CVE-2023-35799

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-35804.3Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.CVE-2023-358004.3Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that CVE-2023-358018.1A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a netwo CVE-2023-358029.8IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploit CVE-2023-358039.8IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow.CVE-2023-358088.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been iden CVE-2023-358098.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified i CVE-2023-35818.1Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket AP CVE-2023-358107.2An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has b CVE-2023-358118.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the R CVE-2023-358125.3An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 CVE-2023-358139.8Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce throug