rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-7323 Nagios Log Server < 2024R1 XSS via Create User Function
Nagios Log Server versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Create User function. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Nagios
product: Log Server
default_status: unaffected
Published: 2025-10-30T21:27:03.493Z
CVE-2023-7324 scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
In the Linux kernel, the following vulnerability has been resolved:

scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses

Sanitize possible addl_desc_ptr out-of-bounds accesses in
ses_enclosure_data_process().
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2025-10-29T13:46:14.184Z
CVE-2023-7325 Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF
Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix socket RPC endpoints and perform privileged XML-RPC methods. An attacker able to send such requests can invoke administrative RPC methods via the unix socket interface to create arbitrary user accounts on the system, resulting in account creation and potential takeover of the bastion host. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:17.837319 UTC.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Anheng Information (Hangzhou DBAPP Security Information Technology Co., Ltd.)
product: Mingyu Operations and Maintenance Audit and Risk Control System
default_status: unknown
Credits: lang: en
value: Anonymous User via CN-SEC
Published: 2025-10-30T21:17:54.830Z
CVE-2023-7326 Epson Stylus SX510W Printer Remote Power Off DoS
The Epson Stylus SX510W embedded web management service fails to properly handle consecutive ampersand characters in query parameters when accessing /PRESENTATION/HTML/TOP/INDEX.HTML. A remote attacker can send a malformed request that triggers improper input parsing or memory handling, resulting in the printer process shutting down or powering off, causing a denial of service condition.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Seiko Epson
product: Epson Stylus SX510W
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-11-12T22:09:43.255Z
CVE-2023-7327 Ozeki SMS Gateway <= 10.3.208 Unauthenticated Arbitrary File Read
Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability. Successful exploitation allows an unauthenticated attacker to use URL-encoded traversal sequences to read arbitrary files from the underlying filesystem with the privileges of the gateway service, leading to disclosure of sensitive information.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Ozeki Ltd.
product: Ozeki SMS Gateway
default_status: unaffected
Credits: lang: en
value: Ahmet Ümit BAYRAM
Published: 2025-11-12T22:07:07.320Z
CVE-2023-7328 Screen SFT DAB 600/C <= 1.9.3 Unauthenticated Information Disclosure
Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: DB Elettronica Telecomunicazioni SpA
product: Screen SFT DAB 600/C
default_status: unknown
Credits: lang: en
value: Gjoko Krstic of Zero Science Lab
Published: 2025-11-14T22:51:05.202Z
CVE-2023-7329 Tinycontrol LAN Controller v3 (LK3) Remote DoS
Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of service and configuration loss.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: tinycontrol
product: Lan Controller
default_status: unaffected
Credits: lang: en
value: Gjoko Krstic of Zero Science Lab
Published: 2025-11-12T22:06:26.619Z
CVE-2023-7330 Ruijie Networks NBR Routers Unauthenticated Arbitrary File Upload via fileupload.php
Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accepts attacker-supplied values in the name and uploadDir parameters and saves the provided multipart file content without adequate validation or sanitization of file type, path, or extension. A remote attacker can upload a crafted PHP file and then access it from the web root, resulting in arbitrary code execution in the context of the web service. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-14 UTC.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Beijing Star-Net Ruijie Network Technology Co., Ltd.
