Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
set mechanism. The issue results from the lack of restriction of excessive authentication attempts. An attacker can leverage this vulnerability to reset a user's password and bypass authentication on the system. Was ZDI-CAN-24164. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-616/ - https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes
CVE ID: CVE-2024-5717 State: PUBLISHED Published: 2024-11-22T20:05:29.751Z Last Updated: 2024-11-26T15:57:54.789Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-78 Description: Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the implementation of the HTTP API. The issue results fro
ion mechanism can be bypassed. The specific flaw exists within the implementation of the HTTP API. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24165. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-617/ - https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes
CVE ID: CVE-2024-5718 State: PUBLISHED Published: 2024-11-22T20:05:30.722Z Last Updated: 2024-11-26T15:57:54.939Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-306 Description: Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the cluster HTTP API, which listens on TCP port 1924 by default when enabled. The issue r
s within the implementation of the cluster HTTP API, which listens on TCP port 1924 by default when enabled. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24166. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-618/ - https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes
CVE ID: CVE-2024-5719 State: PUBLISHED Published: 2024-11-22T20:05:31.663Z Last Updated: 2024-11-26T15:57:55.128Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-78 Description: Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the implementation of the HTTP API. The issue results fro
ion mechanism can be bypassed. The specific flaw exists within the implementation of the HTTP API. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24167. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-619/ - https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes
CVE ID: CVE-2024-5720 State: PUBLISHED Published: 2024-11-22T20:05:32.588Z Last Updated: 2024-11-26T15:57:55.536Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-78 Description: Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the implementation of the HTTP API. The issue results fro
ion mechanism can be bypassed. The specific flaw exists within the implementation of the HTTP API. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24168. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-613/ - https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes
CVE ID: CVE-2024-5721 State: PUBLISHED Published: 2024-11-22T20:05:33.642Z Last Updated: 2024-11-26T15:57:55.702Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-306 Description: Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the cluster HTTP API, which listens on TCP port 1924 when enabled. The issue results from
s within the implementation of the cluster HTTP API, which listens on TCP port 1924 when enabled. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24169. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-615/ - https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes
CVE ID: CVE-2024-5722 State: PUBLISHED Published: 2024-11-22T20:05:34.629Z Last Updated: 2024-11-26T15:57:55.888Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-321 Description: Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP API. The issue results from using a hard-coded cryptographic key. An attacker
. The specific flaw exists within the HTTP API. The issue results from using a hard-coded cryptographic key. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24170. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-614/ - https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes
CVE ID: CVE-2024-5723 State: PUBLISHED Published: 2024-08-21T16:14:43.583Z Last Updated: 2024-08-21T17:27:57.933Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon Problem Types: CWE-89 Description: Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateServiceHost function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker ca
ts from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-23294. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-595/
CVE ID: CVE-2024-5724 State: PUBLISHED Published: 2024-06-19T03:12:31.112Z Last Updated: 2024-08-01T21:18:07.064Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: webhuntinfotech Products: Photo Video Gallery Master Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGM_all_photos_details' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software
ith Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8376556e-ed78-4a0e-a23f-9b2a39db94d9?source=cve - https://plugins.trac.wordpress.org/browser/photo-video-gallery-master/trunk/photo-video-gallery-master.php#L301
CVE ID: CVE-2024-5725 State: PUBLISHED Published: 2024-08-21T16:14:52.027Z Last Updated: 2024-08-22T15:48:16.728Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon Problem Types: CWE-89 Description: Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the initCurveList function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can levera
the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-22683. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-597/
CVE ID: CVE-2024-5726 State: PUBLISHED Published: 2024-07-18T02:03:55.800Z Last Updated: 2024-08-01T21:18:06.943Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpdiscover Products: Timeline Event History Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Timeline Event History plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1 via deserialization of untrusted input 'timelines-data' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is pres
cess and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/107afaa6-6c0b-43fb-9713-ebc4f1189ea6?source=cve - https://plugins.trac.wordpress.org/browser/timeline-event-history/trunk/includes/admin/timeline-wp-build.php#L5 - https://plugins.trac.wordpress.org/browser/timeline-event-history/trunk/includes/public/templates/sty
-wp-build.php#L5 - https://plugins.trac.wordpress.org/browser/timeline-event-history/trunk/includes/public/templates/style-another/index.php#L5 - https://plugins.trac.wordpress.org/browser/timeline-event-history/trunk/includes/public/templates/style-one/index.php#L7
CVE ID: CVE-2024-5727 State: PUBLISHED Published: 2024-06-28T06:00:03.875Z Last Updated: 2024-08-01T21:18:06.947Z Vendors: Unknown Products: Widget4Call Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5f677863-2f4f-474f-ba48-f490f9d6e71c/
