Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-47092 State: PUBLISHED Published: 2025-03-03T13:47:18.887Z Last Updated: 2025-03-04T07:53:06.307Z Problem Types: CWE-502 Description: Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api prior to 5.8.1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://exchange.checkmk.com/p/check-mk-api - https://github.com/HeinleinSupport/check_mk_extensions/commit/b5a2a7529e3367d7a643e66f05da4f2a27013904
CVE ID: CVE-2024-47093 State: PUBLISHED Published: 2024-12-19T14:08:44.081Z Last Updated: 2025-11-03T19:31:17.975Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Nagvis Products: Nagvis Problem Types: CWE-79 Description: Improper neutralization of input in Nagvis before version 1.9.42 which can lead to XSS Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/NagVis/nagvis/commit/30e71e8167d17a1828e7da71d6942f6fb36478cd - https://github.com/NagVis/nagvis/commit/b5b1164007439de526df7d54d5c02d7732ba1c42 - https://www.nagvis.org/downloads/changelog/1.9.42
CVE ID: CVE-2024-47094 State: PUBLISHED Published: 2024-11-29T09:52:18.988Z Last Updated: 2025-09-11T07:16:20.513Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be written to web log files accessible to local site users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17342
CVE ID: CVE-2024-47095 State: PUBLISHED Published: 2024-10-08T07:49:56.847Z Last Updated: 2024-10-08T13:55:09.799Z Vendors: Follet School Solutions Products: Destiny Problem Types: CWE-79 Description: Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the expiredSupportMessage parameter of handleloginform.do. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.securin.io/zerodays/cve-2024-47095-reflected-cross-site-scripting-in-follett-school-solutions-destiny-library-manager/
CVE ID: CVE-2024-47100 State: PUBLISHED Published: 2025-01-14T10:30:11.506Z Last Updated: 2025-01-14T14:33:39.216Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC S7-1200 CPU 1211C AC/DC/Rly, SIMATIC S7-1200 CPU 1211C DC/DC/DC, SIMATIC S7-1200 CPU 1211C DC/DC/Rly, SIMATIC S7-1200 CPU 1212C AC/DC/Rly, SIMATIC S7-1200 CPU 1212C DC/DC/DC, SIMATIC S7-1200 CPU 1212C DC/DC/Rly, SIMATIC S7-1200 CPU 1212FC DC/DC/DC, SIMATIC S7-1200 CPU 1212FC DC/DC/Rly, SIMATIC S7-1200 CPU 1214C AC/DC/Rly, SIMATIC S7-1200 CPU 1214C DC/DC/DC, SIMATIC S7-1200 CPU 1214C DC/DC/Rly, SIMATIC S7-1200 CPU 1214FC DC/DC/DC, SIMATIC S7-1200 CPU 1214FC DC/D
214C DC/DC/DC, SIMATIC S7-1200 CPU 1214C DC/DC/Rly, SIMATIC S7-1200 CPU 1214FC DC/DC/DC, SIMATIC S7-1200 CPU 1214FC DC/DC/Rly, SIMATIC S7-1200 CPU 1215C AC/DC/Rly, SIMATIC S7-1200 CPU 1215C DC/DC/DC, SIMATIC S7-1200 CPU 1215C DC/DC/Rly, SIMATIC S7-1200 CPU 1215FC DC/DC/DC, SIMATIC S7-1200 CPU 1215FC DC/DC/Rly, SIMATIC S7-1200 CPU 1217C DC/DC/DC, SIPLUS S7-1200 CPU 1212 AC/DC/RLY, SIPLUS S7-1200 CPU 1212 DC/DC/RLY, SIPLUS S7-1200 CPU 1212C DC/DC/DC, SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL, SIPLUS S7-1200 CPU 1214 AC/DC/RLY, SIPLUS S7-1200 CPU 1214 DC/DC/DC, SIPLUS S7-1200 CPU 1214 DC/DC/RLY, SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL, SIPLUS S7-1200 CPU 1214FC DC/DC/DC, SIPLUS S7-1200 CPU 1214FC D
1214 DC/DC/RLY, SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL, SIPLUS S7-1200 CPU 1214FC DC/DC/DC, SIPLUS S7-1200 CPU 1214FC DC/DC/RLY, SIPLUS S7-1200 CPU 1215 AC/DC/RLY, SIPLUS S7-1200 CPU 1215 DC/DC/DC, SIPLUS S7-1200 CPU 1215 DC/DC/RLY, SIPLUS S7-1200 CPU 1215C DC/DC/DC, SIPLUS S7-1200 CPU 1215FC DC/DC/DC Problem Types: CWE-352 Description: A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/Rly (6ES7211-1HE40-0XB0), SIMATIC S7-1200 CPU 1212C AC/DC/Rly (6ES7212-1BE40-0XB0), SIMATIC S7-1200 CPU 1212C DC/DC/DC (6ES7212-1AE40-0XB0), SIMATIC S7-1200 CPU 1212C DC/DC/R
/DC/Rly (6ES7212-1BE40-0XB0), SIMATIC S7-1200 CPU 1212C DC/DC/DC (6ES7212-1AE40-0XB0), SIMATIC S7-1200 CPU 1212C DC/DC/Rly (6ES7212-1HE40-0XB0), SIMATIC S7-1200 CPU 1212FC DC/DC/DC (6ES7212-1AF40-0XB0), SIMATIC S7-1200 CPU 1212FC DC/DC/Rly (6ES7212-1HF40-0XB0), SIMATIC S7-1200 CPU 1214C AC/DC/Rly (6ES7214-1BG40-0XB0), SIMATIC S7-1200 CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0), SIMATIC S7-1200 CPU 1214C DC/DC/Rly (6ES7214-1HG40-0XB0), SIMATIC S7-1200 CPU 1214FC DC/DC/DC (6ES7214-1AF40-0XB0), SIMATIC S7-1200 CPU 1214FC DC/DC/Rly (6ES7214-1HF40-0XB0), SIMATIC S7-1200 CPU 1215C AC/DC/Rly (6ES7215-1BG40-0XB0), SIMATIC S7-1200 CPU 1215C DC/DC/DC (6ES7215-1AG40-0XB0), SIMATIC S7-1200 CPU 1215C DC/DC/R
