Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
by tricking an authenticated Argo CD user into loading a web page which contains code to call Argo CD API endpoints on the victim’s behalf. For example, an attacker could send an Argo CD user a link to a page which looks harmless but in the background calls an Argo CD API endpoint to create an application running malicious code. Argo CD uses the “Lax” SameSite cookie policy to prevent CSRF attacks where the attacker controls an external domain. The malicious external website can attempt to call the Argo CD API, but the web browser will refuse to send the Argo CD auth token with the request. Many companies host Argo CD on an internal subdomain. If an attacker can place malicious code on, for
with the request. Many companies host Argo CD on an internal subdomain. If an attacker can place malicious code on, for example, https://test.internal.example.com/, they can still perform a CSRF attack. In this case, the “Lax” SameSite cookie does not prevent the browser from sending the auth cookie, because the destination is a parent domain of the Argo CD API. Browsers generally block such attacks by applying CORS policies to sensitive requests with sensitive content types. Specifically, browsers will send a “preflight request” for POSTs with content type “application/json” asking the destination API “are you allowed to accept requests from my domain?” If the destination API does not answe
n” asking the destination API “are you allowed to accept requests from my domain?” If the destination API does not answer “yes,” the browser will block the request. Before the patched versions, Argo CD did not validate that requests contained the correct content type header. So an attacker could bypass the browser’s CORS check by setting the content type to something which is considered “not sensitive” such as “text/plain.” The browser wouldn’t send the preflight request, and Argo CD would happily accept the contents (which are actually still JSON) and perform the requested action (such as running malicious code). A patch for this vulnerability has been released in the following Argo CD vers
action (such as running malicious code). A patch for this vulnerability has been released in the following Argo CD versions: 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15. The patch contains a breaking API change. The Argo CD API will no longer accept non-GET requests which do not specify application/json as their Content-Type. The accepted content types list is configurable, and it is possible (but discouraged) to disable the content type check completely. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-92mw-q256-5v
tainer: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-92mw-q256-5vwg - https://github.com/argoproj/argo-cd/issues/2496 - https://github.com/argoproj/argo-cd/pull/16860
CVE ID: CVE-2024-22425 State: PUBLISHED Published: 2024-02-16T11:14:47.469Z Last Updated: 2024-08-29T15:55:11.393Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Dell Products: RecoverPoint for VMs Problem Types: CWE-307 Description: Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner. Additional Analyst Notes: - CVE Program Container: -
to brute-force the password of valid users in an automated manner. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities - https://www.dell.com/support/kbdoc/en-us/000228154/dsa-2024-369-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities
CVE ID: CVE-2024-22426 State: PUBLISHED Published: 2024-02-16T11:20:35.039Z Last Updated: 2024-08-29T12:55:21.518Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: RecoverPoint for VMs Problem Types: CWE-434 Description: Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to execute arbitrary operating system commands, which will get executed in the context of the root user, resulting in a complete system compromise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
mplete system compromise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities - https://www.dell.com/support/kbdoc/en-us/000228154/dsa-2024-369-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities
CVE ID: CVE-2024-22428 State: PUBLISHED Published: 2024-01-16T04:02:01.593Z Last Updated: 2024-11-13T20:54:09.106Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: iDRAC Service Module (iSM) Problem Types: CWE-276 Description: Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability. It may allow a local unprivileged user to escalate privileges and execute arbitrary code on the affected system. Dell recommends customers upgrade at the earliest opportunity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000221129/d
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000221129/dsa-2024-018-security-update-for-dell-idrac-service-module-for-weak-folder-permission-vulnerabilities
CVE ID: CVE-2024-22429 State: PUBLISHED Published: 2024-05-17T15:20:16.147Z Last Updated: 2024-08-01T22:43:35.008Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000221102/dsa-2024-020
CVE ID: CVE-2024-22430 State: PUBLISHED Published: 2024-02-01T09:52:17.907Z Last Updated: 2025-05-07T20:12:40.636Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-276 Description: Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability. A local low privileges malicious user could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000221707/dsa-2024-028-security-update-for-dell-powerscale-onefs-for-multiple-se
