Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-50368 State: PUBLISHED Published: 2024-11-26T10:55:16.384Z Last Updated: 2024-11-26T14:19:26.687Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "basic_htm" API which are not properly sanitized before being
nerability relies on multiple parameters belonging to the "basic_htm" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50368
CVE ID: CVE-2024-50369 State: PUBLISHED Published: 2024-11-26T10:55:29.755Z Last Updated: 2024-11-26T14:19:26.553Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "multiple_ssid_htm" API which are not properly sanitized befor
nerability relies on multiple parameters belonging to the "multiple_ssid_htm" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50369
CVE ID: CVE-2024-50370 State: PUBLISHED Published: 2024-11-26T10:55:45.151Z Last Updated: 2024-11-26T14:19:26.395Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on
can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "cfg_cmd_set_eth_conf" operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50370
CVE ID: CVE-2024-50371 State: PUBLISHED Published: 2024-11-26T10:55:58.526Z Last Updated: 2024-11-26T14:19:26.231Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on
can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "wlan_scan" operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50371
CVE ID: CVE-2024-50372 State: PUBLISHED Published: 2024-11-26T10:56:08.644Z Last Updated: 2024-11-26T14:19:26.080Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on
can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "backup_config_to_utility" operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50372
CVE ID: CVE-2024-50373 State: PUBLISHED Published: 2024-11-26T10:56:18.987Z Last Updated: 2024-11-26T14:19:25.933Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on
can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "restore_config_from_utility" operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50373
CVE ID: CVE-2024-50374 State: PUBLISHED Published: 2024-11-26T10:56:28.680Z Last Updated: 2024-11-26T14:19:25.792Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on
can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "capture_packages" operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50374
CVE ID: CVE-2024-50375 State: PUBLISHED Published: 2024-11-26T10:57:03.468Z Last Updated: 2024-11-26T14:19:25.629Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point. Additional Analyst Notes:
sers capable of interacting with the default "edgserver" service enabled on the access point. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50375
CVE ID: CVE-2024-50376 State: PUBLISHED Published: 2024-11-26T10:57:14.296Z Last Updated: 2024-11-26T14:09:22.624Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-79 "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited remotely leveraging a rogue Wi-Fi access point with a malicious SSID. Additional Analyst Notes: - CISA ADP Vulnr
ploited remotely leveraging a rogue Wi-Fi access point with a malicious SSID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50376
CVE ID: CVE-2024-50377 State: PUBLISHED Published: 2024-11-26T10:57:27.054Z Last Updated: 2024-11-26T14:19:25.481Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability is associated to the backup configuration functionality that by default encrypts the archives using a static password. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
by default encrypts the archives using a static password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50377
CVE ID: CVE-2024-50378 State: PUBLISHED Published: 2024-11-08T14:37:09.699Z Last Updated: 2024-11-08T19:02:35.081Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-201 Description: Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users w
audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/airflow/pull/43123 - https://lists.apache.org/thread/17rxys384lzfd6nhm3fztzgvk47zy7jb
CVE ID: CVE-2024-50379 State: PUBLISHED Published: 2024-12-17T12:34:54.827Z Last Updated: 2025-11-03T20:45:15.148Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-367 Description: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL v
ersions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
CVE ID: CVE-2024-50380 State: PUBLISHED Published: 2024-12-02T16:34:07.745Z Last Updated: 2024-12-02T18:30:33.246Z Vendors: Snap One Products: OVRC cloud Problem Types: CWE-290 Description: Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can impersonate other devices by supplying enumerated MAC addresses and receive sensitive information about the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01
CVE ID: CVE-2024-50381 State: PUBLISHED Published: 2024-12-02T16:34:44.415Z Last Updated: 2024-12-02T18:29:09.661Z Vendors: Snap One Products: OVRC cloud Problem Types: CWE-306 Description: A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only needs to provide the MAC address of the targeted device and can make a request to unclaim it from its original connection and make a request to claim it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01
CVE ID: CVE-2024-50382 State: PUBLISHED Published: 2024-10-23T00:00:00 Last Updated: 2024-10-24T19:57:23.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/randombit/botan/commit/53b0cfde580e86b03d0d27a488b6c134f662e957 - https://github.com/randombit/botan/compare/3.5.0...3.6.0 - https://arxiv.org/pdf/2410.13489 - https://news.ycombinator.com/it
://github.com/randombit/botan/compare/3.5.0...3.6.0 - https://arxiv.org/pdf/2410.13489 - https://news.ycombinator.com/item?id=41887153
