rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-29111 Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service)
The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confidentiality of the application.


Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: SAP
product: Application Interface Framework (ODATA service)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-04-11T03:01:14.297Z
CVE-2023-29112 Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)
The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.


Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: SAP
product: Application Interface Framework (Message Monitoring)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2023-04-11T03:03:09.047Z
CVE-2023-29113 A lack of access control in custom IPC mechanism
The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mechanism, leaving attackers with presence in the system an ability to undermine access control restrictions implemented at the operating system level.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Preh Car Connect GmbH (JOYNEXT GmbH)
product: Volkswagen MIB3 infotainment system MIB3 OI MQB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Artem Ivachev from PCA Cyber Security (PCAutomotive)
Published: 2025-06-28T15:33:26.500Z
CVE-2023-29114 Unauthorized System Log Disclosure in Enel X JuiceBox
System logs could be accessed through web management application due to a lack of access control.


An attacker can obtain the following sensitive information:

•     Wi-Fi access point credentials to which the EV charger can connect.

•     APN web address and credentials.

•     IPSEC credentials.

•     Web interface access credentials for user and admin accounts.

•     JuiceBox system components (software installed, model, firmware version, etc.).

•     C2G configuration details.

•     Internal IP addresses.

•     OTA firmware update configurations (DNS servers).

All the credentials are stored in logs in an unencrypted plaintext format.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Abdellah Benotsmane (PCAutomotive)
Published: 2024-11-05T15:01:08.666Z
CVE-2023-29115 Denial of Service via Web Management interface in Enel X JuiceBox
In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot).
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Abdellah Benotsmane (PCAutomotive)
Published: 2024-11-05T15:04:04.570Z
CVE-2023-29116 PHP Information Disclosure in Enel X JuiceBox
Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configuration details could be obtained.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Abdellah Benotsmane (PCAutomotive)
Published: 2024-11-05T15:08:28.147Z
CVE-2023-29117 Authentication Bypass in JuiceBox Web Manager interface
Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Abdellah Benotsmane (PCAutomotive)
Published: 2024-11-05T15:14:23.990Z
CVE-2023-29118 Unauthorized SQLite Injection in Enel X Juicebox
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Anna Breeva (PCAutomotive)
Published: 2024-11-05T15:18:04.751Z
CVE-2023-29119 Unauthorized SQLite Injection
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Anna Breeva (PCAutomotive)
Published: 2024-11-05T15:20:56.644Z
CVE-2023-29120 Unauthorized Remote Command Execution in Enel X Juicebox
Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Danila Parnishchev (PCAutomotive)
lang: en
value: Anna Breeva (PCAutomotive)
Published: 2024-11-05T15:22:22.178Z
CVE-2023-29121 Exposed TCF agent service in Enel X Juicebox
Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Abdellah Benotsmane (PCAutomotive)
Published: 2024-11-05T15:23:41.624Z
CVE-2023-29122 Incorrect file ownership of privileged service's libraries in Enel X JuiceBox
Under certain conditions, access to service libraries is granted to account they should not have access to.
Problem types: cwe_id: CWE-708
description: CWE-708: Incorrect Ownership Assignment
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Artem Ivachev (PCAutomotive)
Published: 2024-11-05T15:24:43.416Z
CVE-2023-29125 Heap overflow in CM_main.exe binary in Enel X JuiceBox
A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Artem Ivachev (PCAutomotive)
Published: 2024-11-05T15:27:22.764Z
CVE-2023-29126 Insecure loose comparison in Enel X JuiceBox
The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypass authentication.
Problem types: cwe_id: CWE-1287
description: CWE-1287: Improper Validation of Specified Type of Input
Affected products: vendor: Enel X
product: JuiceBox Pro 3.0 22kW Cellular
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Anna Breeva (PCAutomotive)
lang: en
value: Abdellah Benotsmane (PCAutomotive)
Published: 2024-11-05T15:28:53.542Z
CVE-2023-29128 
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to write any file with the extension `.db`.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Siemens
product: SIMATIC Cloud Connect 7 CC712
default_status: unknown
vendor: Siemens
product: SIMATIC Cloud Connect 7 CC716
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C
baseScore: 3.8
baseSeverity: LOW
Published: 2023-05-09T11:51:35.346Z
CVE-2023-29129 
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.4.0), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.3.1 < V3.6.1), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.1.9 < V3.3.1), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.3.0 < V3.6.0), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.1.8 < V3.3.0), Mendix SAML (Mendix 9.12/9.18 compatible, New Track) (All versions >= V3.3.1 < V3.3.15), Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.14), Mendix SAML (Mendix 9.6 compatible, New Track) (All versions >= V3.1.9 < V3.2.7), Mendix SAML (Mendix 9.6 compatible, Upgrade Track) (All versions >= V3.1.8 < V3.2.6). The affected versions of the module insufficiently verify the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application.

