Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
uild 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-20
CVE ID: CVE-2024-21904 State: PUBLISHED Published: 2024-09-06T16:26:45.983Z Last Updated: 2024-09-06T17:47:40.203Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.7.2770 build 20240520 and later QuTS hero h5.1.7.2770 build 20240520 and later Additional Analyst Notes: - CISA ADP Vul
.7.2770 build 20240520 and later QuTS hero h5.1.7.2770 build 20240520 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-23
CVE ID: CVE-2024-21905 State: PUBLISHED Published: 2024-04-26T15:01:00.169Z Last Updated: 2024-08-12T19:31:28.640Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-190 Description: An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later Addit
5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-24-16
CVE ID: CVE-2024-21906 State: PUBLISHED Published: 2024-09-06T16:27:36.257Z Last Updated: 2024-09-06T17:06:25.449Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823 build 20240712 and later QuTS hero h5.1.8.2823 build 20240712 and later Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
40712 and later QuTS hero h5.1.8.2823 build 20240712 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-33
CVE ID: CVE-2024-21907 State: PUBLISHED Published: 2024-01-03T15:23:04.441Z Last Updated: 2024-09-06T18:26:37.445Z Problem Types: CWE-755 Description: Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/JamesNK/Newtonsoft.Json/issues/2457 - https://github.com/J
er: - CISA ADP Vulnrichment: References: - https://github.com/JamesNK/Newtonsoft.Json/issues/2457 - https://github.com/JamesNK/Newtonsoft.Json/pull/2462 - https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66 - https://alephsecurity.com/2018/10/22/StackOverflowException/ - https://alephsecurity.com/vulns/aleph-2018004 - https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678 - https://github.com/advisories/GHSA-5crp-9r3c-p9vr - https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr
CVE ID: CVE-2024-21908 State: PUBLISHED Published: 2024-01-03T15:38:09.664Z Last Updated: 2025-04-17T18:36:43.163Z Problem Types: CWE-79 Description: TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tinymce/tinymce/security/advisories/GHSA-5h9g-x5rv-25wg - https://www.tiny.cloud/docs/release-notes/release-notes59/#securityfixes - https://github.com/advisories/GHSA-5h9g-x5rv-25wg - https://vulnc
ud/docs/release-notes/release-notes59/#securityfixes - https://github.com/advisories/GHSA-5h9g-x5rv-25wg - https://vulncheck.com/advisories/vc-advisory-GHSA-5h9g-x5rv-25wg
CVE ID: CVE-2024-21909 State: PUBLISHED Published: 2024-01-03T15:41:57.739Z Last Updated: 2025-06-03T14:43:33.578Z Problem Types: CWE-407 Description: PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg - https:/
CISA ADP Vulnrichment: References: - https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg - https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95 - https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1 - https://github.com/advisories/GHSA-6r92-cgxc-r5fg - https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg
CVE ID: CVE-2024-21910 State: PUBLISHED Published: 2024-01-03T15:55:27.061Z Last Updated: 2025-06-18T15:38:04.887Z Problem Types: CWE-79 Description: TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39 - https://github.com/jazzband/django-tinymce/issues/366 - https://github.com/jazzband/django-tinymce/releases/tag/3.4.0 - https://
github.com/jazzband/django-tinymce/issues/366 - https://github.com/jazzband/django-tinymce/releases/tag/3.4.0 - https://pypi.org/project/django-tinymce/3.4.0/ - https://github.com/advisories/GHSA-r8hm-w5f7-wj39 - https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39
CVE ID: CVE-2024-21911 State: PUBLISHED Published: 2024-01-03T15:59:00.305Z Last Updated: 2025-06-11T16:33:37.008Z Problem Types: CWE-79 Description: TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tinymce/tinymce/security/advisories/GHSA-w7jx-j77m-wp65 - https://www.npmjs.com/package/tinymce - https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes - https://github.com/adviso
m/package/tinymce - https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes - https://github.com/advisories/GHSA-w7jx-j77m-wp65 - https://vulncheck.com/advisories/vc-advisory-GHSA-w7jx-j77m-wp65
CVE ID: CVE-2024-21912 State: PUBLISHED Published: 2024-03-26T15:34:35.837Z Last Updated: 2024-08-05T16:44:27.351Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Arena Simulation Problem Types: CWE-787 Description: An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into the software. This is done by writing beyond the designated memory area, which causes an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would
e system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html
