CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35799
https://notcve.org/view.php?id=CVE-2023-35799
Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges. • https://advisories.stormshield.eu https://advisories.stormshield.eu/2023-022 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35800
https://notcve.org/view.php?id=CVE-2023-35800
Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved to administrators. • https://advisories.stormshield.eu https://advisories.stormshield.eu/2023-021 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23562
https://notcve.org/view.php?id=CVE-2023-23562
Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameters. • https://advisories.stormshield.eu https://advisories.stormshield.eu/2023-002 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23561
https://notcve.org/view.php?id=CVE-2023-23561
Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information. • https://advisories.stormshield.eu https://advisories.stormshield.eu/2023-001 •
CVSS: 5.3EPSS: 0%CPEs: 14EXPL: 2CVE-2023-20052
https://notcve.org/view.php?id=CVE-2023-20052
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process. • https://github.com/nokn0wthing/CVE-2023-20052 https://github.com/cY83rR0H1t/CVE-2023-20052 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-xxe-TcSZduhN • CWE-611: Improper Restriction of XML External Entity Reference CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •