Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5933 State: PUBLISHED Published: 2024-06-27T18:46:17.563Z Last Updated: 2024-08-01T21:25:03.177Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-79 Description: A Cross-site Scripting (XSS) vulnerability exists in the chat functionality of parisneo/lollms-webui in the latest version. This vulnerability allows an attacker to inject malicious scripts via chat messages, which are then executed in the context of the user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/51a2e370-3b64-45cd-9afc-0e4856ab5517
CVE ID: CVE-2024-5934 State: REJECTED Published: N/A Last Updated: 2024-06-14T15:17:03.384Z Description: No description available.
CVE ID: CVE-2024-5935 State: PUBLISHED Published: 2024-06-27T18:45:51.085Z Last Updated: 2024-08-01T21:25:03.181Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: imartinez Products: imartinez/privategpt Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/b374f1c9-fa25-4b52-a34d-5153afd5a295
CVE ID: CVE-2024-5936 State: PUBLISHED Published: 2024-06-27T18:45:31.598Z Last Updated: 2024-08-01T21:25:03.038Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: imartinez Products: imartinez/privategpt Problem Types: CWE-601 Description: An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerability includes potential phishing attacks, malware distribution, and credential theft. Additional Analyst Notes: - CISA ADP Vulnrichm
s potential phishing attacks, malware distribution, and credential theft. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/43f05c1e-d7b8-45e2-b1fe-48faf1e3a48d
CVE ID: CVE-2024-5937 State: PUBLISHED Published: 2024-07-09T08:33:09.583Z Last Updated: 2024-08-01T21:25:03.283Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mardojai Products: Simple Alert Boxes Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Alert Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert shortcode in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above,
n user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a25ad405-a97e-4821-b57a-0f39d5ce5e70?source=cve - https://plugins.trac.wordpress.org/browser/simple-alert-boxes/trunk/plugin.php#L71
CVE ID: CVE-2024-5938 State: PUBLISHED Published: 2024-07-02T02:02:11.049Z Last Updated: 2024-08-01T21:25:03.186Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sur Products: Boot Store Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary w
ping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8256b8e4-f8c5-4feb-b6e4-668ed3b6fccd?source=cve - https://themes.trac.wordpress.org/browser/boot-store/1.6.4/admin/bootstrap-shortcode.php#L63
CVE ID: CVE-2024-5939 State: PUBLISHED Published: 2024-08-20T02:03:17.549Z Last Updated: 2024-09-03T15:15:52.828Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: webdevmattcrom Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-862 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the setup wizard administrative pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
attackers to read the setup wizard administrative pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a104f88b-deae-465d-b4c1-9a1fc78e5ee9?source=cve - https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/Onboarding/Wizard/Page.php#L78 - https://plugins.trac.wordpress.org/changeset/3120745/
CVE ID: CVE-2024-5940 State: PUBLISHED Published: 2024-08-20T02:03:19.791Z Last Updated: 2024-08-20T14:14:49.953Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: webdevmattcrom Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-862 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled. Additional Analyst Notes: - CISA
nticated attackers to edit event ticket settings if the Events beta feature is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3cda8d0-321c-4b15-980e-5ebf49fac367?source=cve - https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/EventTickets/Routes/UpdateEvent.php#L81 - https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/EventTickets/Routes/UpdateEventTicketType.php#L78 - https://plugins.trac.wordpress.org/changeset/3120745/
CVE ID: CVE-2024-5941 State: PUBLISHED Published: 2024-08-20T02:03:14.586Z Last Updated: 2024-08-20T19:50:20.949Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: webdevmattcrom Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-862 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read attachment paths and delete attachment files. A
authenticated attackers, with Subscriber-level access and above, to read attachment paths and delete attachment files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/824ec2ba-b701-46e9-b237-53cd7d0e46da?source=cve - https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/DonorDashboards/Tabs/EditProfileTab/AvatarRoute.php#L36 - https://plugins.trac.wordpress.org/changeset/3132247/
CVE ID: CVE-2024-5942 State: PUBLISHED Published: 2024-06-29T04:33:27.112Z Last Updated: 2024-08-01T21:25:03.191Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: carlosfazenda Products: Page and Post Clone Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to clone and read private posts. Additional Analyst Notes: - CISA
ticated attackers, with Author-level access and above, to clone and read private posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=cve - https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L19 - https://plugins.trac.wordpress.org/changeset/3108149/
CVE ID: CVE-2024-5943 State: PUBLISHED Published: 2024-07-04T11:34:05.170Z Last Updated: 2024-08-01T21:25:03.110Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: kylephillips Products: Nested Pages Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due to missing or incorrect nonce validation on the 'settingsPage' function and missing santization of the 'tab' parameter. This makes it possible for unauthenticated attackers to call local php files via a forged request granted they can trick a site administrator
e for unauthenticated attackers to call local php files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2663150-61f9-49e3-9219-fbe89cc6b03c?source=cve - https://plugins.trac.wordpress.org/browser/wp-nested-pages/trunk/app/Config/Settings.php#L129 - https://plugins.trac.wordpress.org/browser/wp-nested-pages/trunk/app/Views/settings/settings.php#L20 - https://plugins.trac.wordpress.org/changeset/3111847/
CVE ID: CVE-2024-5945 State: PUBLISHED Published: 2024-06-21T07:39:58.068Z Last Updated: 2024-08-01T21:25:03.181Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shortpixel Products: WP SVG Images Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissions to upload sanitized files, to bypass SVG sanitiza
