CVE-2023-22572

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A low privilege local attacker could potentially exploit this vulnerability, leading to system takeover.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Feb 1, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-225735.5Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. A low privilegCVE-2023-225748.1Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI moCVE-2023-225758.8Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. A low privilegesCVE-2023-225767.8Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low prCVE-2023-225777.5Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP cCVE-2023-225789.8Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.CVE-2023-225798.8Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.CVE-2023-22588.8Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.CVE-2023-225807.5Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.CVE-2023-225819.8White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the webCVE-2023-225826.1The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.CVE-2023-225839.8The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.