ttps://www.dell.com/support/kbdoc/en-us/000221707/dsa-2024-028-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-22432 State: PUBLISHED Published: 2024-01-25T14:53:01.205Z Last Updated: 2024-08-29T13:43:41.707Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: NetWorker Module for Databases and Applications - Oracle Problem Types: CWE-256 Description: Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. User has low privilege access to Networker Client system could potentially exploit this vulnerability, leading to the disclosure of configured MySQL Database user credentials. The attacker may be able to use the exposed credentials to access
closure of configured MySQL Database user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application Database with privileges of the compromised account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000221474/dsa-2024-059-security-update-for-dell-networker-multiple-components-vulnerabilities
CVE ID: CVE-2024-22433 State: PUBLISHED Published: 2024-02-01T15:57:46.053Z Last Updated: 2024-08-19T20:16:38.664Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L) Vendors: Dell Products: Data Protection Search Problem Types: CWE-538 Description: Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search. A remote unauthorized unauthenticated attacker could potentially exploit this vulnerability leading to a loss of Confidentiality, Integrity, Protection, and remote takeover of the system. This is a high-severity vulnerability as it allows an attacker to take complete control of D
ote takeover of the system. This is a high-severity vulnerability as it allows an attacker to take complete control of DP Search to affect downstream protected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000221720/dsa-2024-063-security-update-for-dell-data-protection-search-multiple-security-vulnerabilities
CVE ID: CVE-2024-22435 State: PUBLISHED Published: 2024-04-15T09:06:09.732Z Last Updated: 2024-08-21T14:53:15.755Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise Products: HPE NonStop Web ViewPoint Enterprise software Problem Types: CWE-200 Description: A potential security vulnerability has been identified in Web ViewPoint Enterprise software. This vulnerability could be exploited to allow unauthorized users to access some resources on a NonStop system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbns04624en_us
CVE ID: CVE-2024-22436 State: PUBLISHED Published: 2024-03-26T18:50:24.741Z Last Updated: 2025-08-26T20:15:35.328Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: IceWall Gen11, IceWall SSO Agent Description: A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbmu04626en_us
CVE ID: CVE-2024-22437 State: PUBLISHED Published: 2024-04-15T09:21:40.627Z Last Updated: 2024-08-01T22:43:34.946Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise Products: HPE MSA SAN Storage VSS Provider and CAPI Proxy Software Problem Types: CWE-428 Description: A potential security vulnerability has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This vulnerability could be exploited to gain elevated privilege on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hp
ichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbst04630en_us
CVE ID: CVE-2024-22438 State: PUBLISHED Published: 2024-04-15T09:37:46.770Z Last Updated: 2024-08-01T22:43:34.942Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: Hewlett Packard Enterprise Products: HPE OfficeConnect 1820 Network switches Problem Types: CWE-352 Description: A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820 Network switches. The vulnerability could be remotely exploited to allow execution of malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbnw04628en_us
CVE ID: CVE-2024-22439 State: PUBLISHED Published: 2024-04-15T10:08:57.234Z Last Updated: 2024-08-01T22:43:34.952Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: Hewlett Packard Enterprise Products: HPE FlexNetwork and FlexFabric products Problem Types: CWE-639 Description: A potential security vulnerability has been identified in HPE FlexFabric and FlexNetwork series products. This vulnerability could be exploited to gain privileged access to switches resulting in information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbnw0462
- CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbnw04625en_us
CVE ID: CVE-2024-22440 State: PUBLISHED Published: 2024-04-17T06:56:26.415Z Last Updated: 2024-08-01T22:43:34.942Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise Products: HPE Compute Scale-up Server 3200 Server Problem Types: CWE-532 Description: A potential security vulnerability has been identified in HPE Compute Scale-up Server 3200 server. This vulnerability could cause disclosure of sensitive information in log files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04634en_us&docLocale=en_US
CVE ID: CVE-2024-22441 State: PUBLISHED Published: 2024-06-13T15:23:19.669Z Last Updated: 2025-03-25T16:30:45.476Z Vendors: Hewlett Packard Enterprise (HPE) Products: Cray System Management Software - PALS Description: HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbcr04653en_us&docLocale=en_US
CVE ID: CVE-2024-22442 State: PUBLISHED Published: 2024-07-16T15:45:51.809Z Last Updated: 2024-08-01T22:43:34.901Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE 3PAR Service Processor Description: The vulnerability could be remotely exploited to bypass authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04663en_us&docLocale=en_US
CVE ID: CVE-2024-22443 State: PUBLISHED Published: 2024-07-24T15:08:07.150Z Last Updated: 2024-08-01T22:43:34.951Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise Products: HPE Aruba Networking EdgeConnect SD-WAN Orchestrator Description: A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. Additional Analyst Notes: - CISA ADP Vuln