CVE ID: CVE-2024-21913 State: PUBLISHED Published: 2024-03-26T15:38:23.962Z Last Updated: 2024-08-02T20:03:36.781Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Arena Simulation Problem Types: CWE-122 Description: A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this,
mful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html
CVE ID: CVE-2024-21914 State: PUBLISHED Published: 2024-03-25T21:27:18.975Z Last Updated: 2024-08-05T16:36:55.604Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Rockwell Automation Products: FactoryTalk® View ME Problem Types: Improper security protection for remote restart action Description: A vulnerability exists in the affected product that allows a malicious user to restart the Rockwell Automation PanelView™ Plus 7 terminal remotely without security protections. If the vulnerability is exploited, it could lead to the loss of view or control of the PanelView™ product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
control of the PanelView™ product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD1663.html
CVE ID: CVE-2024-21915 State: PUBLISHED Published: 2024-02-16T18:20:43.862Z Last Updated: 2024-08-28T16:49:41.429Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Rockwell Automation Products: FactoryTalk® Service Platform Problem Types: CWE-732 Description: A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A threat actor could potentially read and modify sensitive data, delete data and render the FTSP system unavailable. Additional Analyst Notes: - CVE
ally read and modify sensitive data, delete data and render the FTSP system unavailable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD1662.html
CVE ID: CVE-2024-21916 State: PUBLISHED Published: 2024-01-31T18:28:59.715Z Last Updated: 2024-08-01T22:35:34.618Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Rockwell Automation Products: ControlLogix® 5570, GuardLogix® 5570, ControlLogix® 5570 redundant Problem Types: CWE-119 Description: A denial-of-service vulnerability exists in specific Rockwell Automation ControlLogix ang GuardLogix controllers. If exploited, the product could potentially experience a major nonrecoverable fault (MNRF). The device will restart itself to recover from the MNRF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rockwel
the MNRF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD1661.html
CVE ID: CVE-2024-21917 State: PUBLISHED Published: 2024-01-31T18:16:27.949Z Last Updated: 2024-10-17T17:09:38.403Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: FactoryTalk® Service Platform Problem Types: CWE-347 Description: A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a malicious user could potentially retrieve user information and modify settings without any authentication. Add
loited, a malicious user could potentially retrieve user information and modify settings without any authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD1660.html
CVE ID: CVE-2024-21918 State: PUBLISHED Published: 2024-03-26T15:44:33.835Z Last Updated: 2024-08-06T15:05:34.136Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Arena Simulation Problem Types: CWE-416 Description: A memory buffer vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by corrupting the memory and triggering an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to o
s the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html
CVE ID: CVE-2024-21919 State: PUBLISHED Published: 2024-03-26T15:46:38.129Z Last Updated: 2024-08-02T17:55:57.699Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Arena Simulation Problem Types: CWE-824 Description: An uninitialized pointer in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by leveraging the pointer after it is properly. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious fi
ity, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html
CVE ID: CVE-2024-21920 State: PUBLISHED Published: 2024-03-26T15:48:59.735Z Last Updated: 2024-08-06T18:02:34.744Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: Rockwell Automation Products: Arena Simulation Problem Types: CWE-125 Description: A memory buffer vulnerability in Rockwell Automation Arena Simulation could potentially let a threat actor read beyond the intended memory boundaries. This could reveal sensitive information and even cause the application to crash, resulting in a denial-of-service condition. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor. Additional Analyst Notes: - CVE Program Co
r would unwittingly need to open a malicious file shared by the threat actor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html
CVE ID: CVE-2024-21922 State: PUBLISHED Published: 2025-11-23T16:26:50.063Z Last Updated: 2025-11-24T16:20:09.974Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: AMD Products: AMD StoreMI™ Problem Types: CWE-426 Description: A DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4010.html
