially
resulting in a loss of guest integrity.  





Affected products: vendor: AMD
product: 3rd Gen AMD EPYC™ Processors
default_status: affected
vendor:  AMD
product: 4th Gen AMD EPYC™ Processors 
default_status: affected
Published: 2024-02-13T19:18:51.045Z
CVE-2023-31348 
A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
Affected products: vendor: AMD
product: μProf Tool
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-13T16:57:16.834Z
CVE-2023-31349 
Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: AMD
product: μProf Tool
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-13T16:57:28.998Z
CVE-2023-31351 
Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integrity.
Problem types: cwe_id: CWE-119
description: CWE-119  Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: AMD
product: AMD EPYC™ 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 8004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2025-09-06T16:59:26.905Z
CVE-2023-31352 
A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private data.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: AMD
product: AMD EPYC™ 9004 Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-02-11T22:44:28.001Z
CVE-2023-31355 
Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allowing reading of memory from a decommissioned guest.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: AMD
product: 3rd Gen AMD EPYC™ Processors
default_status: affected
vendor: AMD
product: 4th Gen AMD EPYC™ Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9003
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2024-08-05T16:04:24.813Z
CVE-2023-31356 
Incomplete system memory cleanup in SEV firmware could
allow a privileged attacker to corrupt guest private memory, potentially
resulting in a loss of data integrity.
Problem types: cwe_id: CWE-459
description: CWE-459 Incomplete Cleanup
Affected products: vendor: AMD
product: AMD EPYC™ 7003 Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9004 Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2024-08-13T16:54:23.979Z
CVE-2023-31358 
A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: AMD
product: AIM-T Manageability API
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-05-13T17:14:16.675Z
CVE-2023-31359 
Incorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: AMD
product: AIM-T Manageability API
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-05-13T17:15:44.658Z
CVE-2023-31360 
Incorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability Service installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: AMD
product: AIM-T(AMD Integrated Management Technology) software
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-02-11T20:01:48.822Z
CVE-2023-31361 
A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: AMD
product: AIM-T (AMD Integrated Management Technology) software
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-02-11T20:07:05.296Z
CVE-2023-31365 
An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area resulting in loss of integrity or availability.
Problem types: cwe_id: CWE-190
description: CWE-190  Integer Overflow or Wraparound
Affected products: vendor: AMD
product: AMD Radeon™ RX 7000 Series Graphics Products
default_status: affected
vendor: AMD
product: AMD Radeon™ PRO W7000 Series Graphics Products
default_status: affected
vendor: AMD
product: AMD Radeon™ PRO V710 Graphics Products
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
Published: 2025-09-06T17:04:01.002Z
CVE-2023-31366 
Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of service.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: AMD
product: μProf Tool
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-08-13T16:57:40.561Z
CVE-2023-31403 Improper Access Control vulnerability in SAP Business One product installation
SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be executed or be used by the installation process leading to considerable impact on confidentiality, integrity and availability.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: SAP_SE
product: SAP Business One
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-11-14T00:59:07.320Z
CVE-2023-31404 Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Service)
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could let them access data sources which would otherwise be restricted.


Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: SAP_SE
product: SAP BusinessObjects Business Intelligence Platform (Central Management Service)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Published: 2023-05-09T01:37:04.867Z
CVE-2023-31405 Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)
SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.


Problem types: cwe_id: CWE-117
description: CWE-117: Improper Output Neutralization for Logs
Affected products: vendor: SAP_SE
product: SAP NetWeaver AS for Java (Log Viewer)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-07-11T02:23:26.873Z
CVE-2023-31406 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform
Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.


Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: SAP_SE
product: SAP BusinessObjects Business Intelligence Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-05-09T01:37:32.237Z
CVE-2023-31407 Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation
SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.


Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: SAP_SE
product: SAP Business Planning and Consolidation
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-05-09T01:37:53.404Z
CVE-2023-31408 
Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with
Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote
attacker to potentially steal user credentials that are stored in the user’s browsers local storage via
cross-site-scripting attacks.
Problem types: cwe_id: CWE-312
description: CWE-312 (Cleartext Storage of Sensitive Information)
Affected products: vendor: SICK AG
product: SICK FTMG-ESD15AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD20AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD25AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN50SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR50SXX AIR FLOW SENSOR
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: 2023-05-15T10:55:39.301Z
CVE-2023-31409 
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability of the webserver by invocing a Slowloris style attack via HTTP requests.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: SICK AG
product: SICK FTMG-ESD15AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD20AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESD25AXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESN50SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR40SXX AIR FLOW SENSOR
default_status: affected
vendor: SICK AG
product: SICK FTMG-ESR50SXX AIR FLOW SENSOR
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: 2023-05-15T10:55:57.836Z
CVE-2023-31410 
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK EventCam App. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on the communication between the EventCam App and the Client, and potentially manipulate the data being transmitted.
Problem types: description: Cleartext Transmission of Sensitive Information
description: Improper Authorization
Affected products: vendor: SICK AG
product: EventCam App
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2023-06-19T14:57:52.413Z
CVE-2023-31411 
A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App.
Problem types: description: Improper Authorization
Affected products: vendor: SICK AG
product: EventCam App
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2023-06-19T14:59:30.206Z
CVE-2023-31412 
The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. If an attacker manages to retrieve the hash, it could lead to collision attacks and the potential retrieval of the password.
Problem types: description: Use of Weak Hash
Affected products: vendor: SICK AG
product: LMS5xx
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2023-08-24T18:15:53.835Z
CVE-2023-31413 
Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logging is enabled.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Elastic
product: Filebeat
Published: 2023-05-04T00:00:00.000Z
CVE-2023-31414 
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code
Affected products: vendor: Elastic
product: Kibana
Published: 2023-05-04T00:00:00.000Z