rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-43730 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "countries_name[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Os Commerce
product: Os Commerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-09-30T21:54:56.293Z
CVE-2023-43731 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "zone_name" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Os Commerce
product: Os Commerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-09-30T21:55:02.197Z
CVE-2023-43732 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "tax_class_title" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Os Commerce
product: Os Commerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-09-30T22:08:42.715Z
CVE-2023-43733 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "company_address" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Os Commerce
product: Os Commerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-09-30T22:08:44.735Z
CVE-2023-43734 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "name" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Os Commerce
product: Os Commerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-09-30T22:08:47.176Z
CVE-2023-43735 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "formats_titles[7]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Os Commerce
product: Os Commerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-09-30T22:08:49.377Z
CVE-2023-43739 Online Book Store Project v1.0 - Unauthenticated SQL Injection (SQLi)
The 'bookisbn' parameter of the cart.php resource

does not validate the characters received and they

are sent unfiltered to the database.




Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Online Book Store Project
product: Online Book Store Project
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-09-28T21:32:55.726Z
CVE-2023-43740 Online Book Store Project v1.0 - Insecure File Upload
Online Book Store Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'image' parameter of
admin_edit.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting
the application.

Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Online Book Store Project
product: Online Book Store Project
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-09-28T20:48:22.121Z
CVE-2023-43741 
A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-43742 
An authentication bypass in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an unauthenticated attacker to obtain an administrative session via a protection mechanism failure in the authentication function. In normal operation, the Zultys MX Administrator Windows client connects to port 7505 and attempts authentication, submitting the administrator username and password to the server. Upon authentication failure, the server sends a login failure message prompting the client to disconnect. However, if the client ignores the failure message instead and attempts to continue, the server does not forcibly close the connection and processes all subsequent requests from the client as if authentication had been successful.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-08T00:00:00.000Z
CVE-2023-43743 
A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an authenticated attacker to execute arbitrary SQL queries on the backend database via the filter parameter in requests to the /newapi/ endpoint in the Zultys MX web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-08T00:00:00.000Z
CVE-2023-43744 
An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an administrator to execute arbitrary OS commands via a file name parameter in a patch application function. The Zultys MX Administrator client has a "Patch Manager" section that allows administrators to apply patches to the device. The user supplied filename for the patch file is passed to a shell script without validation. Including bash command substitution characters in a patch file name results in execution of the provided command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-08T00:00:00.000Z
CVE-2023-43745 
Improper input validation in some Intel(R) CBI software before version 1.1.0 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) CBI software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.8
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
Published: 2024-05-16T20:47:34.772Z
CVE-2023-43746 BIG-IP Appliance mode external monitor vulnerability

When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system.  A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-267
description: CWE-267 Privilege Defined With Unsafe Action
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: F5
Published: 2023-10-10T12:36:52.839Z
CVE-2023-43747 
Incorrect default permissions for some Intel(R) Connectivity Performance Suite software installers before version 2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-276
description: Incorrect default permissions
Affected products: vendor: n/a
product: Intel(R) Connectivity Performance Suite software installers
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-08-14T13:45:27.586Z
CVE-2023-43748 
Improper access control in some Intel(R) GPA Framework software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-284
description: Improper access control
Affected products: vendor: n/a
product: Intel(R) GPA Framework software installers
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-05-16T20:47:44.843Z
CVE-2023-43751 
Uncontrolled search path in Intel(R) Graphics Command Center Service bundled in some Intel(R) Graphics Windows DCH driver software before versions 31.0.101.3790/31.0.101.2114 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path element
Affected products: vendor: n/a
product: Intel(R) Graphics Windows DCH driver software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-05-16T20:47:39.645Z
CVE-2023-43752 
OS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and earlier, and WRC-X3000GS2A-B v1.05 and earlier allows a network-adjacent authenticated user to execute an arbitrary OS command by sending a specially crafted request.
Problem types: description: OS command injection
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-X3000GS2-W
vendor: ELECOM CO.,LTD.
product: WRC-X3000GS2-B
vendor: ELECOM CO.,LTD.
product: WRC-X3000GS2A-B
Published: 2023-11-16T06:46:38.102Z
CVE-2023-43753 
Improper conditions check in some Intel(R) Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
cwe_id: CWE-92
description: Improper conditions check
Affected products: vendor: n/a
product: Intel(R) Processors with Intel(R) SGX
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
Published: 2024-09-16T16:38:46.373Z
CVE-2023-43754 Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels
Mattermost fails to check whether the  “Allow users to view archived channels”  setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled. 


Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Harrison Healey
Published: 2023-11-27T09:11:13.283Z
CVE-2023-43755 Zavio IP Camera Stack-Based Buffer Overflow
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
 CB6231, B8520, B8220, and CD321 

IP Cameras 

with firmware version M2.1.6.05 are 
vulnerable to multiple instances of stack-based overflows. During the 
processing and parsing of certain fields in XML elements from incoming 
network requests, the product does not sufficiently check or validate 
allocated buffer size. This may lead to remote code execution.


