Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25528 State: PUBLISHED Published: 2024-05-08T00:00:00 Last Updated: 2024-08-01T23:44:09.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_work_stat_settingaspx
CVE ID: CVE-2024-25529 State: PUBLISHED Published: 2024-05-08T00:00:00 Last Updated: 2024-08-01T23:44:09.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file_history_show.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_office_file_history_showaspx
CVE ID: CVE-2024-25530 State: PUBLISHED Published: 2024-05-08T00:00:00 Last Updated: 2024-08-01T23:44:09.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find_condiction.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#get_find_condictionaspx
CVE ID: CVE-2024-25531 State: PUBLISHED Published: 2024-05-08T00:00:00 Last Updated: 2024-08-01T23:44:09.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondiction.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#searchcondictionaspx
CVE ID: CVE-2024-25532 State: PUBLISHED Published: 2024-05-08T00:00:00 Last Updated: 2024-08-01T23:44:09.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/get_dict.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#get_dictaspx
CVE ID: CVE-2024-25533 State: PUBLISHED Published: 2024-05-08T00:00:00 Last Updated: 2024-08-01T23:44:09.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx). This vulnerability can allow attackers to write files to the server or execute arbitrary commands via crafted SQL statements. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#information-leakage-and-unauthorized-access-to-sensitive-data
CVE ID: CVE-2024-25545 State: PUBLISHED Published: 2024-04-12T00:00:00 Last Updated: 2024-08-01T23:44:09.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.weavehelp.com/hc/en-us/articles/360060696152-Download-the-Weave-Desktop-App - https://gist.github.com/khronokernel/b68709335aa097752423f5d6844c3aa3
CVE ID: CVE-2024-25551 State: PUBLISHED Published: 2024-03-03T00:00:00 Last Updated: 2024-10-29T20:14:18.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in sourcecodester Simple Student Attendance System v1.0 allows attackers to execute arbitrary code via crafted GET request to web application URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://medium.com/%40jose.inaciot/my-first-cve-cve-2024-25551-f91787c05ae9
CVE ID: CVE-2024-25552 State: PUBLISHED Published: 2024-03-01T07:49:41.683Z Last Updated: 2024-08-26T18:33:44.194Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: W&T Products: Com Redirector PnP, Com Redirector Legacy, OPC-Server Problem Types: CWE-428 Description: A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-018
CVE ID: CVE-2024-25553 State: REJECTED Published: N/A Last Updated: 2024-03-01T07:50:53.472Z Description: No description available.
CVE ID: CVE-2024-25554 State: REJECTED Published: N/A Last Updated: 2024-03-01T07:51:22.368Z Description: No description available.
CVE ID: CVE-2024-25559 State: PUBLISHED Published: 2024-02-15T04:32:37.608Z Last Updated: 2024-11-01T20:52:44.326Z Vendors: appleple inc. Products: a-blog cms Problem Types: User Interface (UI) Misrepresentation of Critical Information Description: URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may be forced to access an arbitrary website when clicking a link in the audit log. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVN-48966481.html - https://jvn.jp/en/jp/JVN48966481/
CVE ID: CVE-2024-25560 State: PUBLISHED Published: 2024-05-08T15:01:25.651Z Last Updated: 2024-08-01T23:44:09.627Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next CNF Problem Types: CWE-476 Description: When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000139037
CVE ID: CVE-2024-25561 State: PUBLISHED Published: 2024-08-14T13:45:29.925Z Last Updated: 2024-08-16T16:10:26.685Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) HID Event Filter software installers Problem Types: escalation of privilege, CWE-277 Description: Insecure inherited permissions in some Intel(R) HID Event Filter software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01089.html
CVE ID: CVE-2024-25562 State: PUBLISHED Published: 2024-08-14T13:45:33.238Z Last Updated: 2024-08-14T19:06:10.315Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: n/a Products: Intel(R) Distribution for GDB software Problem Types: denial of service, CWE-92 Description: Improper buffer restrictions in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01075.html
