Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-52875 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-02-12T20:41:37.262Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GFI Products: Kerio Control Problem Types: CWE-113 Description: An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). R
perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875
CVE ID: CVE-2024-52876 State: PUBLISHED Published: 2024-11-17T00:00:00 Last Updated: 2024-11-18T16:47:10.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://coalfire.com/the-coalfire-blog/holy-stone-remote-id-vulnerability-disclosure
CVE ID: CVE-2024-52877 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-19T20:02:26.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, callback function SmmCreateVariableLockList () calls CreateVariableLockListInSmm (). In CreateVariableLockListInSmm (), it uses StrSize () to get variable name size and it could lead to a buffer over-read. Additional Analyst Notes:
Smm (), it uses StrSize () to get variable name size and it could lead to a buffer over-read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/sa-2024016/
CVE ID: CVE-2024-52878 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-19T19:55:47.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, VariableServicesSetVariable () can be called by gRT_>SetVariable () or the SmmSetSensitiveVariable () or SmmInternalSetVariable () from SMM. In VariableServicesSetVariable (), it uses StrSize () to get variable name size, uses StrLe
rnalSetVariable () from SMM. In VariableServicesSetVariable (), it uses StrSize () to get variable name size, uses StrLen () to get variable name length and uses StrCmp () to compare strings. These actions may cause a buffer over-read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/sa-2024016/
CVE ID: CVE-2024-52879 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-19T20:04:06.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SmmUpdateVariablePropertySmi () is a SMM callback function and it uses StrCmp () to compare variable names. This action may cause a buffer over-read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyd
action may cause a buffer over-read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/sa-2024016/
CVE ID: CVE-2024-52880 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-16T14:19:59.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SecureBootHandler uses DataSize and VariableNameSize when determining if the data or name are in the buffer, but these are supplied by the caller and therefore cannot be trusted. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
these are supplied by the caller and therefore cannot be trusted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/sa-2024016/
CVE ID: CVE-2024-52881 State: PUBLISHED Published: 2025-02-07T00:00:00.000Z Last Updated: 2025-02-10T16:54:09.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sensitive data such as passwords extracted from the topology file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-079.txt
CVE ID: CVE-2024-52882 State: PUBLISHED Published: 2025-02-07T00:00:00.000Z Last Updated: 2025-02-10T16:56:48.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to improper neutralization of input via the devices API, an attacker can inject malicious JavaScript code (XSS) to attack logged-in administrator sessions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-076.txt
CVE ID: CVE-2024-52883 State: PUBLISHED Published: 2025-02-07T00:00:00.000Z Last Updated: 2025-02-10T16:57:51.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to a path traversal vulnerability, sensitive data can be read without any authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-075.txt
CVE ID: CVE-2024-52884 State: PUBLISHED Published: 2025-02-07T00:00:00.000Z Last Updated: 2025-02-10T16:55:20.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscation/encryption, an attacker with access to configuration exports (INI) is able to decrypt the passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/solutions-products/products/session-border-controllers-sbcs - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-078.txt
CVE ID: CVE-2024-52885 State: PUBLISHED Published: 2025-08-06T14:45:43.182Z Last Updated: 2025-08-06T15:03:53.437Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: checkpoint Products: Check Point Mobile Access Problem Types: CWE-35 Description: The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessible directories on the Mobile Access gateway. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.checkpoint.com/results/sk/sk183137
CVE ID: CVE-2024-52887 State: PUBLISHED Published: 2025-04-27T07:46:23.027Z Last Updated: 2025-04-28T16:31:21.597Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: checkpoint Products: Check Point Mobile Access Problem Types: CWE-79 Description: Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.checkpoint.com/results/sk/sk183054
CVE ID: CVE-2024-52888 State: PUBLISHED Published: 2025-04-27T07:46:53.542Z Last Updated: 2025-04-28T16:31:15.797Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: checkpoint Products: Check Point Mobile Access Problem Types: CWE-79 Description: For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.checkpoint.com/results/sk/sk183055
CVE ID: CVE-2024-52890 State: PUBLISHED Published: 2025-08-05T13:45:59.104Z Last Updated: 2025-08-05T14:02:25.726Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: IBM Engineering Lifecycle Optimization - Publishing Problem Types: CWE-84 Description: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7241392
CVE ID: CVE-2024-52891 State: PUBLISHED Published: 2025-01-07T11:58:13.671Z Last Updated: 2025-01-07T14:47:44.238Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-117 Description: IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180303
CVE ID: CVE-2024-52892 State: PUBLISHED Published: 2025-02-06T19:27:39.422Z Last Updated: 2025-02-22T22:11:06.206Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Jazz for Service Management Problem Types: CWE-79 Description: IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182508