CVE ID: CVE-2024-5728 State: PUBLISHED Published: 2024-06-28T06:00:04.165Z Last Updated: 2024-08-01T21:18:07.034Z Vendors: Unknown Products: Animated AL List Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/287c4e8c-9092-4cb9-9642-e4f3d10f46fa/
CVE ID: CVE-2024-5729 State: PUBLISHED Published: 2024-06-28T06:00:04.527Z Last Updated: 2024-08-01T21:18:07.060Z Vendors: Unknown Products: Simple AL Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/0352f6f5-cdfd-4cef-9ed5-fdc1cbcb368a/
CVE ID: CVE-2024-5730 State: PUBLISHED Published: 2024-06-28T06:00:05.085Z Last Updated: 2024-08-01T21:18:07.116Z Vendors: Unknown Products: Pagerank tools Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/17482b2c-c9ba-480a-8000-879baf835af7/
CVE ID: CVE-2024-5731 State: PUBLISHED Published: 2024-06-14T13:57:25.836Z Last Updated: 2024-08-01T21:18:06.887Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Trellix Products: Intrusion Prevention System (IPS) Manager Problem Types: CWE-311 Description: A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by manipulating the parameter, thereby leveraging sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://thrive.trellix.com/s/article/000013623
CVE ID: CVE-2024-5732 State: PUBLISHED Published: 2024-06-07T10:00:04.020Z Last Updated: 2024-08-01T21:18:07.061Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: Clash Problem Types: CWE-287 Description: A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-267406 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP V
figuration settings. VDB-267406 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.267406 - https://vuldb.com/?ctiid.267406 - https://vuldb.com/?submit.345469 - https://github.com/GTA12138/vul/blob/main/clash%20for%20windows.md
CVE ID: CVE-2024-5733 State: PUBLISHED Published: 2024-06-07T11:31:03.489Z Last Updated: 2024-08-01T21:18:06.919Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Discussion Forum Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Online Discussion Forum 1.0. It has been rated as critical. This issue affects some unknown processing of the file register_me.php. The manipulation of the argument eaddress leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267407. Additional Analyst Notes: - CISA ADP Vul
and may be used. The associated identifier of this vulnerability is VDB-267407. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.267407 - https://vuldb.com/?ctiid.267407 - https://vuldb.com/?submit.351115 - https://github.com/kingshao0312/cve/issues/1
CVE ID: CVE-2024-5734 State: PUBLISHED Published: 2024-06-07T11:31:04.948Z Last Updated: 2024-08-01T21:18:07.013Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Discussion Forum Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. Affected is an unknown function of the file /members/poster.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267408. Additional Analyst Notes: - CISA ADP Vulnrichment
c and may be used. The identifier of this vulnerability is VDB-267408. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.267408 - https://vuldb.com/?ctiid.267408 - https://vuldb.com/?submit.351116 - https://github.com/kingshao0312/cve/issues/2
CVE ID: CVE-2024-5735 State: PUBLISHED Published: 2024-06-28T11:24:18.916Z Last Updated: 2024-08-01T21:18:07.044Z Vendors: Nikola Vasilijevski Products: AdmirorFrames Problem Types: CWE-497 Description: Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/06/CVE-2024-5735/ - https://cert.pl/posts/2024/06/CVE-2024-5735/ - https://github.com/vasiljevski/admirorframes/issues/3 - https://github.com/sectroyer/CVEs/tree/mai
4/06/CVE-2024-5735/ - https://github.com/vasiljevski/admirorframes/issues/3 - https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5735 - https://github.com/afine-com/CVE-2024-5735
CVE ID: CVE-2024-5736 State: PUBLISHED Published: 2024-06-28T11:26:53.512Z Last Updated: 2024-08-01T21:18:06.930Z Vendors: Nikola Vasilijevski Products: AdmirorFrames Problem Types: CWE-918 Description: Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/06/CVE-2024-5735/ - https://cert.pl/posts/2024/06/CVE-2024-5735/ - https://github.com/vasiljevski/admirorframes/issues/3 - https://github.com/sect
//cert.pl/posts/2024/06/CVE-2024-5735/ - https://github.com/vasiljevski/admirorframes/issues/3 - https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5736 - https://github.com/afine-com/CVE-2024-5736
CVE ID: CVE-2024-5737 State: PUBLISHED Published: 2024-06-28T11:29:03.154Z Last Updated: 2024-08-01T21:18:07.021Z Vendors: Nikola Vasilijevski Products: AdmirorFrames Problem Types: CWE-79 Description: Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/06/CVE-2024-5735/ - https://cert.pl/posts/2024/06/CVE-2024-5735/ - https://github.com/vasiljevski/admiro
l/en/posts/2024/06/CVE-2024-5735/ - https://cert.pl/posts/2024/06/CVE-2024-5735/ - https://github.com/vasiljevski/admirorframes/issues/3 - https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5737 - https://github.com/afine-com/CVE-2024-5737
CVE ID: CVE-2024-5738 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:48.088Z Description: No description available.
CVE ID: CVE-2024-5739 State: PUBLISHED Published: 2024-06-12T07:00:35.232Z Last Updated: 2025-03-28T23:50:07.942Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: LINE Corporation Products: LINE client for iOS Problem Types: na Description: The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability. This vulnerability allows for cross-site scripting (XSS) where arbitrary JavaScript can be executed in the top frame from an embedded iframe on any displayed web site within the in-app browser. The in-app browser is usually opened by tapping on URLs contained in chat messages, and for the attack to be successful,
he in-app browser is usually opened by tapping on URLs contained in chat messages, and for the attack to be successful, the victim must trigger a click event on a malicious iframe. If an iframe embedded in any website can be controlled by an attacker, this vulnerability could be exploited to capture or alter content displayed in the top frame, as well as user session information. This vulnerability affects LINE client for iOS versions below 14.9.0 and does not affect other LINE clients such as LINE client for Android. Please update LINE client for iOS to version 14.9.0 or higher. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/r
igher. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2284129
CVE ID: CVE-2024-5741 State: PUBLISHED Published: 2024-06-17T11:16:59.771Z Last Updated: 2024-08-01T21:18:07.062Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-80 Description: Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://checkmk.com/werk/17009