rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-23912 
Out-of-bounds Read vulnerability in Merge DICOM Toolkit C/C++ on Windows.

When MC_Open_File() function is used to read a malformed DICOM data, it might result in over-reading memory buffer and could cause memory access violation.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Merative
product: Merge DICOM Toolkit C/C++
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Gabriele Quagliarella of Nozomi Networks found this bug during a security research activity.
Published: 2024-05-03T08:14:47.798Z
CVE-2024-23913 
Use of Out-of-range Pointer Offset vulnerability in Merge DICOM Toolkit C/C++ on Windows.

When deprecated MC_XML_To_Message() function is used to read a malformed DICOM XML file, it might result in memory access violation.
Problem types: description: Use of Out-of-range Pointer Offset
Affected products: vendor: Merative
product: Merge DICOM Toolkit C/C++
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Gabriele Quagliarella of Nozomi Networks found this bug during a security research activity.
Published: 2024-05-03T08:15:19.724Z
CVE-2024-23914 
Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows.

When MC_Open_Association() function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it might result in an unhandled exception.
Problem types: cwe_id: CWE-134
description: CWE-134 Use of Externally-Controlled Format String
Affected products: vendor: Merative
product: Merge DICOM Toolkit C/C++
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Gabriele Quagliarella of Nozomi Networks found this bug during a security research activity.
Published: 2024-05-03T08:15:32.389Z
CVE-2024-23915 NULL Pointer Dereference in libfluid_msg library
Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routines fluid_msg::of13::InstructionSet::unpack.

This issue affects libfluid: 0.1.0.
Problem types: cwe_id: CWE-690
description: CWE-690 Unchecked Return Value to NULL Pointer Dereference
Affected products: vendor: Open Networking Foundation (ONF)
product: libfluid
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-09-18T13:53:04.303Z
CVE-2024-23916 NULL Pointer Dereference in libfluid_msg library
Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routines fluid_msg::ActionSet::unpack.

This issue affects libfluid: 0.1.0.
Problem types: cwe_id: CWE-690
description: CWE-690 Unchecked Return Value to NULL Pointer Dereference
Affected products: vendor: Open Networking Foundation (ONF)
product: libfluid
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-09-18T13:53:35.102Z
CVE-2024-23917 
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
Problem types: cwe_id: CWE-288
description: CWE-288
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2024-02-06T09:21:31.957Z
CVE-2024-23918 
Improper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-92
description: Improper conditions check
Affected products: vendor: n/a
product: Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-11-13T20:34:16.216Z
CVE-2024-23919 
Improper buffer restrictions in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-92
description: Improper buffer restrictions
Affected products: vendor: n/a
product: Intel(R) Graphics software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
Published: 2024-11-13T21:06:00.324Z
CVE-2024-23920 ChargePoint Home Flex Improper Access Control
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the onboardee module. The issue results from improper access control. An attacker can leverage this vulnerability to execute code in the context of root.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: ChargePoint
product: Home Flex
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sina Kheirkhah of Summoning Team reported this to ZDI
Published: 2025-01-31T00:15:11.427Z
CVE-2024-23921 ChargePoint Home Flex Command Injection
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the wlanapp module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: ChargePoint
product: Home Flex
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sina Kheirkhah of Summoning Team reported this to ZDI
Published: 2025-01-31T00:17:52.652Z
CVE-2024-23922 Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability
Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of software update packages. An attacker can leverage this vulnerability to execute code in the context of the device.

Was ZDI-CAN-22939
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: Sony
product: XAV-AX5500
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-23T14:23:00.351Z
CVE-2024-23923 Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability
Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the prh_l2_sar_data_ind function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of root.

Was ZDI-CAN-22945
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Alpine
product: Halo9
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-28T06:22:22.014Z
CVE-2024-23924 Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability
Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UPDM_wemCmdCreatSHA256Hash function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

Was ZDI-CAN-23105
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Alpine
product: Halo9
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-28T06:18:57.554Z
CVE-2024-23928 Pioneer DMH-WT7600NEX Telematics Improper Certificate Validation
This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the telematics functionality, which operates over HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.
Problem types: cwe_id: CWE-295
description: CWE-295
Affected products: vendor: Pioneer
product: DMH-WT7600NEX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: NCC Group EDG reported this to ZDI.
Published: 2025-01-31T00:09:46.661Z
CVE-2024-23929 Pioneer DMH-WT7600NEX Telematics Directory Traversal
This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the telematics functionality. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: Pioneer
product: DMH-WT7600NEX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group EDG reported this to ZDI
Published: 2025-01-31T00:13:03.982Z
CVE-2024-23930 Pioneer DMH-WT7600NEX Media Service Improper Handling of Exceptional Conditions
This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Media service, which listens on TCP port 42000 by default. The issue results from improper handling of error conditions. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
Problem types: cwe_id: CWE-404
description: CWE-404
Affected products: vendor: Pioneer
product: DMH-WT7600NEX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: NCC Group EDG reported to ZDI
Published: 2025-01-31T00:01:54.514Z
CVE-2024-23933 Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability
Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of 	Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the Apple CarPlay protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

Was ZDI-CAN-23238
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Sony
product: XAV-AX5500
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-23T14:12:38.125Z
CVE-2024-23934 Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of WMV/ASF files. A crafted Extended Content Description Object in a WMV media file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

. Was ZDI-CAN-22994.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Sony
product: XAV-AX5500
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-23T14:16:02.143Z
CVE-2024-23935 Alpine Halo9 DecodeUTF7 Stack-based Buffer Overflow Remote Code Execution Vulnerability
Alpine Halo9 DecodeUTF7 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.

The specific flaw exists within the DecodeUTF7 function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

Was ZDI-CAN-23249
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Alpine
product: Halo9
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-28T06:13:30.882Z
CVE-2024-23937 Silicon Labs Gecko OS Debug Interface Format String
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the debug interface. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: Silicon Labs
product: Gecko OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Synacktiv reported this to ZDI.
Published: 2025-01-31T00:07:40.930Z
CVE-2024-23938 Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability
Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the debug interface. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

Was ZDI-CAN-23184
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Silicon Labs
product: Gecko OS
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-28T06:06:43.976Z
CVE-2024-23940 
Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable to a DLL hijacking/proxying vulnerability, which if exploited could allow an attacker to impersonate and modify a library to execute code on the system and ultimately escalate privileges on an affected system.
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Security (Consumer) uiAirSupport
Published: 2024-01-29T18:22:34.819Z
CVE-2024-23941 
Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: Intermesh BV
product: Group Office
vendor: Intermesh BV
product: Group Office
vendor: Intermesh BV
product: Group Office
Published: 2024-02-01T03:56:12.231Z
CVE-2024-23942 MB connect line: Configuration File on the client workstation is not encrypted
A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from accessing the cloud portal which leads to a DoS.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbNET
default_status: unaffected
vendor: MB connect line
product: mbNET.rokey
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
version: 3.1
Published: 2025-03-18T11:03:35.116Z