ands on the underlying operating system leading to complete system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04672en_us&docLocale=en_US
CVE ID: CVE-2024-22444 State: PUBLISHED Published: 2024-07-24T15:17:18.394Z Last Updated: 2024-08-01T22:43:34.992Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Hewlett Packard Enterprise Products: HPE Aruba Networking EdgeConnect SD-WAN Orchestrator Description: A vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victims browser in the context of the affected interface. Additional Analyst Notes: - CISA ADP Vulnrichm
cript code in a victims browser in the context of the affected interface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04672en_us&docLocale=en_US
CVE ID: CVE-2024-22445 State: PUBLISHED Published: 2024-02-13T07:40:20.900Z Last Updated: 2024-08-22T15:28:00.442Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerProtect Data Manager Problem Types: CWE-78 Description: Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker. Additional Analyst Notes: - CVE Program
nerable application. Exploitation may lead to a system take over by an attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222025/dsa-2024-061-dell-power-protect-data-manager-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-22448 State: PUBLISHED Published: 2024-04-10T07:30:08.507Z Last Updated: 2024-08-01T22:43:34.907Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-787 Description: Dell BIOS contains an Out-of-Bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000221744/dsa-2024-066
CVE ID: CVE-2024-22449 State: PUBLISHED Published: 2024-02-01T09:48:41.978Z Last Updated: 2025-06-17T14:45:28.220Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-306 Description: Dell PowerScale OneFS versions 9.0.0.x through 9.6.0.x contains a missing authentication for critical function vulnerability. A low privileged local malicious user could potentially exploit this vulnerability to gain elevated access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000221707/dsa-2024-028-security-update-for-dell-powerscale-onefs-for-m
ences: - https://www.dell.com/support/kbdoc/en-us/000221707/dsa-2024-028-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-22450 State: PUBLISHED Published: 2024-04-10T07:08:12.756Z Last Updated: 2024-08-01T22:43:34.997Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Alienware Command Center (AWCC) Problem Types: CWE-427 Description: Dell Alienware Command Center, versions prior to 6.2.7.0, contain an uncontrolled search path element vulnerability. A local malicious user could potentially inject malicious files in the file search path, leading to system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000218222/dsa-2024-016-security-update-for-dell-alienwa
ontainer: References: - https://www.dell.com/support/kbdoc/en-us/000218222/dsa-2024-016-security-update-for-dell-alienware-command-center-vulnerabilities
CVE ID: CVE-2024-22452 State: PUBLISHED Published: 2024-03-04T13:08:03.515Z Last Updated: 2024-08-02T19:35:48.108Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Display and Peripheral Manager Problem Types: CWE-264 Description: Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access control vulnerability. A low privilege user could potentially exploit this vulnerability by modifying files in the installation folder to execute arbitrary code, leading to privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/00022
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000221414/dsa-2024-056
CVE ID: CVE-2024-22453 State: PUBLISHED Published: 2024-03-19T07:42:27.785Z Last Updated: 2024-08-01T22:43:34.929Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: Dell Products: PowerEdge Platform Problem Types: CWE-122 Description: Dell PowerEdge Server BIOS contains a heap-based buffer overflow vulnerability. A local high privileged attacker could potentially exploit this vulnerability to write to otherwise unauthorized memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000223209/dsa-2024-105-security-update-for-dell-poweredge-server-bios-for-a-heap-based-buffer-overflow-
port/kbdoc/en-us/000223209/dsa-2024-105-security-update-for-dell-poweredge-server-bios-for-a-heap-based-buffer-overflow-vulnerability
CVE ID: CVE-2024-22454 State: PUBLISHED Published: 2024-02-13T07:35:35.667Z Last Updated: 2025-05-09T18:26:40.775Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerProtect Data Manager Problem Types: CWE-640 Description: Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the compromised account. The attacker could retrieve the reset password token without authorization and then perform the password change Addition
The attacker could retrieve the reset password token without authorization and then perform the password change Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222025/dsa-2024-061-dell-power-protect-data-manager-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-22455 State: PUBLISHED Published: 2024-02-14T07:01:59.081Z Last Updated: 2024-10-30T15:06:57.786Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Dell Products: Mobility - E-Lab Navigator Problem Types: CWE-639 Description: Dell Mobility - E-Lab Navigator, version(s) 3.1.9, 3.2.0, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Launch of phishing attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222015/dsa-2024-073-secu
m Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222015/dsa-2024-073-security-update-for-mobility-e-lab-navigator-vulnerabilities