CVE ID: CVE-2024-52893 State: PUBLISHED Published: 2025-01-07T12:00:41.835Z Last Updated: 2025-01-07T14:44:00.514Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-209 Description: IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180303
CVE ID: CVE-2024-52894 State: PUBLISHED Published: 2025-07-29T19:00:12.910Z Last Updated: 2025-08-17T01:23:03.366Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 Problem Types: CWE-121 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240953
CVE ID: CVE-2024-52895 State: PUBLISHED Published: 2025-02-14T14:36:21.990Z Last Updated: 2025-02-14T15:01:56.856Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: i Problem Types: CWE-754 Description: IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor can remove or otherwise impact database infrastructure files resulting in incorrect behavior of software products that rely upon the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183052
CVE ID: CVE-2024-52896 State: PUBLISHED Published: 2024-12-19T17:01:20.061Z Last Updated: 2025-01-10T14:26:51.681Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: MQ Problem Types: CWE-209 Description: IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179152
CVE ID: CVE-2024-52897 State: PUBLISHED Published: 2024-12-19T17:18:11.436Z Last Updated: 2025-01-14T16:39:11.196Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: MQ Problem Types: CWE-209 Description: IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179151
CVE ID: CVE-2024-52898 State: PUBLISHED Published: 2025-01-14T16:49:57.674Z Last Updated: 2025-01-14T17:41:54.638Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: MQ Problem Types: CWE-209 Description: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179150
CVE ID: CVE-2024-52899 State: PUBLISHED Published: 2024-11-26T00:34:19.476Z Last Updated: 2024-11-26T15:29:29.620Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Data Virtualization Manager for z/OS Problem Types: CWE-94 Description: IBM Data Virtualization Manager for z/OS 1.1 and 1.2 could allow an authenticated user to inject malicious JDBC URL parameters and execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177091
CVE ID: CVE-2024-52900 State: PUBLISHED Published: 2025-06-28T00:59:23.758Z Last Updated: 2025-08-24T11:37:56.523Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-79 Description: IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node
trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7238163
CVE ID: CVE-2024-52901 State: PUBLISHED Published: 2024-12-12T16:06:31.783Z Last Updated: 2024-12-12T16:33:42.317Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-1284 Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to GUI to not load or stop working due to improper input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177700
CVE ID: CVE-2024-52902 State: PUBLISHED Published: 2025-02-19T14:50:24.376Z Last Updated: 2025-08-15T14:42:21.022Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Cognos Controller, Controller Problem Types: CWE-798 Description: IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183597
CVE ID: CVE-2024-52903 State: PUBLISHED Published: 2025-05-01T22:15:48.366Z Last Updated: 2025-09-29T15:26:07.133Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-248 Description: IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232336
CVE ID: CVE-2024-52905 State: PUBLISHED Published: 2025-03-10T16:05:13.550Z Last Updated: 2025-09-01T10:15:16.815Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling B2B Integrator Standard Edition Problem Types: CWE-497 Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 could disclose sensitive database information to a privileged user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185264
CVE ID: CVE-2024-52906 State: PUBLISHED Published: 2024-12-25T14:48:57.318Z Last Updated: 2024-12-26T18:09:36.603Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: AIX Problem Types: CWE-362 Description: IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179826
CVE ID: CVE-2024-52912 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:47:54.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an abs64 logic bug. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/03/disclose-timestamp-overflow/
CVE ID: CVE-2024-52913 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:46:23.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/03/disclose_already_asked_for/
CVE ID: CVE-2024-52914 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:38:12.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/03/disclose-orphan-dos/
CVE ID: CVE-2024-52915 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:29:26.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/03/disclose-inv-buffer-blowup/
CVE ID: CVE-2024-52916 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:32:50.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/03/disclose-header-spam/
CVE ID: CVE-2024-52917 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:20:27.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH replies from a fake UPnP device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/31/disclose-upnp-oom/
CVE ID: CVE-2024-52918 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:27:11.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) via a BIP21 r parameter for a URL that has a large file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/03/disclose-bip70-crash/
CVE ID: CVE-2024-52919 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:21:59.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure (and daemon exit) via a flood of addr messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/31/disclose-addrman-int-overflow/
CVE ID: CVE-2024-52920 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:27:30.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/03/disclose-getdata-cpu/