CVE ID: CVE-2024-21923 State: PUBLISHED Published: 2025-11-23T16:27:55.574Z Last Updated: 2025-11-24T14:41:43.065Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: AMD Products: AMD StoreMI™ Problem Types: CWE-426 Description: Incorrect default permissions in AMD StoreMI™ could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4010.html
CVE ID: CVE-2024-21924 State: PUBLISHED Published: 2025-02-11T20:18:50.402Z Last Updated: 2025-02-11T20:52:32.535Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: AMD Products: AMD EPYC™ 7002 Processors, AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors, AMD Ryzen™ Threadripper™ PRO 5000WX- Series Desktop Processors, AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors, AMD EPYC™ Embedded 7002 Processors Problem Types: CWE-250 Description: SMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentially resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP V
modify boot services handlers, potentially resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7028.html
CVE ID: CVE-2024-21925 State: PUBLISHED Published: 2025-02-11T20:39:03.746Z Last Updated: 2025-06-27T21:55:43.707Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: AMD Products: AMD EPYC™ 7001 Processors, AMD EPYC™ 7002 Processors, AMD EPYC™ 9004 Processors, AMD EPYC™ 7003 Processors, AMD Ryzen™ 3000 Series Desktop Processors, AMD Ryzen™ 5000 Series Desktop Processors, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics, AMD Ryzen™ 7000 Series Desktop Processors, AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics, AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics, AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics, AMD
Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics, AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics, AMD Ryzen™ Threadripper™ 3000 Series Processors, AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors, AMD Ryzen™ Threadripper™ PRO 5000WX- Series Desktop Processors, AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors, AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics, AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics
raphics, AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics, AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics, AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics, AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics, AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 7000 Series Mobile Processors, AMD EPYC™ Embedded 3000, AMD EPYC™ Embedded 7002, AMD EPYC™ Embedded 7003, AMD EPYC™ Embedded 9004, AMD Ryzen™ Embedded 5000, AMD Ryzen™ Embedded 7000, AMD Ryzen™ Embedded V2000, AMD Ryzen™ Embedded V3000, AMD Ryzen™ Embedded 8000, AMD Ryzen™ Embedded R1000, AMD Ryzen™ Embedded R2000, AMD Ryzen™ Embedded V1000 Problem Types: CWE-20 Description: Improper inp
en™ Embedded R1000, AMD Ryzen™ Embedded R2000, AMD Ryzen™ Embedded V1000 Problem Types: CWE-20 Description: Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7027.html
CVE ID: CVE-2024-21927 State: PUBLISHED Published: 2025-09-23T21:33:54.121Z Last Updated: 2025-09-24T13:18:45.108Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: AMD Products: AMD Instinct™ MI300X Problem Types: CWE-241 Description: Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain special characters in manipulated Redfish® API commands, causing service processes like OpenBMC to crash and reset, potentially resulting in denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6016.html
CVE ID: CVE-2024-21935 State: PUBLISHED Published: 2025-09-23T21:38:22.057Z Last Updated: 2025-09-24T13:16:47.376Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: AMD Products: AMD Instinct™ MI300X Problem Types: CWE-241 Description: Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate Redfish® API commands to remove files from the local root directory, potentially resulting in data corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6016.html
CVE ID: CVE-2024-21937 State: PUBLISHED Published: 2024-11-12T17:14:20.641Z Last Updated: 2024-11-14T16:26:04.560Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: AMD Products: AMD Software: PRO Edition, AMD Software: Adrenalin Edition, AMD Software: Cloud Edition Problem Types: CWE-276 Description: Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6015.html
CVE ID: CVE-2024-21938 State: PUBLISHED Published: 2024-11-12T17:14:39.332Z Last Updated: 2024-11-13T20:39:37.769Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: AMD Products: AMD Management Plug-In for SCCM Problem Types: CWE-276 Description: Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-9005.html