Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-41870 State: PUBLISHED Published: 2024-09-13T07:00:18.197Z Last Updated: 2024-09-13T14:07:04.532Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Media Encoder Problem Types: CWE-125 Description: Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products
licious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/media-encoder/apsb24-53.html
CVE ID: CVE-2024-41871 State: PUBLISHED Published: 2024-09-13T07:00:17.433Z Last Updated: 2024-12-12T17:26:59.468Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Media Encoder Problem Types: CWE-125 Description: Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products
CVE ID: CVE-2024-41872 State: PUBLISHED Published: 2024-09-13T07:00:19.793Z Last Updated: 2024-09-13T14:03:01.462Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Media Encoder Problem Types: CWE-125 Description: Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products
CVE ID: CVE-2024-41873 State: PUBLISHED Published: 2024-09-13T07:00:16.657Z Last Updated: 2024-09-13T14:10:07.362Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Media Encoder Problem Types: CWE-125 Description: Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products
CVE ID: CVE-2024-41874 State: PUBLISHED Published: 2024-09-13T09:18:03.226Z Last Updated: 2024-09-16T12:56:15.061Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Adobe Products: ColdFusion Problem Types: CWE-502 Description: ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which when deserialized, leads to execution of malicious code. Exploitation of this issue does not require user interaction. Additional Analyst Notes:
to execution of malicious code. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb24-71.html
CVE ID: CVE-2024-41875 State: PUBLISHED Published: 2024-08-23T16:53:42.893Z Last Updated: 2024-10-07T12:29:31.003Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/secur
CVE ID: CVE-2024-41876 State: PUBLISHED Published: 2024-08-23T16:53:39.045Z Last Updated: 2024-10-07T13:18:48.377Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager
CVE ID: CVE-2024-41877 State: PUBLISHED Published: 2024-08-23T16:53:37.545Z Last Updated: 2024-10-07T12:30:42.895Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/secur
ing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html
CVE ID: CVE-2024-41878 State: PUBLISHED Published: 2024-08-23T16:53:36.032Z Last Updated: 2024-10-07T12:30:10.349Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Additional Analyst Notes: - CISA ADP Vulnrichment:
teraction, such as convincing a victim to click on a malicious link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html
CVE ID: CVE-2024-41879 State: PUBLISHED Published: 2024-08-26T12:01:24.403Z Last Updated: 2024-08-26T15:18:22.423Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-787 Description: Acrobat Reader versions 127.0.2651.105 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-41879
CVE ID: CVE-2024-41880 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-08-02T04:46:52.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and private routes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/veilid/veilid/-/issues/395
CVE ID: CVE-2024-41881 State: PUBLISHED Published: 2024-07-29T08:39:25.832Z Last Updated: 2024-08-02T04:46:52.953Z Vendors: Philip Hazel Products: SDoP Problem Types: Stack-based buffer overflow Description: SDoP versions prior to 1.11 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted XML file, arbitrary code may be executed on the user's environment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/PhilipHazel/SDoP - https://github.com/PhilipHazel/SDoP/commit/ff83d851b4b39ff2fd37
ner: References: - https://github.com/PhilipHazel/SDoP - https://github.com/PhilipHazel/SDoP/commit/ff83d851b4b39ff2fd37ab2ab14365649515b023 - https://jvn.jp/en/jp/JVN16420523/
CVE ID: CVE-2024-41882 State: PUBLISHED Published: 2024-12-24T05:35:11.310Z Last Updated: 2025-10-01T01:55:06.444Z Vendors: Hanwha Vision Co., Ltd. Products: XRN-420S Problem Types: CWE-121 Description: Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker can cause a stack overflow by entering large data into URL parameters, which will result in a system reboot. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR-Vulnerability-Re
tes: - CISA ADP Vulnrichment: References: - https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR-Vulnerability-Report-CVE-2024-4188241887.pdf
CVE ID: CVE-2024-41883 State: PUBLISHED Published: 2024-12-24T05:32:41.711Z Last Updated: 2024-12-24T15:23:56.758Z Vendors: Hanwha Vision Co., Ltd. Products: XRN-420S Problem Types: CWE-476 Description: Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR . An attacker enters a special value for a specific URL parameter, resulting in a NULL pointer reference and a reboot of the NVR. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR-Vulnerab
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR-Vulnerability-Report-CVE-2024-4188241887.pdf
CVE ID: CVE-2024-41884 State: PUBLISHED Published: 2024-12-24T05:30:41.603Z Last Updated: 2024-12-24T15:24:24.167Z Vendors: Hanwha Vision Co., Ltd. Products: XRN-420S Problem Types: CWE-476 Description: Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. If an attacker does not enter any value for a specific URL parameter, NULL pointer references will occur and the NVR will reboot. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR-Vulnera
nalyst Notes: - CISA ADP Vulnrichment: References: - https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR-Vulnerability-Report-CVE-2024-4188241887.pdf
CVE ID: CVE-2024-41885 State: PUBLISHED Published: 2024-12-24T05:27:39.718Z Last Updated: 2025-10-01T01:56:42.604Z Vendors: Hanwha Vision Co., Ltd. Products: XRN-420S Problem Types: CWE-547 Description: Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. The seed string for the encrypt key was hardcoding. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR-Vulnerability-Report-CVE-2024-4188241887.pdf
CVE ID: CVE-2024-41886 State: PUBLISHED Published: 2024-12-24T05:23:52.078Z Last Updated: 2025-10-01T01:48:38.916Z Vendors: Hanwha Vision Co., Ltd. Products: XRN-420S Problem Types: CWE-755 Description: Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker could inject malformed data into url input parameters to reboot the NVR. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR-Vulnerability-Report-CVE-2024-4188241887.pdf