CVE ID: CVE-2024-50383 State: PUBLISHED Published: 2024-10-23T00:00:00 Last Updated: 2024-10-24T19:55:57.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be affected.) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/randombit/botan/commit/53b0cfde580e86b03d0d27a488b6c134f662e957 - https://github.com/randombit/botan/co
tps://github.com/randombit/botan/commit/53b0cfde580e86b03d0d27a488b6c134f662e957 - https://github.com/randombit/botan/compare/3.5.0...3.6.0 - https://arxiv.org/pdf/2410.13489 - https://news.ycombinator.com/item?id=41887153
CVE ID: CVE-2024-50384 State: PUBLISHED Published: 2025-04-02T13:41:57.136Z Last Updated: 2025-11-03T19:31:48.392Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: STMicroelectronics Products: X-CUBE-AZRT-H7RS, X-CUBE-AZRTOS-F4, X-CUBE-AZRTOS-F7, X-CUBE-AZRTOS-G0, X-CUBE-AZRTOS-G4, X-CUBE-AZRTOS-H7, X-CUBE-AZRTOS-L4, X-CUBE-AZRTOS-L5, X-CUBE-AZRTOS-WB, X-CUBE-AZRTOS-WL Problem Types: CWE-459 Description: A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vu
ecially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Web Component HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2097
CVE ID: CVE-2024-50385 State: PUBLISHED Published: 2025-04-02T13:41:57.295Z Last Updated: 2025-11-03T19:31:49.760Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: STMicroelectronics Products: X-CUBE-AZRT-H7RS, X-CUBE-AZRTOS-F4, X-CUBE-AZRTOS-F7, X-CUBE-AZRTOS-G0, X-CUBE-AZRTOS-G4, X-CUBE-AZRTOS-H7, X-CUBE-AZRTOS-L4, X-CUBE-AZRTOS-L5, X-CUBE-AZRTOS-WB, X-CUBE-AZRTOS-WL Problem Types: CWE-459 Description: A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vu
ecially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2097
CVE ID: CVE-2024-50386 State: PUBLISHED Published: 2024-11-12T14:34:08.537Z Last Updated: 2024-11-12T20:06:52.571Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-20 Description: Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker that can register templates, can use them to deploy malicious instances on KVM-based environments and exploit this to g
that can register templates, can use them to deploy malicious instances on KVM-based environments and exploit this to gain access to the host filesystems that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack 4.18.2.5 or 4.19.1.3, or later, which addresses this issue. Additionally, all user-registered KVM-compatible templates can be scanned and checked that they are flat files that should not be using any additional or unnecessary features. For example, operators can run the following command on their file-based prima
g any additional or unnecessary features. For example, operators can run the following command on their file-based primary storage(s) and inspect the output. An empty output for the disk being validated means it has no references to the host filesystems; on the other hand, if the output for the disk being validated is not empty, it might indicate a compromised disk. However, bear in mind that (i) volumes created from templates will have references for the templates at first and (ii) volumes can be consolidated while migrating, losing their references to the templates. Therefore, the command execution for the primary storages can show both false positives and false negatives. for file in $(fi
fore, the command execution for the primary storages can show both false positives and false negatives. for file in $(find /path/to/storage/ -type f -regex [a-f0-9\-]*.*); do echo "Retrieving file [$file] info. If the output is not empty, that might indicate a compromised disk; check it carefully."; qemu-img info -U $file | grep file: ; printf "\n\n"; done For checking the whole template/volume features of each disk, operators can run the following command: for file in $(find /path/to/storage/ -type f -regex [a-f0-9\-]*.*); do echo "Retrieving file [$file] info."; qemu-img info -U $file; printf "\n\n"; done Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Reference
info -U $file; printf "\n\n"; done Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.5-4.19.1.3 - https://lists.apache.org/thread/d0x83c2cyglzzdw8csbop7mj7h83z95y - https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-5-and-4-19-1-3/
CVE ID: CVE-2024-50387 State: PUBLISHED Published: 2024-12-06T16:35:38.061Z Last Updated: 2024-12-06T19:55:29.687Z Vendors: QNAP Systems Inc. Products: SMB Service Problem Types: CWE-89 Description: A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: SMB Service 4.15.002 and later SMB Service h4.15.002 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-42
CVE ID: CVE-2024-50388 State: PUBLISHED Published: 2024-12-06T16:35:07.434Z Last Updated: 2024-12-06T19:59:55.053Z Vendors: QNAP Systems Inc. Products: HBS 3 Hybrid Backup Sync Problem Types: CWE-77, CWE-78 Description: An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 25.1.1.673 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-41
CVE ID: CVE-2024-50389 State: PUBLISHED Published: 2024-12-06T16:35:45.704Z Last Updated: 2024-12-06T19:39:20.514Z Vendors: QNAP Systems Inc. Products: QuRouter Problem Types: CWE-89 Description: A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: QuRouter 2.4.5.032 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-45
CVE ID: CVE-2024-50390 State: PUBLISHED Published: 2025-03-07T16:13:03.267Z Last Updated: 2025-03-07T17:58:11.150Z Vendors: QNAP Systems Inc. Products: QuRouter Problem Types: CWE-1188, CWE-78 Description: A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.5.032 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-01