CVE-2023-35800

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved to administrators.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-358018.1A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a netwo CVE-2023-358029.8IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploit CVE-2023-358039.8IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow.CVE-2023-358088.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been iden CVE-2023-358098.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified i CVE-2023-35818.1Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket AP CVE-2023-358107.2An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has b CVE-2023-358118.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the R CVE-2023-358125.3An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 CVE-2023-358139.8Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce throug CVE-2023-358149.8DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.CVE-2023-358159.8DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.