Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-21988 State: PUBLISHED Published: 2024-06-14T21:37:46.450Z Last Updated: 2024-11-12T20:02:20.694Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: NetApp Products: StorageGRID (formerly StorageGRID Webscale) Problem Types: 321 Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM attacks due to a vulnerability in the SSH cryptographic implementation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20240614-0010/
CVE ID: CVE-2024-21989 State: PUBLISHED Published: 2024-04-17T19:32:34.598Z Last Updated: 2024-08-01T22:35:34.729Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: NetApp Products: ONTAP Select Deploy administration utility Problem Types: CWE-269 Description: ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x are susceptible to a vulnerability which when successfully exploited could allow a read-only user to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20240411-0001/
CVE ID: CVE-2024-21990 State: PUBLISHED Published: 2024-04-17T19:35:23.599Z Last Updated: 2024-08-01T22:35:34.847Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: NetApp Products: ONTAP Select Deploy administration utility Problem Types: CWE-259 Description: ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration information and modify the account credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20240411-0002/
CVE ID: CVE-2024-21993 State: PUBLISHED Published: 2024-07-09T21:26:03.404Z Last Updated: 2025-03-27T15:41:35.222Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: NetApp Products: SnapCenter Problem Types: 313 Description: SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability which could allow an authenticated attacker to discover plaintext credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20240705-0007/
CVE ID: CVE-2024-21994 State: PUBLISHED Published: 2024-11-08T21:06:32.380Z Last Updated: 2024-11-09T15:52:48.138Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: NetApp Products: StorageGRID Problem Types: 789 Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authenticated attacker could lead to a service crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/ntap-20241108-0001/
CVE ID: CVE-2024-22002 State: PUBLISHED Published: 2024-06-18T00:00:00 Last Updated: 2024-08-01T22:35:34.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the installation directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://twitter.com/0xkickit - https://github.com/0xkickit/iCUE_DllHijack_LPE-CVE-2024-22002
CVE ID: CVE-2024-22004 State: PUBLISHED Published: 2024-04-05T18:03:23.151Z Last Updated: 2024-08-01T22:35:34.683Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Google Products: Nest Wifi Pro Problem Types: CWE-125 Description: Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a vulnerability and leak the secure memory from the Trusted Application Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.google.com/product-documentation/answer/14580222?hl=en&ref_topic=12974021&sjid=10751611047462550096-NA
CVE ID: CVE-2024-22005 State: PUBLISHED Published: 2024-03-11T18:55:34.794Z Last Updated: 2024-08-27T14:50:49.938Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-22006 State: PUBLISHED Published: 2024-03-11T18:55:34.950Z Last Updated: 2024-11-06T17:15:15.954Z Vendors: Google Products: Android Problem Types: Information disclosure Description: OOB read in the TMU plugin that allows for memory disclosure in the power management subsystem of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-22007 State: PUBLISHED Published: 2024-03-11T18:55:35.107Z Last Updated: 2024-11-01T19:32:58.475Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In constraint_check of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-22008 State: PUBLISHED Published: 2024-03-11T18:55:35.260Z Last Updated: 2025-04-16T15:45:37.989Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In config_gov_time_windows of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-22009 State: PUBLISHED Published: 2024-03-11T18:55:35.419Z Last Updated: 2024-08-14T20:13:54.792Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In init_data of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-22010 State: PUBLISHED Published: 2024-03-11T18:55:35.566Z Last Updated: 2024-11-05T16:46:52.354Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In dvfs_plugin_caller of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-22011 State: PUBLISHED Published: 2024-03-11T18:55:35.717Z Last Updated: 2025-03-26T21:13:25.879Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In ss_ProcessRejectComponent of ss_MmConManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-22012 State: PUBLISHED Published: 2024-02-07T15:49:18.359Z Last Updated: 2025-05-08T18:49:27.175Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-02-01