CVE ID: CVE-2024-41887 State: PUBLISHED Published: 2024-12-24T05:20:40.653Z Last Updated: 2025-10-01T01:52:22.963Z Vendors: Hanwha Vision Co., Ltd. Products: XRN-420S Problem Types: CWE-22 Description: Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker can create an NVR log file in a directory one level higher on the system, which can be used to corrupt files in the directory. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR-Vulnerability-Report-CVE-2024-4188241887.pdf
CVE ID: CVE-2024-41888 State: PUBLISHED Published: 2024-08-09T14:55:14.493Z Last Updated: 2025-03-13T19:53:24.691Z Vendors: Apache Software Foundation Products: Apache Answer Problem Types: CWE-772 Description: Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thr
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4
CVE ID: CVE-2024-41889 State: PUBLISHED Published: 2024-08-05T04:36:27.107Z Last Updated: 2024-08-07T18:43:04.676Z Vendors: Pimax Products: Pimax Play, PiTool Problem Types: Improper restriction of communication channel to intended endpoints Description: Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pimax.com/pages/downloads-manuals - https://github.com/OpenMAR/PiTool - https://jvn.jp/en/jp/JVN50850706/
CVE ID: CVE-2024-41890 State: PUBLISHED Published: 2024-08-09T14:53:28.544Z Last Updated: 2025-03-13T18:27:24.551Z Vendors: Apache Software Foundation Products: Apache Answer Problem Types: CWE-772 Description: Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.ap
es the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/j7c080xj31x8rvz1pyk2h47rdd9pwbv9
CVE ID: CVE-2024-41902 State: PUBLISHED Published: 2024-10-08T08:40:18.170Z Last Updated: 2024-10-08T18:03:27.584Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: JT2Go Problem Types: CWE-121 Description: A vulnerability has been identified in JT2Go (All versions < V2406.0003). The affected application contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-626178.html
CVE ID: CVE-2024-41903 State: PUBLISHED Published: 2024-08-13T07:54:22.465Z Last Updated: 2024-08-13T14:22:58.678Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-269 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application mounts the container's root filesystem with read and write privileges. This could allow an attacker to alter the container's filesystem leading to unauthorized modifications and data corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/pro
nd data corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-716317.html
CVE ID: CVE-2024-41904 State: PUBLISHED Published: 2024-08-13T07:54:23.788Z Last Updated: 2024-08-13T14:25:30.856Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-307 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not properly enforce restriction of excessive authentication attempts. This could allow an unauthenticated attacker to conduct brute force attacks against legitimate user credentials or keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/produ
dentials or keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-716317.html
CVE ID: CVE-2024-41905 State: PUBLISHED Published: 2024-08-13T07:54:25.056Z Last Updated: 2024-08-13T13:25:25.882Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-284 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not have access control for accessing the files. This could allow an authenticated attacker with low privilege's to get access to sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-716317.html
CVE ID: CVE-2024-41906 State: PUBLISHED Published: 2024-08-13T07:54:26.385Z Last Updated: 2024-08-14T17:46:26.134Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-524 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not properly handle cacheable HTTP responses in the web service. This could allow an attacker to read and modify data stored in the local cache. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-716317.html
CVE ID: CVE-2024-41907 State: PUBLISHED Published: 2024-08-13T07:54:27.688Z Last Updated: 2024-08-13T17:52:23.314Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-358 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application is missing general HTTP security headers in the web server. This could allow an attacker to make the servers more prone to clickjacking attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-716317.html
CVE ID: CVE-2024-41908 State: PUBLISHED Published: 2024-08-13T07:54:28.985Z Last Updated: 2024-08-13T13:49:49.818Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: NX Problem Types: CWE-125 Description: A vulnerability has been identified in NX (All versions < V2406.3000). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-357412.html
CVE ID: CVE-2024-41909 State: PUBLISHED Published: 2024-08-12T16:00:29.568Z Last Updated: 2025-03-27T15:31:20.659Z Vendors: Apache Software Foundation Products: Apache MINA SSHD Problem Types: CWE-354 Description: Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.
r disabled, aka a Terrapin attack The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/mina-sshd/issues/445 - https://lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b
CVE ID: CVE-2024-41910 State: PUBLISHED Published: 2024-08-06T14:05:28.473Z Last Updated: 2025-03-14T16:06:19.571Z Vendors: HP Inc. Products: Poly Clariti Manager Description: A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware contained multiple XSS vulnerabilities in the version of JavaScript used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11006981-11007005-16/hpsbpy03960
CVE ID: CVE-2024-41911 State: PUBLISHED Published: 2024-08-06T14:07:33.637Z Last Updated: 2024-10-28T20:23:13.420Z Vendors: HP Inc. Products: Poly Clariti Manager Description: A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11006770-11006795-16/hpsbpy03959
CVE ID: CVE-2024-41912 State: PUBLISHED Published: 2024-08-07T19:54:47.266Z Last Updated: 2025-03-13T20:26:13.846Z Vendors: HP Inc. Products: Poly Clariti Manager Description: A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11006235-11006266-16/hpsbpy03958