/DC/Rly (6ES7215-1BG40-0XB0), SIMATIC S7-1200 CPU 1215C DC/DC/DC (6ES7215-1AG40-0XB0), SIMATIC S7-1200 CPU 1215C DC/DC/Rly (6ES7215-1HG40-0XB0), SIMATIC S7-1200 CPU 1215FC DC/DC/DC (6ES7215-1AF40-0XB0), SIMATIC S7-1200 CPU 1215FC DC/DC/Rly (6ES7215-1HF40-0XB0), SIMATIC S7-1200 CPU 1217C DC/DC/DC (6ES7217-1AG40-0XB0), SIPLUS S7-1200 CPU 1212 AC/DC/RLY (6AG1212-1BE40-2XB0), SIPLUS S7-1200 CPU 1212 AC/DC/RLY (6AG1212-1BE40-4XB0), SIPLUS S7-1200 CPU 1212 DC/DC/RLY (6AG1212-1HE40-2XB0), SIPLUS S7-1200 CPU 1212 DC/DC/RLY (6AG1212-1HE40-4XB0), SIPLUS S7-1200 CPU 1212C DC/DC/DC (6AG1212-1AE40-2XB0), SIPLUS S7-1200 CPU 1212C DC/DC/DC (6AG1212-1AE40-4XB0), SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL (6AG22
G1212-1AE40-2XB0), SIPLUS S7-1200 CPU 1212C DC/DC/DC (6AG1212-1AE40-4XB0), SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL (6AG2212-1AE40-1XB0), SIPLUS S7-1200 CPU 1214 AC/DC/RLY (6AG1214-1BG40-2XB0), SIPLUS S7-1200 CPU 1214 AC/DC/RLY (6AG1214-1BG40-4XB0), SIPLUS S7-1200 CPU 1214 AC/DC/RLY (6AG1214-1BG40-5XB0), SIPLUS S7-1200 CPU 1214 DC/DC/DC (6AG1214-1AG40-2XB0), SIPLUS S7-1200 CPU 1214 DC/DC/DC (6AG1214-1AG40-4XB0), SIPLUS S7-1200 CPU 1214 DC/DC/DC (6AG1214-1AG40-5XB0), SIPLUS S7-1200 CPU 1214 DC/DC/RLY (6AG1214-1HG40-2XB0), SIPLUS S7-1200 CPU 1214 DC/DC/RLY (6AG1214-1HG40-4XB0), SIPLUS S7-1200 CPU 1214 DC/DC/RLY (6AG1214-1HG40-5XB0), SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL (6AG2214-1AG40-1XB0), SI
SIPLUS S7-1200 CPU 1214 DC/DC/RLY (6AG1214-1HG40-5XB0), SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL (6AG2214-1AG40-1XB0), SIPLUS S7-1200 CPU 1214FC DC/DC/DC (6AG1214-1AF40-5XB0), SIPLUS S7-1200 CPU 1214FC DC/DC/RLY (6AG1214-1HF40-5XB0), SIPLUS S7-1200 CPU 1215 AC/DC/RLY (6AG1215-1BG40-2XB0), SIPLUS S7-1200 CPU 1215 AC/DC/RLY (6AG1215-1BG40-4XB0), SIPLUS S7-1200 CPU 1215 AC/DC/RLY (6AG1215-1BG40-5XB0), SIPLUS S7-1200 CPU 1215 DC/DC/DC (6AG1215-1AG40-2XB0), SIPLUS S7-1200 CPU 1215 DC/DC/DC (6AG1215-1AG40-4XB0), SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-2XB0), SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-4XB0), SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-5XB0), SIPLUS S7-1200 CPU 12
0 CPU 1215 DC/DC/RLY (6AG1215-1HG40-4XB0), SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-5XB0), SIPLUS S7-1200 CPU 1215C DC/DC/DC (6AG1215-1AG40-5XB0), SIPLUS S7-1200 CPU 1215FC DC/DC/DC (6AG1215-1AF40-5XB0). The web interface of the affected devices is vulnerable to Cross-Site Request Forgery (CSRF) attacks. This could allow an unauthenticated attacker to change the CPU mode by tricking a legitimate and authenticated user with sufficient permissions on the target CPU to click on a malicious link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-717113.html
CVE ID: CVE-2024-47102 State: PUBLISHED Published: 2024-12-25T14:47:39.249Z Last Updated: 2025-09-29T15:23:15.712Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: AIX, VIOS Problem Types: CWE-863 Description: IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179826
CVE ID: CVE-2024-47103 State: PUBLISHED Published: 2025-01-31T15:24:33.527Z Last Updated: 2025-01-31T15:58:05.647Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-79 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/sup
CVE ID: CVE-2024-47104 State: PUBLISHED Published: 2024-12-18T10:53:19.133Z Last Updated: 2024-12-18T14:41:39.925Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: IBM Products: i Problem Types: CWE-732 Description: IBM i 7.4 and 7.5 is vulnerable to an authenticated user gaining elevated privilege to a physical file. A user with authority to a view can alter the based-on physical file security attributes without having object management rights to the physical file. A malicious actor can use the elevated privileges to perform actions restricted by their view privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/suppo
ted by their view privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179158