product: NBR Series Routers
default_status: unknown
Published: 2025-11-24T20:31:19.914Z
CVE-2023-7331 PKrystian Full-Stack-Bank User sql injection
A vulnerability was detected in PKrystian Full-Stack-Bank up to bf73a0179e3ff07c0d7dc35297cea0be0e5b1317. This vulnerability affects unknown code of the component User Handler. Performing manipulation results in sql injection. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The patch is named 25c9965a872c704f3a9475488dc5d3196902199a. It is suggested to install a patch to address this issue.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PKrystian
product: Full-Stack-Bank
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2025-12-31T21:02:07.896Z
CVE-2023-7332 PocketMine-MP < 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash
PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player's hotbar, triggering a server crash and resulting in denial of service.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: pmmp
product: PocketMine-MP
default_status: unaffected
Published: 2025-12-31T21:37:38.838Z
CVE-2023-7333 bluelabsio records-mover Table Object sql injection
A weakness has been identified in bluelabsio records-mover up to 1.5.4. The affected element is an unknown function of the component Table Object Handler. This manipulation causes sql injection. The attack needs to be launched locally. Upgrading to version 1.6.0 is sufficient to fix this issue. Patch name: 3f8383aa89f45d861ca081e3e9fd2cc9d0b5dfaa. You should upgrade the affected component.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: bluelabsio
product: records-mover
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2026-01-07T23:02:10.309Z
CVE-2023-7334 Changjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCE
Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore with a malicious JSON body that leverages deserialization of attacker-controlled .NET types to invoke arbitrary methods such as System.Diagnostics.Process.Start. This can result in execution of arbitrary commands in the context of the T+ application service account. Exploitation evidence was observed by the Shadowserver Foundation as early as 2023-08-19 (UTC).
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Changjetong Information Technology Co., Ltd.
product: T+
default_status: unknown
Published: 2026-01-15T21:44:58.843Z
CVE-2023-7335 EduSoho < 22.4.7 Arbitrary File Read via classroom-course-statistics
EduSoho versions prior to 22.4.7 contain an arbitrary file read vulnerability in the classroom-course-statistics export functionality. A remote, unauthenticated attacker can supply crafted path traversal sequences in the fileNames[] parameter to read arbitrary files from the server filesystem, including application configuration files such as config/parameters.yml that may contain secrets and database credentials. Exploitation evidence was observed by the Shadowserver Foundation on 2026-01-19 (UTC).
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Hangzhou Kuozhi Network Technology Co., Ltd.
product: EduSoho
default_status: unaffected
Published: 2026-01-22T16:55:25.228Z
CVE-2023-7337 JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient escaping on the user supplied values and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: rabilal
product: JS Help Desk – AI-Powered Support & Ticketing System
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Published: 2026-03-04T09:24:29.837Z
CVE-2023-7338 Ruckus Unleashed Authenticated RCE in Gateway Mode
Ruckus Unleashed contains a remote code execution vulnerability in the web-based management interface that allows authenticated remote attackers to execute arbitrary code on the system when gateway mode is enabled. Attackers can exploit this vulnerability by sending specially crafted requests through the management interface to achieve arbitrary code execution on affected systems.
Problem types: cwe_id: CWE-78
description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Affected products: vendor: Ruckus Networks
product: RUCKUS H350
default_status: affected
vendor: Ruckus Networks
product: RUCKUS H550
default_status: affected
vendor: Ruckus Networks
product: RUCKUS R350
default_status: affected
vendor: Ruckus Networks
product: RUCKUS R550
default_status: affected
vendor: Ruckus Networks
product: RUCKUS R650
default_status: affected
vendor: Ruckus Networks
product: RUCKUS R750
default_status: affected
vendor: Ruckus Networks
product: RUCKUS R850
default_status: affected
vendor: Ruckus Networks
product: RUCKUS T350c
default_status: affected
vendor: Ruckus Networks
product: RUCKUS T350d
default_status: affected
vendor: Ruckus Networks
product: RUCKUS T350se
default_status: affected
vendor: Ruckus Networks
product: RUCKUS T750
default_status: affected
vendor: Ruckus Networks
product: RUCKUS T750SE
default_status: affected
vendor: Ruckus Networks
product: RUCKUS Unleashed
default_status: affected
vendor: Ruckus Networks
product: Ruckus C110
default_status: affected
vendor: Ruckus Networks
product: Ruckus E510
default_status: affected
vendor: Ruckus Networks
product: Ruckus H320
default_status: affected
vendor: Ruckus Networks
product: Ruckus H510
default_status: affected
vendor: Ruckus Networks
product: Ruckus M510-JP
default_status: affected
vendor: Ruckus Networks
product: Ruckus R320
default_status: affected
vendor: Ruckus Networks
product: Ruckus R510
default_status: affected
vendor: Ruckus Networks
product: Ruckus R610
default_status: affected
vendor: Ruckus Networks
product: Ruckus R710
default_status: affected
vendor: Ruckus Networks
product: Ruckus R720
default_status: affected
vendor: Ruckus Networks
product: Ruckus T310c
default_status: affected
vendor: Ruckus Networks
product: Ruckus T310d
default_status: affected
vendor: Ruckus Networks
product: Ruckus T310n
default_status: affected
vendor: Ruckus Networks
product: Ruckus T310s
default_status: affected
vendor: Ruckus Networks
product: Ruckus T610
default_status: affected
vendor: Ruckus Networks
product: Ruckus T710
default_status: affected
vendor: Ruckus Networks
product: Ruckus T710s
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2026-03-26T19:20:53.252Z
CVE-2023-7339 Data collection for dowloading leads into buffer overflow
Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers.