CVE ID: CVE-2024-25563 State: PUBLISHED Published: 2024-11-13T21:02:46.527Z Last Updated: 2024-11-14T19:47:41.889Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi Problem Types: information disclosure, CWE-665 Description: Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before version 23.40 may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.ht
CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html
CVE ID: CVE-2024-25565 State: PUBLISHED Published: 2024-11-13T20:36:06.900Z Last Updated: 2024-11-13T20:59:56.539Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) Xeon(R) Processors Problem Types: denial of service, CWE-691 Description: Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated user to enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01085.html
CVE ID: CVE-2024-25566 State: PUBLISHED Published: 2024-10-29T15:34:53.358Z Last Updated: 2024-10-29T19:58:25.775Z Vendors: Ping Identity Products: PingAM Problem Types: CWE-601 Description: An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://backstage.forgerock.com/downloads/browse/am/featured - https://backstage.forgerock.com/knowledge/advisories/article/a63463303
CVE ID: CVE-2024-25567 State: PUBLISHED Published: 2024-03-21T22:22:17.780Z Last Updated: 2024-08-01T23:44:09.621Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-22 Description: Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE ID: CVE-2024-25568 State: PUBLISHED Published: 2024-04-04T00:02:32.323Z Last Updated: 2024-08-01T23:44:09.663Z Vendors: ELECOM CO.,LTD. Products: WRC-X3200GST3-B, WRC-G01-W, WMC-X1800GST-B Problem Types: OS command injection Description: OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands by sending a specially crafted request to the product. Affected products and versions are as follows: WRC-X3200GST3-B v1.25 and earlier, WRC-G01-W v1.24 and earlier, and WMC-X1800GST-B v1.41 and earlier. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B". Additional Analyst Notes: -
41 and earlier. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B". Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.elecom.co.jp/news/security/20240326-01/ - https://jvn.jp/en/vu/JVNVU95381465/
CVE ID: CVE-2024-25569 State: PUBLISHED Published: 2024-04-25T14:33:06.539Z Last Updated: 2025-11-04T17:14:27.283Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Grassroot DICOM Products: Grassroot DICOM Problem Types: CWE-125 Description: An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-194
Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1944 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N5HXUKUJ7SG3TK456SGUWVZ4Z5D7JKOL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJA7QWWZWMY4AQFR35EA7S3CFVUTOQYG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZJ4IG7EXMSMPHTK5ZFASCW6MHSOVZOE/
CVE ID: CVE-2024-25571 State: PUBLISHED Published: 2025-02-12T21:19:37.820Z Last Updated: 2025-02-13T15:13:01.214Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) SPS firmware before SPS_E5_06.01.04.059.0 Problem Types: Denial of Service, CWE-20 Description: Improper input validation in some Intel(R) SPS firmware before SPS_E5_06.01.04.059.0 may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01120.html
CVE ID: CVE-2024-25572 State: PUBLISHED Published: 2024-04-11T02:29:38.560Z Last Updated: 2025-03-13T14:52:08.346Z Vendors: Saturday Drive Products: Ninja Forms Problem Types: Cross-site request forgery (CSRF) Description: Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wordpress.org/plugins/ninja-forms/ - https://ninjaforms.com/ - https://jvn.jp/en/jp/JVN50361500/
CVE ID: CVE-2024-25573 State: PUBLISHED Published: 2025-06-15T15:25:38.540Z Last Updated: 2025-06-16T18:05:43.793Z Vendors: Ping Identity Products: PingFederate Problem Types: CWE-79 Description: Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.pingidentity.com/pingfederate/12.1/release_notes/pf_release_notes.html - https://www.pingidentity.com/en/resources/downloads/pingfederate.html
CVE ID: CVE-2024-25574 State: PUBLISHED Published: 2024-04-01T16:04:46.800Z Last Updated: 2024-08-01T23:44:09.659Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: SQL injection vulnerability exists in GetDIAE_usListParameters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE ID: CVE-2024-25575 State: PUBLISHED Published: 2024-04-30T14:38:39.114Z Last Updated: 2025-11-04T17:14:28.624Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-843 Description: A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a sp
user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1963