CVE ID: CVE-2024-22013 State: PUBLISHED Published: 2024-09-16T19:52:33.764Z Last Updated: 2024-11-06T21:06:31.169Z Vendors: Google Products: Nest Wifi Pro Problem Types: Elevation of privilege Description: U-Boot environment is read from unauthenticated partition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.google.com/product-documentation/answer/14950962?hl=en&ref_topic=12974021&sjid=9595902703262170957-NA#zippy=%2Cwifi
CVE ID: CVE-2024-22014 State: PUBLISHED Published: 2024-04-15T00:00:00.000Z Last Updated: 2025-03-13T19:54:44.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via Symbolic Link Follow to Arbitrary File Delete. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mansk1es/CVE_360TS
CVE ID: CVE-2024-22015 State: PUBLISHED Published: 2024-05-16T20:47:36.565Z Last Updated: 2024-08-01T22:35:34.827Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) DLB driver software Problem Types: denial of service, CWE-20 Description: Improper input validation for some Intel(R) DLB driver software before version 8.5.0 may allow an authenticated user to potentially denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00996.html
CVE ID: CVE-2024-22016 State: PUBLISHED Published: 2024-02-01T23:19:59.311Z Last Updated: 2024-11-08T15:43:45.266Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Rapid Software LLC Products: Rapid SCADA Problem Types: CWE-732 Description: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03 - https://rapidscada.org/contact/
CVE ID: CVE-2024-22017 State: PUBLISHED Published: 2024-03-19T04:32:34.137Z Last Updated: 2025-04-30T22:25:14.211Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L) Vendors: NodeJS Products: Node Description: setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.
Node.js 21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2170226 - http://www.openwall.com/lists/oss-security/2024/03/11/1 - https://security.netapp.com/advisory/ntap-20240517-0007/
CVE ID: CVE-2024-22018 State: PUBLISHED Published: 2024-07-10T01:00:12.747Z Last Updated: 2025-04-30T22:25:19.795Z Severity: LOW (CVSS 2.9 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: NodeJS Products: Node Description: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Plea
cess to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2145862 - http://www.openwall.com/lists/oss-security/2024/07/11/6 - http://www.openwall.com/lists/oss-security/2024/07/19/3
CVE ID: CVE-2024-22019 State: PUBLISHED Published: 2024-02-20T01:31:08.092Z Last Updated: 2025-11-04T16:11:10.950Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: NodeJS Products: Node Description: A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits. Additional Analyst Notes: - CI
k bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2233486 - https://security.netapp.com/advisory/ntap-20240315-0004/ - http://www.openwall.com/lists/oss-security/2024/03/11/1
CVE ID: CVE-2024-22020 State: PUBLISHED Published: 2024-07-09T01:07:28.098Z Last Updated: 2025-04-30T22:25:20.702Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: NodeJS Products: Node Description: A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
curity, posing a risk to developers and servers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2092749 - http://www.openwall.com/lists/oss-security/2024/07/11/6 - http://www.openwall.com/lists/oss-security/2024/07/19/3
CVE ID: CVE-2024-22021 State: PUBLISHED Published: 2024-02-07T00:53:30.493Z Last Updated: 2025-06-05T16:13:58.954Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Veeam Products: Recovery Orchestrator , Disaster Recovery Orchestrator, Availability Orchestrator, Recovery Orchestrator Description: Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://veeam.com/kb4541
CVE ID: CVE-2024-22022 State: PUBLISHED Published: 2024-02-07T00:53:30.523Z Last Updated: 2025-06-03T18:40:07.375Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/CR:X/IR:X/AR:X) Vendors: Veeam Products: Recovery Orchestrator, Availability Orchestrator Description: Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://veeam.com/kb4541