ed attackers, with Author-level access and above, who have permissions to upload sanitized files, to bypass SVG sanitization and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/389d96e9-1fad-49a6-89b6-8f7f108d8117?source=cve - https://plugins.trac.wordpress.org/browser/wp-svg-images/trunk/wp-svg-images.php#L111 - https://plugins.trac.wordpress.org/browser/wp-svg-images/trunk/wp-svg-images.php#L313 - https://plugins.trac.wordpress.org/changeset/3105276/
CVE ID: CVE-2024-5946 State: PUBLISHED Published: 2024-07-09T11:02:40.613Z Last Updated: 2024-08-01T21:25:03.232Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: squelch Products: Squelch Tabs and Accordions Shortcodes Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tab’ shortcode in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and abov
tization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/33f63bd9-3031-40e8-b72e-1cbbcce5b782?source=cve - https://plugins.trac.wordpress.org/browser/squelch-tabs-and-accordions-shortcodes/trunk/squelch-tabs-and-accordions.php#L455 - https://plugins.trac.wordpress.org/changeset/3114198/
CVE ID: CVE-2024-5947 State: PUBLISHED Published: 2024-06-13T19:40:45.549Z Last Updated: 2024-08-01T21:25:03.179Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Deep Sea Electronics Products: DSE855 Problem Types: CWE-306 Description: Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior
vulnerability. The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22679. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-671/
CVE ID: CVE-2024-5948 State: PUBLISHED Published: 2024-06-13T19:40:40.871Z Last Updated: 2024-08-01T21:25:03.230Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Deep Sea Electronics Products: DSE855 Problem Types: CWE-121 Description: Deep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of multipart boundaries. The issue results from the lack of proper v
ility. The specific flaw exists within the handling of multipart boundaries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23170. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-672/
CVE ID: CVE-2024-5949 State: PUBLISHED Published: 2024-06-13T19:40:32.594Z Last Updated: 2024-08-01T21:25:03.222Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Deep Sea Electronics Products: DSE855 Problem Types: CWE-835 Description: Deep Sea Electronics DSE855 Multipart Boundary Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of multipart boundaries. The issue results from a logic error that can
ity. The specific flaw exists within the handling of multipart boundaries. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23171. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-673/
CVE ID: CVE-2024-5950 State: PUBLISHED Published: 2024-06-13T19:40:28.222Z Last Updated: 2024-08-01T21:25:03.210Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Deep Sea Electronics Products: DSE855 Problem Types: CWE-121 Description: Deep Sea Electronics DSE855 Multipart Value Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of multipart form variables. The issue results from the lack o
lnerability. The specific flaw exists within the handling of multipart form variables. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23172. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-674/
CVE ID: CVE-2024-5951 State: PUBLISHED Published: 2024-06-13T19:40:23.659Z Last Updated: 2024-08-01T21:25:03.168Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Deep Sea Electronics Products: DSE855 Problem Types: CWE-306 Description: Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to
ific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23173. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-675/
CVE ID: CVE-2024-5952 State: PUBLISHED Published: 2024-06-13T19:40:19.388Z Last Updated: 2024-08-01T21:25:02.972Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Deep Sea Electronics Products: DSE855 Problem Types: CWE-306 Description: Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to func
flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23174. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-676/
CVE ID: CVE-2024-5953 State: PUBLISHED Published: 2024-06-18T10:01:56.714Z Last Updated: 2025-11-06T23:15:48.251Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 for RHEL 8, Red Hat Directory Server 11.9 for RHEL 8, Red Hat Directory Server 12.2 EUS for RHEL 9, Red Hat Directory Server 12.4 for RHEL 9, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise L
erprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 Problem Types: CWE-1288 Description: A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:4633 - https://access.redhat.com/errata/RHSA-2024:4997 - https://access.redhat.com/errata/RHSA-2024:5192 - https://access.redhat.com/errata/RHSA-2024:5690 - https://acc
4:4997 - https://access.redhat.com/errata/RHSA-2024:5192 - https://access.redhat.com/errata/RHSA-2024:5690 - https://access.redhat.com/errata/RHSA-2024:6153 - https://access.redhat.com/errata/RHSA-2024:6568 - https://access.redhat.com/errata/RHSA-2024:6569 - https://access.redhat.com/errata/RHSA-2024:6576 - https://access.redhat.com/errata/RHSA-2024:7458 - https://access.redhat.com/errata/RHSA-2025:1632 - https://access.redhat.com/security/cve/CVE-2024-5953 - https://bugzilla.redhat.com/show_bug.cgi?id=2292104
CVE ID: CVE-2024-5955 State: PUBLISHED Published: 2024-12-20T05:53:28.886Z Last Updated: 2024-12-20T17:37:43.395Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Trellix Products: ePO Onprem Sp1 Update4 Problem Types: CWE-79 Description: Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft requests causing arbitrary content to be injected into the response when accessing the epolicy Orchestrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thrive.trellix.com/s/article/000014118
CVE ID: CVE-2024-5956 State: PUBLISHED Published: 2024-09-05T10:42:09.315Z Last Updated: 2024-09-05T13:13:04.061Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Trellix Products: Intrusion Prevention System (IPS) Manager Problem Types: CWE-305 Description: This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with garbage data in response mostly Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thrive.trellix.com/s/article/000013870
CVE ID: CVE-2024-5957 State: PUBLISHED Published: 2024-09-05T10:49:38.276Z Last Updated: 2024-09-05T13:11:11.676Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Trellix Products: Intrusion Prevention System (IPS) Manager Problem Types: CWE-305 Description: This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thrive.trellix.com/s/article/000013870
CVE ID: CVE-2024-5958 State: PUBLISHED Published: 2024-09-18T14:42:04.465Z Last Updated: 2024-09-18T16:06:36.377Z Vendors: Eliz Software Products: Panel Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection.This issue affects Panel: before v2.3.24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1497