rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-48229 Out-of-bounds write in the radio driver for Contiki-NG nRF platforms
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds write exists in the driver for IEEE 802.15.4 radios on nRF platforms in the Contiki-NG operating system. The problem is triggered when parsing radio frames in the `read_frame` function in the `arch/cpu/nrf/net/nrf-ieee-driver-arch.c` module. More specifically, the `read_frame` function performs an incomplete validation of the payload length of the packet, which is a value that can be set by an external party that sends radio packets to a Contiki-NG system. Although the value is validated to be in the range of the MTU length, it is not validated to fit into the given buffer into which the packet will be copied. The problem has been patched in the "develop" branch of Contiki-NG and is expected to be included in subsequent releases. Users are advised to update their develop branch or to update to a subsequent release when available. Users unable to upgrade should consider manually applying the changes in PR #2741.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: contiki-ng
product: contiki-ng
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2024-02-14T18:30:31.708Z
CVE-2023-48230 Cap'n Proto WebSocket message can cause crash
Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ HTTP library with WebSocket compression enabled, a buffer underrun can be caused by a remote peer. The underrun always writes a constant value that is not attacker-controlled, likely resulting in a crash, enabling a remote denial-of-service attack. Most Cap'n Proto and KJ users are unlikely to have this functionality enabled and so unlikely to be affected. Maintainers suspect only the Cloudflare Workers Runtime is affected.

If KJ HTTP is used with WebSocket compression enabled, a malicious peer may be able to cause a buffer underrun on a heap-allocated buffer. KJ HTTP is an optional library bundled with Cap'n Proto, but is not directly used by Cap'n Proto. WebSocket compression is disabled by default. It must be enabled via a setting passed to the KJ HTTP library via `HttpClientSettings` or `HttpServerSettings`. The bytes written out-of-bounds are always a specific constant 4-byte string `{ 0x00, 0x00, 0xFF, 0xFF }`. Because this string is not controlled by the attacker, maintainers believe it is unlikely that remote code execution is possible. However, it cannot be ruled out. This functionality first appeared in Cap'n Proto 1.0. Previous versions are not affected.

This issue is fixed in Cap'n Proto 1.0.1.1.
Problem types: cwe_id: CWE-124
description: CWE-124: Buffer Underwrite ('Buffer Underflow')
Affected products: vendor: capnproto
product: capnproto
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-11-21T20:53:34.151Z
CVE-2023-48231 Use-After-Free in win_close() in vim
Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: vim
product: vim
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Published: 2023-11-16T22:59:37.681Z
CVE-2023-48232 Floating point Exception in adjust_plines_for_skipcol() in vim
Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled and the cpo-settings include the 'n' flag. This may happen when a window border is present and when the wrapped line continues on the next physical line directly in the window border because the 'cpo' setting includes the 'n' flag. Only users with non-default settings are affected and the exception should only result in a crash. This issue has been addressed in commit `cb0b99f0` which has been included in release version 9.0.2107. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: vim
product: vim
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Published: 2023-11-16T22:57:17.462Z
CVE-2023-48233 overflow with count for :s command in vim
Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `ac6378773` which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: vim
product: vim
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-11-16T22:55:31.353Z
CVE-2023-48234 overflow in nv_z_get_count in vim
Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: vim
product: vim
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-11-16T22:52:50.866Z
CVE-2023-48235 overflow in ex address parsing in vim
Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an
overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: vim
product: vim
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-11-16T22:50:57.878Z
CVE-2023-48236 overflow in get_number in vim
Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger
than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit `73b2d379` which has been included in release version 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: vim
product: vim
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-11-16T22:47:53.519Z
CVE-2023-48237 overflow in shift_line in vim
Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `6bf131888` which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: vim
product: vim
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-11-16T22:45:57.667Z
CVE-2023-48238 JWT Algorithm Confusion in json-web-token library
joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to be transferred between two parties. Versions prior to 4.0.0 are vulnerable to a JWT algorithm confusion attack. On line 86 of the 'index.js' file, the algorithm to use for verifying the signature of the JWT token is taken from the JWT token, which at that point is still unverified and thus shouldn't be trusted. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work against this library is the RS256 algorithm is in use, however it is a best practice to use that algorithm. Version 4.0.0 fixes the issue.
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: joaquimserafim
product: json-web-token
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2023-11-17T21:35:00.111Z
CVE-2023-48239 Nextcloud Server users can make external storage mount points inaccessible for other users
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Enterprise Server, a malicious user could update any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud Server 25.0.13, 26.0.8, and 27.1.3 and Nextcloud Enterprise Server is upgraded to 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 contain a patch for this issue. As a workaround, disable app files_external. This workaround also makes the external storage inaccessible but retains the configurations until a patched version has been deployed.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: nextcloud
product: security-advisories
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
version: 3.1
Published: 2023-11-21T21:02:35.442Z
CVE-2023-48240 XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery
XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other domains and include all cookies that were sent in the original request to ensure that images with restricted view right can be compared. Starting in version 11.10.1 and prior to versions 14.10.15, 15.5.1, and 15.6, this allows an attacker to steal login and session cookies that allow impersonating the current user who views the diff. The attack can be triggered with an image that references the rendered diff, thus making it easy to trigger. Apart from stealing login cookies, this also allows server-side request forgery (the result of any successful request is returned in the image's source) and viewing protected content as once a resource is cached, it is returned for all users. As only successful requests are cached, the cache will be filled by the first user who is allowed to access the resource. This has been patched in XWiki 14.10.15, 15.5.1 and 15.6. The rendered diff now only downloads images from trusted domains. Further, cookies are only sent when the image's domain is the same the requested domain. The cache has been changed to be specific for each user. As a workaround, the image embedding feature can be disabled by deleting `xwiki-platform-diff-xml-<version>.jar` in `WEB-INF/lib/`.