CVE ID: CVE-2024-22023 State: PUBLISHED Published: 2024-04-04T19:45:10.162Z Last Updated: 2024-10-03T21:38:58.416Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Ivanti Products: Connect Secure, Policy Secure Description: An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Ove
ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
CVE ID: CVE-2024-22024 State: PUBLISHED Published: 2024-02-13T04:07:04.355Z Last Updated: 2025-05-09T18:26:09.386Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Ivanti, Ivant Products: ICS, IPS Description: An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
CVE ID: CVE-2024-22025 State: PUBLISHED Published: 2024-03-19T04:32:34.211Z Last Updated: 2025-11-04T16:11:11.894Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: NodeJS Products: Node Description: A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit
exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2284065 - https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html - https://security.netapp.com/advisory/ntap-20240517-0008/
CVE ID: CVE-2024-22026 State: PUBLISHED Published: 2024-05-22T22:55:11.219Z Last Updated: 2025-03-13T16:58:21.399Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: EPMM Description: A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US
CVE ID: CVE-2024-22027 State: PUBLISHED Published: 2024-01-12T06:41:29.452Z Last Updated: 2025-06-05T18:21:22.928Z Vendors: AYS Pro Plugins Products: WordPress Quiz Maker Plugin Problem Types: Improper input validation Description: Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/quiz-maker/ - https://jvn.jp/en/jp/JVN37326856/
CVE ID: CVE-2024-22028 State: PUBLISHED Published: 2024-01-15T06:53:27.089Z Last Updated: 2025-06-03T14:01:12.809Z Vendors: THREE R SOLUTION CORP. JAPAN Products: 3R-TMC01, 3R-TMC02, 3R-TMC03, 3R-TMC04, 3R-TMC05, 3R-TMC06 Problem Types: Insufficient verification of data authenticity Description: Insufficient technical documentation issue exists in thermal camera TMC series all firmware versions. The user of the affected product is not aware of the internally saved data. By accessing the affected product physically, an attacker may retrieve the internal data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://3rrr-btob.jp/archives/news/23624 - ht
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://3rrr-btob.jp/archives/news/23624 - https://jvn.jp/en/jp/JVN96240417/
CVE ID: CVE-2024-22029 State: PUBLISHED Published: 2024-10-16T13:20:47.698Z Last Updated: 2025-08-26T20:18:11.916Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122, SUSE Enterprise Storage 7.1, SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS, SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS, SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS, SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS, SUSE Linux Enterprise High Performance Computing 15 SP5, SUSE Linux Enterprise Module for Web and Scripting 15 SP5, SUSE Linux Enterprise Server 15 SP5,
rmance Computing 15 SP5, SUSE Linux Enterprise Module for Web and Scripting 15 SP5, SUSE Linux Enterprise Server 15 SP5, SUSE Linux Enterprise Server for SAP Applications 15 SP5, SUSE Linux Enterprise High Performance Computing 15 SP6, SUSE Linux Enterprise Module for Web and Scripting 15 SP6, SUSE Linux Enterprise Server 15 SP6, SUSE Linux Enterprise Server for SAP Applications 15 SP6, SUSE Linux Enterprise Server 15 SP2-LTSS, SUSE Linux Enterprise Server 15 SP3-LTSS, SUSE Linux Enterprise Server 15 SP4-LTSS, SUSE Linux Enterprise Server for SAP Applications 15 SP2, SUSE Linux Enterprise Server for SAP Applications 15 SP3, SUSE Linux Enterprise Server for SAP Applications 15 SP4, SUSE Manag
inux Enterprise Server for SAP Applications 15 SP3, SUSE Linux Enterprise Server for SAP Applications 15 SP4, SUSE Manager Server 4.3, openSUSE Leap 15.5, openSUSE Tumbleweed Problem Types: CWE-732 Description: Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22029
CVE ID: CVE-2024-22030 State: PUBLISHED Published: 2024-10-16T13:24:06.944Z Last Updated: 2024-10-16T14:25:43.445Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: rancher Problem Types: CWE-295 Description: A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The targeted domain is the one used as the Rancher URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug
as the Rancher URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22030 - https://github.com/rancher/rancher/security/advisories/GHSA-h4h5-9833-v2p4