CVE ID: CVE-2024-25576 State: PUBLISHED Published: 2024-08-14T13:45:31.056Z Last Updated: 2024-08-14T15:47:09.041Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: n/a Products: Intel(R) FPGA products Problem Types: escalation of privilege, CWE-284 Description: improper access control in firmware for some Intel(R) FPGA products before version 24.1 may allow a privileged user to enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01087.html
CVE ID: CVE-2024-25578 State: PUBLISHED Published: 2024-03-01T00:40:00.677Z Last Updated: 2024-08-12T20:21:12.703Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MicroDicom Products: DICOM Viewer Problem Types: CWE-787 Description: MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior contain a lack of proper validation of user-supplied data, which could result in memory corruption within the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01
CVE ID: CVE-2024-25579 State: PUBLISHED Published: 2024-02-28T23:08:49.598Z Last Updated: 2024-12-03T17:10:28.400Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ELECOM CO.,LTD. Products: WRC-1167GS2-B, WRC-1167GS2H-B, WRC-1167GST2, WRC-2533GS2-B, WRC-2533GS2-W, WRC-2533GS2V-B, WRC-2533GST2, WRC-X3200GST3-B, WRC-G01-W, WMC-X1800GST-B Problem Types: OS command injection Description: OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product. Note that WMC-X1800GST-B is also included in e-Mesh Starte
mmands by sending a specially crafted request to the product. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B". Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20240220-01/ - https://jvn.jp/en/vu/JVNVU99444194/
CVE ID: CVE-2024-25580 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:36.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
CVE ID: CVE-2024-25581 State: PUBLISHED Published: 2024-05-13T11:49:24.500Z Last Updated: 2025-02-13T17:40:49.395Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: PowerDNS Products: DNSdist Problem Types: CWE-20 Description: When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a Denial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS (Do53) by default. Additiona
nial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS (Do53) by default. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2024-03.html - http://www.openwall.com/lists/oss-security/2024/05/13/1
CVE ID: CVE-2024-25582 State: PUBLISHED Published: 2024-08-19T06:59:17.511Z Last Updated: 2025-11-04T16:11:22.622Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-79 Description: Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social engineering to make a user follow a prepared link to a malicious account. Please deploy the provided updates and patch releases. The s
make a user follow a prepared link to a malicious account. Please deploy the provided updates and patch releases. The savepoint module path has been restricted to modules that provide the feature, excluding any arbitrary or non-existing modules. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6277_7.10.6_2024-05-06.pdf - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0003.json
CVE ID: CVE-2024-25583 State: PUBLISHED Published: 2024-04-25T09:45:05.220Z Last Updated: 2025-02-13T17:40:49.994Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: PowerDNS Products: Recursor Problem Types: CWE-20 Description: A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-02.html - http://www.openwall.com
rences: - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-02.html - http://www.openwall.com/lists/oss-security/2024/04/24/1
CVE ID: CVE-2024-25584 State: PUBLISHED Published: 2024-09-06T15:02:48.487Z Last Updated: 2024-09-06T15:28:02.638Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX Dovecot Pro Problem Types: CWE-345 Description: Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest released version. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
d version. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2024/oxdc-adv-2024-0001.json
CVE ID: CVE-2024-25590 State: PUBLISHED Published: 2024-10-03T15:29:08.765Z Last Updated: 2024-10-03T18:03:26.815Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: PowerDNS Products: Recursor Problem Types: CWE-20 Description: An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for these sets can lead to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-04.html
CVE ID: CVE-2024-25591 State: PUBLISHED Published: 2024-03-17T16:14:33.113Z Last Updated: 2024-08-01T23:44:09.827Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Benjamin Rojas Products: WP Editor Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Benjamin Rojas WP Editor.This issue affects WP Editor: from n/a through 1.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-editor/wordpress-wp-editor-plugin-1-2-7-sensitive-data-exposure-vulnerability?_s_id=cve