rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-28902 Denial of Service via integer underflow in picserver
An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the infotainment system.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Problem types: cwe_id: CWE-191
description: CWE-191 Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Artem Ivachev from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:38:23.242Z
CVE-2023-28903 
An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-service of the infotainment system.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Artem Ivachev from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:38:02.954Z
CVE-2023-28904 Bypass of secure boot process
A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU to bypass firmware signature verification and run arbitrary code in the infotainment system at boot process.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
version: 3.1
Credits: lang: en
value: Danila Parnishchev from PCA Cyber Security (PCAutomotive)
lang: en
value: Polina Smirnova from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:37:35.093Z
CVE-2023-28905 Heap buffer overflow in picserver
A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Artem Ivachev from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:37:09.395Z
CVE-2023-28906 Command injection in networking service
A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain administrative access to the system.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Mikhail Evdokimov from PCA Cyber Security (PCAutomotive)
lang: en
value: Artem Ivachev from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:36:47.874Z
CVE-2023-28907 A lack of access restrictions on internal memory regions
There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating system to compromise the CPU core responsible for CAN message processing.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Artem Ivachev from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:36:10.983Z
CVE-2023-28908 Integer Overflow in Non-Fragmented Data Reception
A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving non-fragmented HCI packets on a channel.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Mikhail Evdokimov from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:35:48.124Z
CVE-2023-28909 Integer Overflow Leading to MTU Bypass
A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving fragmented HCI packets on a channel. An attacker can leverage this vulnerability to bypass the MTU check on a channel with enabled fragmentation. Consequently, this can lead to a buffer overflow in upper layer profiles, which can be used to obtain remote code execution.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Mikhail Evdokimov from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:35:21.590Z
CVE-2023-28910 Disabled Abortion Flag
A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventually leading to bypassing assertion functions.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Mikhail Evdokimov from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:34:50.755Z
CVE-2023-28911 Arbitrary Channel Disconnection Resulting in Denial of Service
A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which can result in an arbitrary channel disconnection. An attacker can leverage this vulnerability to cause a denial-of-service attack for every connected client of the infotainment device.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Mikhail Evdokimov from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:34:25.867Z
CVE-2023-28912 Cleartext Phonebook Information
The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical access to the system to obtain vehicle owner's contact data.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Artem Ivachev from PCA Cyber Security (PCAutomotive)
lang: en
value: Mikhail Evdokimov from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:33:58.714Z
CVE-2023-28929 
Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable file as an execution and/or persistence mechanism which could execute a malicious program each time the executable file is started.
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Security (Consumer)
Published: 2023-06-26T21:52:22.423Z
CVE-2023-28930 WordPress Mobile Banner Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Robin Phillips Mobile Banner plugin <= 1.5 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Robin Phillips
product: Mobile Banner
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Yuki Haruma (Patchstack Alliance)
Published: 2023-11-12T21:32:59.127Z
CVE-2023-28931 WordPress Post Connector Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Never5 Post Connector plugin <= 1.0.9 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Never5
product: Post Connector
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Juampa Rodríguez (Patchstack Alliance)
Published: 2023-08-08T12:35:44.360Z
CVE-2023-28932 WordPress WPMobile.App Plugin <= 11.20 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.20 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: WPMobile.App
product: WPMobile.App — Android and iOS Mobile Application
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Juampa Rodríguez (Patchstack Alliance)
Published: 2023-05-10T07:07:24.036Z
CVE-2023-28933 WordPress Call Now Accessibility Button Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in StPeteDesign Call Now Accessibility Button plugin <= 1.1 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: StPeteDesign
product: Call Now Accessibility Button
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Juampa Rodríguez (Patchstack Alliance)
Published: 2023-06-12T15:10:01.709Z
CVE-2023-28934 WordPress WP Full Stripe Free Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Mammothology
product: WP Full Stripe Free
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: easyBug (Patchstack Alliance)
Published: 2023-08-08T12:25:44.931Z
CVE-2023-28935 Apache UIMA DUCC: DUCC (EOL) allows RCE
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC.


When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA, an authenticated user that has the permissions to modify core entities can cause command execution as the system user that runs the web process.


As the "Distributed UIMA Cluster Computing" module for UIMA is retired, we do not plan to release a fix for this issue.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Apache Software Foundation
product: Apache UIMA DUCC
default_status: affected
Credits: lang: en
value: Crilwa
Published: 2023-03-30T09:10:11.178Z
CVE-2023-28936 Apache OpenMeetings: insufficient check of invitation hash
Attacker can access arbitrary recording/room

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

Problem types: cwe_id: CWE-697
description: CWE-697 Incorrect Comparison
Affected products: vendor: Apache Software Foundation
product: Apache OpenMeetings
default_status: affected
Credits: lang: en
value: Stefan Schiller
Published: 2023-05-12T07:45:04.835Z
CVE-2023-28937 
DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunner and ScriptRunner for Amazon SQS are used to start the configured processes on DataSpider Servista. The cryptographic key is embedded in ScriptRunner and ScriptRunner for Amazon SQS, which is common to all users. If an attacker who can gain access to a target DataSpider Servista instance and obtain a Launch Settings file of ScriptRunner and/or ScriptRunner for Amazon SQS, the attacker may perform operations with the user privilege encrypted in the file. Note that DataSpider Servista and some of the OEM products are affected by this vulnerability. For the details of affected products and versions, refer to the information listed in [References].
Problem types: description: Use of hard-coded cryptographic key
Affected products: vendor: SAISON INFORMATION SYSTEMS CO.,LTD.
product: DataSpider Servista
Published: 2023-06-01T00:00:00.000Z
CVE-2023-28938 
Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-400
description: Uncontrolled resource consumption
Affected products: vendor: n/a
product: Intel(R) SSD Tools software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.4
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
Published: 2023-08-11T02:36:51.770Z
CVE-2023-28949 IBM Engineering Requirements Management cross-site request forgery
IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  251216.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: IBM
product: Engineering Requirements Management
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Published: 2024-03-01T01:47:15.207Z
CVE-2023-28950 IBM MQ information disclosure
IBM MQ 8.0, 9.0, 9.1, 9.2, and 9.3 could disclose sensitive user information from a trace file if that functionality has been enabled.  IBM X-Force ID:  251358.
Problem types: description: 497 Exposure of System Data to an Unauthorized Control Sphere
Affected products: vendor: IBM
product: MQ
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-05-19T15:20:50.476Z
CVE-2023-28952 IBM Cognos Controller log injection
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to injection attacks in application logging by not sanitizing user provided data.  IBM X-Force ID:  251463.
Problem types: cwe_id: CWE-117
description: CWE-117 Improper Output Neutralization for Logs
Affected products: vendor: IBM
product: Cognos Controller
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2024-05-03T17:39:23.634Z
CVE-2023-28953 IBM Cognos Analytics on Cloud Pak for Data improper access control
IBM Cognos Analytics on Cloud Pak for Data 4.0 could allow an attacker to make system calls that might compromise the security of the containers due to misconfigured security context.  IBM X-Force ID:  251465.
Problem types: description: 284 Improper Access Control
Affected products: vendor: IBM
product: Cognos Analytics Cartridge for Cloud Pak for Data
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-07-10T00:17:30.448Z
CVE-2023-28955 IBM Watson Knowledge Catalog denial of service
IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service.  IBM X-Force ID:  251704.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: IBM
product: Watson Knowledge Catalog on Cloud Pak for Data
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-07-10T01:09:59.829Z