This CVE entry describes the incomplete fix for CVE-2023-25957 in a specific non default configuration.
Problem types: cwe_id: CWE-303
description: CWE-303: Incorrect Implementation of Authentication Algorithm
Affected products: vendor: Siemens
product: Mendix SAML (Mendix 7 compatible)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 7 compatible)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 8 compatible)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 8 compatible)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 9 latest compatible, New Track)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 9 latest compatible, New Track)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 9 latest compatible, Upgrade Track)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 9 latest compatible, Upgrade Track)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 9.12/9.18 compatible, New Track)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 9.6 compatible, New Track)
default_status: unknown
vendor: Siemens
product: Mendix SAML (Mendix 9.6 compatible, Upgrade Track)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C
baseScore: 9.1
baseSeverity: CRITICAL
Published: 2023-06-13T08:17:09.102Z
CVE-2023-29130 
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of improper access controls in the configuration files that leads to privilege escalation. An attacker could gain admin access with this vulnerability leading to complete device control.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: SIMATIC CN 4100
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 9.9
baseSeverity: CRITICAL
Published: 2023-07-11T09:07:06.193Z
CVE-2023-29131 
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of an incorrect default value in the SSH configuration. This could allow an attacker to bypass network isolation.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: Siemens
product: SIMATIC CN 4100
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C
baseScore: 7.4
baseSeverity: HIGH
Published: 2023-07-11T09:07:07.238Z
CVE-2023-29132 
Irssi 1.3.x and 1.4.x before 1.4.4 has a use-after-free because of use of a stale special collector reference. This occurs when printing of a non-formatted line is concurrent with printing of a formatted line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2023-29134 
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling of backticks to smartSplit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2023-29137 
An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The UserImpactHandler for GrowthExperiments inadvertently returns the timezone preference for arbitrary users, which can be used to de-anonymize users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-31T00:00:00.000Z
CVE-2023-29139 
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissions makes many CheckUserLog API requests in some configurations, denial of service can occur (RequestTimeoutException or upstream request timeout).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-31T00:00:00.000Z
CVE-2023-29140 
An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see edits for which the username has been hidden, because there is no check for rev_deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-31T00:00:00.000Z
CVE-2023-29141 
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-31T00:00:00.000Z
CVE-2023-29144 
Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-12T00:00:00.000Z
CVE-2023-29145 
The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution. The attacker can set LD_LIBRARY_PATH, set LD_PRELOAD, or run an executable file in a debugger.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-30T00:00:00.000Z
CVE-2023-29147 
In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the same identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-30T00:00:00.000Z
CVE-2023-29150 CVE-2023-29150
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. 
Problem types: description: CWE-78 OS Command Injection
Affected products: vendor: mySCADA Technologies
product: mySCADA myPRO
Published: 2023-04-27T22:01:29.958Z
CVE-2023-29151 
Uncontrolled search path element in some Intel(R) PSR SDK before version 1.0.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path element
Affected products: vendor: n/a
product: Intel(R) PSR SDK
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-08-11T02:37:23.573Z
CVE-2023-29152 PTC Vuforia Studio Improper Authorization


By changing the filename parameter in the request, an attacker could 
delete any file with the permissions of the Vuforia server account.


Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: PTC 
product: Vuforia Studio
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Lockheed Martin—Red Team reported these vulnerabilities to PTC.
Published: 2023-06-07T21:46:20.797Z
CVE-2023-29153 
Uncontrolled resource consumption for some Intel(R) SPS firmware before version SPS_E5_06.01.04.002.0 may allow a privileged user to potentially enable denial of service via network access.
Problem types: description: denial of service
cwe_id: CWE-400
description: Uncontrolled resource consumption
Affected products: vendor: n/a
product: Intel(R) SPS firmware
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2024-02-14T13:38:17.590Z
CVE-2023-29154 
SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may execute an arbitrary SQL command via specially crafted input to the query setting page.
Problem types: description: SQL Injection
Affected products: vendor: Contec Co., Ltd.
product: CONPROSYS HMI System (CHS)
Published: 2023-06-01T00:00:00.000Z