CVE ID: CVE-2024-47106 State: PUBLISHED Published: 2025-01-18T16:09:47.381Z Last Updated: 2025-01-21T20:51:51.370Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Jazz for Service Management Problem Types: CWE-552 Description: IBM Jazz for Service Management 1.1.3 through 1.1.3.22 could allow a remote attacker to obtain sensitive information from improper access restrictions that could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7178507
CVE ID: CVE-2024-47107 State: PUBLISHED Published: 2024-12-07T14:49:45.624Z Last Updated: 2024-12-09T15:59:55.524Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: QRadar SIEM Problem Types: CWE-79 Description: IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7178104
CVE ID: CVE-2024-47109 State: PUBLISHED Published: 2025-03-10T16:01:42.848Z Last Updated: 2025-09-01T01:08:12.240Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling File Gateway Problem Types: CWE-522 Description: IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 UI could disclosure the installation path of the server which could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185259
CVE ID: CVE-2024-47113 State: PUBLISHED Published: 2025-01-18T15:29:40.728Z Last Updated: 2025-01-21T20:53:07.098Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: IBM Products: Voice Gateway Problem Types: CWE-91 Description: IBM ICP - Voice Gateway 1.0.2, 1.0.2.4, 1.0.3, 1.0.4, 1.0.5, 1.0.6. 1.0.7, 1.0.7.1, and 1.0.8 could allow remote attacker to send specially crafted XML statements, which would allow them to attacker to view or modify information in the XML document. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7175791
CVE ID: CVE-2024-47115 State: PUBLISHED Published: 2024-12-07T12:42:59.838Z Last Updated: 2024-12-10T16:13:11.390Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: AIX Problem Types: CWE-78 Description: IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7178033
CVE ID: CVE-2024-47116 State: PUBLISHED Published: 2025-01-31T16:01:06.963Z Last Updated: 2025-01-31T16:47:10.695Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-79 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com
isclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182046
CVE ID: CVE-2024-47117 State: PUBLISHED Published: 2024-12-10T13:49:50.660Z Last Updated: 2024-12-10T14:48:28.606Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Carbon Charts Problem Types: CWE-79 Description: IBM Carbon Design System (Carbon Charts 0.4.0 through 1.13.16) is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7178269
CVE ID: CVE-2024-47118 State: PUBLISHED Published: 2025-11-07T18:23:07.665Z Last Updated: 2025-11-07T18:48:16.332Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 Problem Types: CWE-121 Description: IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250473
CVE ID: CVE-2024-47119 State: PUBLISHED Published: 2024-12-18T15:23:43.333Z Last Updated: 2024-12-18T16:00:34.268Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Storage Defender - Resiliency Service Problem Types: CWE-295 Description: IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7178587
CVE ID: CVE-2024-47120 State: PUBLISHED Published: 2025-09-10T20:04:19.307Z Last Updated: 2025-09-13T03:55:37.145Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Information Queue Problem Types: CWE-250 Description: IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a privileged user to escalate their privileges and attack surface on the host due to the containers running with unnecessary privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244514
CVE ID: CVE-2024-47121 State: PUBLISHED Published: 2024-09-26T17:18:03.228Z Last Updated: 2025-05-02T16:25:19.846Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: goTenna Products: Pro Problem Types: CWE-521 Description: The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is recommended to
icular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is recommended to use local QR encryption key sharing for additional security on this and previous versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