Problem types: cwe_id: CWE-201
description: CWE-201: Insertion of Sensitive Information Into Sent Data
cwe_id: CWE-281
description: CWE-281: Improper Preservation of Permissions
cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: xwiki
product: xwiki-platform
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-11-20T17:48:03.447Z
CVE-2023-48241 XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service
XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wikis to anybody who has access to it, by default it is public. This exposes all information stored in the wiki (but not some protected information like password hashes). While there is a right check normally, the right check can be circumvented by explicitly requesting fields from Solr that don't include the data for the right check. This has been fixed in XWiki 15.6RC1, 15.5.1 and 14.10.15 by not listing documents whose rights cannot be checked. No known workarounds are available.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: xwiki
product: xwiki-platform
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-11-20T17:58:54.651Z
CVE-2023-48242 
The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Rexroth
product: Nexo cordless nutrunner NXA015S-36V (0608842001)
vendor: Rexroth
product: Nexo cordless nutrunner NXA030S-36V (0608842002)
vendor: Rexroth
product: Nexo cordless nutrunner NXA050S-36V (0608842003)
vendor: Rexroth
product: Nexo cordless nutrunner NXP012QD-36V (0608842005)
vendor: Rexroth
product: Nexo cordless nutrunner NXA015S-36V-B (0608842006)
vendor: Rexroth
product: Nexo cordless nutrunner NXA030S-36V-B (0608842007)
vendor: Rexroth
product: Nexo cordless nutrunner NXA050S-36V-B (0608842008)
vendor: Rexroth
product: Nexo cordless nutrunner NXP012QD-36V-B (0608842010)
vendor: Rexroth
product: Nexo cordless nutrunner NXA011S-36V (0608842011)
vendor: Rexroth
product: Nexo cordless nutrunner NXA011S-36V-B (0608842012)
vendor: Rexroth
product: Nexo cordless nutrunner NXA065S-36V (0608842013)
vendor: Rexroth
product: Nexo cordless nutrunner NXA065S-36V-B (0608842014)
vendor: Rexroth
product: Nexo cordless nutrunner NXV012T-36V (0608842015)
vendor: Rexroth
product: Nexo cordless nutrunner NXV012T-36V-B (0608842016)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2272)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2301)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2514)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2515)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2666)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2673)
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2024-01-10T10:35:25.216Z
CVE-2023-48243 
The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Rexroth
product: Nexo cordless nutrunner NXA015S-36V (0608842001)
vendor: Rexroth
product: Nexo cordless nutrunner NXA030S-36V (0608842002)
vendor: Rexroth
product: Nexo cordless nutrunner NXA050S-36V (0608842003)
vendor: Rexroth
product: Nexo cordless nutrunner NXP012QD-36V (0608842005)
vendor: Rexroth
product: Nexo cordless nutrunner NXA015S-36V-B (0608842006)
vendor: Rexroth
product: Nexo cordless nutrunner NXA030S-36V-B (0608842007)
vendor: Rexroth
product: Nexo cordless nutrunner NXA050S-36V-B (0608842008)
vendor: Rexroth
product: Nexo cordless nutrunner NXP012QD-36V-B (0608842010)
vendor: Rexroth
product: Nexo cordless nutrunner NXA011S-36V (0608842011)
vendor: Rexroth
product: Nexo cordless nutrunner NXA011S-36V-B (0608842012)
vendor: Rexroth
product: Nexo cordless nutrunner NXA065S-36V (0608842013)
vendor: Rexroth
product: Nexo cordless nutrunner NXA065S-36V-B (0608842014)
vendor: Rexroth
product: Nexo cordless nutrunner NXV012T-36V (0608842015)
vendor: Rexroth
product: Nexo cordless nutrunner NXV012T-36V-B (0608842016)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2272)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2301)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2514)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2515)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2666)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2673)
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
Published: 2024-01-10T10:36:56.971Z
CVE-2023-48244 
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Rexroth
product: Nexo cordless nutrunner NXA015S-36V (0608842001)
vendor: Rexroth
product: Nexo cordless nutrunner NXA030S-36V (0608842002)
vendor: Rexroth
product: Nexo cordless nutrunner NXA050S-36V (0608842003)
vendor: Rexroth
product: Nexo cordless nutrunner NXP012QD-36V (0608842005)
vendor: Rexroth
product: Nexo cordless nutrunner NXA015S-36V-B (0608842006)
vendor: Rexroth
product: Nexo cordless nutrunner NXA030S-36V-B (0608842007)
vendor: Rexroth
product: Nexo cordless nutrunner NXA050S-36V-B (0608842008)
vendor: Rexroth
product: Nexo cordless nutrunner NXP012QD-36V-B (0608842010)
vendor: Rexroth
product: Nexo cordless nutrunner NXA011S-36V (0608842011)
vendor: Rexroth
product: Nexo cordless nutrunner NXA011S-36V-B (0608842012)
vendor: Rexroth
product: Nexo cordless nutrunner NXA065S-36V (0608842013)
vendor: Rexroth
product: Nexo cordless nutrunner NXA065S-36V-B (0608842014)
vendor: Rexroth
product: Nexo cordless nutrunner NXV012T-36V (0608842015)
vendor: Rexroth
product: Nexo cordless nutrunner NXV012T-36V-B (0608842016)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2272)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2301)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2514)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2515)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2666)
vendor: Rexroth
product: Nexo special cordless nutrunner (0608PE2673)
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2024-01-10T10:37:55.300Z