Problem types: cwe_id: CWE-121
description: CWE-121 Stack-Based Buffer Overflow
Affected products: vendor: Zavio
product: IP Camera CF7500
default_status: unaffected
vendor: Zavio
product: IP Camera CF7300
default_status: unaffected
vendor: Zavio
product: IP Camera CF7201
default_status: unaffected
vendor: Zavio
product: IP Camera CF7501
default_status: unaffected
vendor: Zavio
product: IP Camera CB3211
default_status: unaffected
vendor: Zavio
product: IP Camera CB3212
default_status: unaffected
vendor: Zavio
product: IP Camera CB5220
default_status: unaffected
vendor: Zavio
product: IP Camera CB6231
default_status: unaffected
vendor: Zavio
product: IP Camera B8520
default_status: unaffected
vendor: Zavio
product: IP Camera B8220
default_status: unaffected
vendor: Zavio
product: IP Camera CD321
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Attila Szasz 
Published: 2023-11-08T22:57:59.332Z
CVE-2023-43756 Dsoftbus has an out-of-bounds read vulnerability

in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read.


Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-02-02T06:18:38.658Z
CVE-2023-43757 
Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated attacker to guess the encryption key used for wireless LAN communication and intercept the communication. As for the affected products/versions, see the information provided by the vendor under [References] section.
Problem types: description: Inadequate Encryption Strength
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-2533GHBK2-T
vendor: ELECOM CO.,LTD.
product: WRC-2533GHBK-I
vendor: ELECOM CO.,LTD.
product: WRC-1750GHBK2-I
vendor: ELECOM CO.,LTD.
product: WRC-1750GHBK-E
vendor: ELECOM CO.,LTD.
product: WRC-1750GHBK
vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK2
vendor: ELECOM CO.,LTD.
product: WRC-1167GHBK
vendor: ELECOM CO.,LTD.
product: WRC-F1167ACF
vendor: ELECOM CO.,LTD.
product: WRC-733GHBK
vendor: ELECOM CO.,LTD.
product: WRC-733GHBK-I
vendor: ELECOM CO.,LTD.
product: WRC-733GHBK-C
vendor: ELECOM CO.,LTD.
product: WRC-300GHBK2-I
vendor: ELECOM CO.,LTD.
product: WRC-300GHBK
vendor: ELECOM CO.,LTD.
product: WRC-733FEBK
vendor: ELECOM CO.,LTD.
product: WRC-300FEBK
vendor: ELECOM CO.,LTD.
product: WRC-F300NF
vendor: ELECOM CO.,LTD.
product: WRH-300WH-H
vendor: ELECOM CO.,LTD.
product: WRH-300BK
vendor: ELECOM CO.,LTD.
product: WRH-300WH
vendor: ELECOM CO.,LTD.
product: WRH-300RD
vendor: ELECOM CO.,LTD.
product: WRH-300SV
vendor: ELECOM CO.,LTD.
product: WRH-300BK-S
vendor: ELECOM CO.,LTD.
product: WRH-300WH-S
vendor: ELECOM CO.,LTD.
product: WRH-300BK2-S
vendor: ELECOM CO.,LTD.
product: WRH-300WH2-S
vendor: ELECOM CO.,LTD.
product: WRH-H300BK
vendor: ELECOM CO.,LTD.
product: WRH-H300WH
vendor: ELECOM CO.,LTD.
product: WRH-150BK
vendor: ELECOM CO.,LTD.
product: WRH-150WH
vendor: ELECOM CO.,LTD.
product: LAN-W300N/RS
vendor: ELECOM CO.,LTD.
product: LAN-W301NR
vendor: ELECOM CO.,LTD.
product: LAN-W300N/P
vendor: ELECOM CO.,LTD.
product: LAN-WH300N/DGP
vendor: ELECOM CO.,LTD.
product: LAN-WH300NDGPE
Published: 2023-11-16T06:21:13.445Z
CVE-2023-43758 
Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: n/a
product: Intel(R) processors
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-02-12T21:19:24.119Z
CVE-2023-43760 
Certain WithSecure products allow Denial of Service via a fuzzed PE32 file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-22T00:00:00.000Z
CVE-2023-43761 
Certain WithSecure products allow Denial of Service (infinite loop). This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-22T00:00:00.000Z
CVE-2023-43762 
Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend). This affects WithSecure Policy Manager 15 and Policy Manager Proxy 15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-22T00:00:00.000Z
CVE-2023-43763 
Certain WithSecure products allow XSS via an unvalidated parameter in the endpoint. This affects WithSecure Policy Manager 15 on Windows and Linux.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-22T00:00:00.000Z
CVE-2023-43765 
Certain WithSecure products allow Denial of Service in the aeelf component. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-22T00:00:00.000Z
CVE-2023-43766 
Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-22T00:00:00.000Z