CVE ID: CVE-2024-47122 State: PUBLISHED Published: 2024-09-26T17:19:17.877Z Last Updated: 2024-10-17T17:23:41.981Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: goTenna Products: Pro Problem Types: CWE-922 Description: In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). This allows for complete decryption of keys stored on the EUD if physically compromised. This allows an attacker to decrypt all encrypted broadcast communications based on encryption keys stored on the EUD. This requires access to and control of the EUD, so it is recommended to use strong access control measures and layered encryption
res access to and control of the EUD, so it is recommended to use strong access control measures and layered encryption on the EUD for more secure operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
CVE ID: CVE-2024-47123 State: PUBLISHED Published: 2024-09-26T17:20:26.885Z Last Updated: 2024-11-21T16:57:33.110Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: goTenna Products: Pro Problem Types: CWE-353 Description: The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is recommended to continue to use encryption in the app and update to the current release for more secure operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/ics
ns. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
CVE ID: CVE-2024-47124 State: PUBLISHED Published: 2024-09-26T17:21:29.975Z Last Updated: 2024-10-17T17:28:21.392Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: goTenna Products: Pro Problem Types: CWE-319 Description: The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using this and previous versions of the app and update your app to the current app version which uses AES-256 encryption for callsigns in encrypted operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
CVE ID: CVE-2024-47125 State: PUBLISHED Published: 2024-09-26T17:24:20.173Z Last Updated: 2024-10-17T17:30:55.944Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: goTenna Products: Pro Problem Types: CWE-923 Description: The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to update your app to the current release for enhanced encryption protocols. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
CVE ID: CVE-2024-47126 State: PUBLISHED Published: 2024-09-26T17:26:26.643Z Last Updated: 2024-10-17T17:33:31.127Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: goTenna Products: Pro Problem Types: CWE-338 Description: The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations. Additional Analyst Notes: - CISA ADP Vulnrichment
ed to share the key with local QR code for higher security operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
CVE ID: CVE-2024-47127 State: PUBLISHED Published: 2024-09-26T17:27:35.188Z Last Updated: 2024-10-17T17:35:50.706Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: goTenna Products: Pro Problem Types: CWE-1390 Description: In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised. It is advised to share encryption keys via QR scanning for higher security operations and update your app
n compromised. It is advised to share encryption keys via QR scanning for higher security operations and update your app to the current release for enhanced encryption protocols. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
CVE ID: CVE-2024-47128 State: PUBLISHED Published: 2024-09-26T17:28:32.604Z Last Updated: 2024-10-17T17:37:51.475Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: goTenna Products: Pro Problem Types: CWE-201 Description: The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
CVE ID: CVE-2024-47129 State: PUBLISHED Published: 2024-09-26T17:30:12.759Z Last Updated: 2024-10-17T17:40:06.968Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: goTenna Products: Pro Problem Types: CWE-204 Description: The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
CVE ID: CVE-2024-47130 State: PUBLISHED Published: 2024-09-26T17:30:52.751Z Last Updated: 2024-10-17T17:42:43.163Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: goTenna Products: Pro Problem Types: CWE-306 Description: The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advised to update your app to the current release for enhanced encryption protocols. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04