This issue affects
pnGate: through 1.30
epGate: through 1.30
mbGate: through 1.30
smartLink HW-DP: through 1.30
smartLink HW-PN: through 1.01.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Softing
product: pnGate
default_status: unaffected
vendor: Softing
product: epGate
default_status: unaffected
vendor: Softing
product: mbGate
default_status: unaffected
vendor: Softing
product: smartLink HW-DP
default_status: unaffected
vendor: Softing
product: smartLink HW-PN
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: 2026-03-27T10:53:07.778Z
CVE-2023-7340 Wazuh authd service (os_auth) Heap-based Buffer Overflow
Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers can exploit this vulnerability to trigger a denial of service condition, resulting in low availability impact to the authentication daemon.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Wazuh
product: Wazuh
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
baseSeverity: LOW
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Credits: lang: en
value: Reported by @vikman90; credited to @stasos24.
Published: 2026-03-27T15:52:47.751Z
CVE-2023-7342 Belden HiSecOS Web Server Privilege Escalation
HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authenticated users with operator or auditor roles to escalate privileges to the administrator role by sending specially crafted packets to the web server. Attackers can exploit this flaw to gain full administrative access to the affected device.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Belden
product: Hirschmann HiSecOS EAGLE
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2026-04-02T18:27:15.226Z
CVE-2023-7343 Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File
Hirschmann Industrial HiVision versions 05.0.00 through 08.3.01 prior to 08.3.02 contain an arbitrary code execution vulnerability triggered when an administrator opens a maliciously crafted project file. Successful exploitation allows the attacker to execute code in the context of the HiVision process.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Belden
product: Hirschmann Industrial HiVision
default_status: unaffected
CVSS v3.1: attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: 2026-04-02T19:56:24.883Z
CVE-2023-7345 Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation
Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can obtain signatures on truncated or misinterpreted message values to authorize unintended blockchain transactions, such as asset transfers at incorrect amounts.
Problem types: cwe_id: CWE-704
description: CWE-704 Incorrect Type Conversion or Cast
Affected products: vendor: Ledger
product: ledgerhq/hw-app-eth
default_status: unaffected
vendor: Ledger
product: Ledger Live
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Credits: lang: en
value: Ian Fisher
lang: en
value: VulnCheck
Published: 2026-05-19T21:55:51.388Z
CVE-2023-7346 Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript
Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.
Problem types: cwe_id: CWE-682
description: CWE-682 Incorrect Calculation
Affected products: vendor: Ledger
product: Ledger Bitcoin app
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: PHYSICAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Credits: lang: en
value: Kevin Loaec
lang: en
value: Antoine Poinsot
lang: en
value: VulnCheck
Published: 2026-05-20T14:13:22.344Z
CVE-2024-0001 
A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.
Problem types: cwe_id: CWE-1188
description: CWE-1188 Insecure Default Initialization of Resource
Affected products: vendor: Pure Storage
product: FlashArray
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-09-23T17:25:00.509Z
CVE-2024-0002 
A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: PureStorage
product: FlashArray
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-09-23T17:26:08.811Z
CVE-2024-0003 
A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: PureStorage
product: FlashArray
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-09-23T17:27:30.114Z
CVE-2024-0004 
A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: PureStorage
product: FlashArray
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-09-23T17:28:53.664Z
CVE-2024-0005 
A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: PureStorage
product: FlashArray
default_status: unaffected
vendor: PureStorage
product: FlashBlade
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-09-23T17:34:11.321Z