Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-28672 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-19T18:57:08.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/777erp/cms/blob/main/3.md
CVE ID: CVE-2024-28673 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-02T20:43:29.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/777erp/cms/blob/main/4.md
CVE ID: CVE-2024-28675 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-06T15:16:38.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/777erp/cms/blob/main/12.md
CVE ID: CVE-2024-28676 State: PUBLISHED Published: 2024-03-13T00:00:00.000Z Last Updated: 2025-04-15T15:25:11.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via /dede/article_edit.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/777erp/cms/blob/main/18.md
CVE ID: CVE-2024-28677 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-28T18:24:36.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_main.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/777erp/cms/blob/main/14.md
CVE ID: CVE-2024-28678 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-26T16:51:55.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_description_main.php Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/777erp/cms/blob/main/15.md
CVE ID: CVE-2024-28679 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-11-01T14:58:14.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via Photo Collection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/777erp/cms/blob/main/19.md
CVE ID: CVE-2024-28680 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-15T20:04:47.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_add.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/777erp/cms/blob/main/11.md
CVE ID: CVE-2024-28681 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-28T18:25:32.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus_edit.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/777erp/cms/blob/main/17.md
CVE ID: CVE-2024-28682 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-28T13:33:58.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys_cache_up.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/777erp/cms/blob/main/13.md
CVE ID: CVE-2024-28683 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-15T20:02:56.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via create file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/777erp/cms/blob/main/20.md
CVE ID: CVE-2024-28684 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-05T17:45:09.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.php Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/777erp/cms/blob/main/16.md
CVE ID: CVE-2024-28698 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-08-02T00:56:58.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/MarimerLLC/csla/pull/3552 - https://www.intruder.io/research/path-traversal-and-code-execution-in-csla-net-cve-2024-28698
CVE ID: CVE-2024-28699 State: PUBLISHED Published: 2024-04-22T00:00:00 Last Updated: 2024-08-02T00:56:58.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://pdf2json.com - https://github.com/flexpaper/pdf2json - https://github.com/flexpaper/pdf2json/issues/52
CVE ID: CVE-2024-28709 State: PUBLISHED Published: 2024-10-07T00:00:00.000Z Last Updated: 2025-03-25T16:40:46.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://limesurvey.com - https://github.com/LimeSurvey/LimeSurvey/commit/c844c4fba81cc26ffe6544bf095bad6252910bc0
CVE ID: CVE-2024-28710 State: PUBLISHED Published: 2024-10-07T00:00:00.000Z Last Updated: 2025-03-25T16:30:47.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://limesurvey.com - https://github.com/LimeSurvey/LimeSurvey/commit/c2fd60f94bc1db275f20cbb27a3135a9bdfb7f10
CVE ID: CVE-2024-28713 State: PUBLISHED Published: 2024-03-28T00:00:00 Last Updated: 2024-08-27T19:18:07.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://mblog.com - https://gitee.com/mtons/mblog - https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%871.png - https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%872.png - https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%873.png - https://github.com/JiangXiaoBa
7%89%872.png - https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%873.png - https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%874.png - https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%875.png - https://github.com/JiangXiaoBaiJia/cve/blob/main/Mblog%20blog%20system%20has%20SSTI%20template%20injection%20vulnerability.md
CVE ID: CVE-2024-28714 State: PUBLISHED Published: 2024-03-28T00:00:00 Last Updated: 2024-08-19T07:47:58.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://crmebjava.com - https://gitee.com/ZhongBangKeJi/crmeb_java - https://github.com/JiangXiaoBaiJia/cve2/blob/main/a.png - https://github.com/JiangXiaoBaiJia/cve2/blob/main/1.md
CVE ID: CVE-2024-28715 State: PUBLISHED Published: 2024-03-19T00:00:00 Last Updated: 2024-11-01T14:34:06.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Lq0ne/CVE-2024-28715
CVE ID: CVE-2024-28716 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-08-02T00:56:58.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.launchpad.net/solum/+bug/2047505 - https://drive.google.com/file/d/11x-6CjWCyap8_W1JpVzun56HQkPNLtWT/view?usp=drive_link - https://gist.github.com/Fewword/f098d8d6375ac25e27b18c0e57be532f
CVE ID: CVE-2024-28717 State: PUBLISHED Published: 2024-04-22T00:00:00 Last Updated: 2024-08-02T00:56:58.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.launchpad.net/storlets/+bug/2047723 - https://gist.github.com/Fewword/f098d8d6375ac25e27b18c0e57be532f
CVE ID: CVE-2024-28718 State: PUBLISHED Published: 2024-04-12T00:00:00 Last Updated: 2024-08-15T18:55:40.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py. component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/magnum/+bug/2047690 - https://review.opendev.org/c/openstack/magnum/+/907305 - https://gist.github.com/Fewword/f098d8d6375ac25e27b18c0e57be532f
CVE ID: CVE-2024-28722 State: PUBLISHED Published: 2024-04-22T00:00:00 Last Updated: 2024-08-02T00:56:58.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to the /CMD0/xml_modes.xml endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://innovaphone.com - http://mypbx.com - https://wiki.innovaphone.com/index.php?title=Reference14r1:Release_Notes_Firmware#159317_-_Advanced_UI:_Prevent_XSL_injection
CVE ID: CVE-2024-28725 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T00:56:58.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/asenzhenshuai/DongDong/blob/main/yzmcms-xss.pdf - https://github.com/asenzhenshuai/DongDong/issues/1
CVE ID: CVE-2024-28726 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-13T15:50:22.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary code via a crafted payload to the Diagnostics function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mrnmap/mrnmap-cve - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2024-28726
CVE ID: CVE-2024-28728 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-13T15:45:20.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to obtain sensitive information via a crafted payload to the WiFi SSID Name field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mrnmap/mrnmap-cve - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2024-28728
CVE ID: CVE-2024-28729 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-22T18:53:21.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary code via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mrnmap/mrnmap-cve - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2024-28729
CVE ID: CVE-2024-28730 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-21T17:22:35.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to obtain sensitive information via the file upload feature of the VPN configuration module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mrnmap/mrnmap-cve - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2024-28730-ReflectedXSS
CVE ID: CVE-2024-28731 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-22T18:29:53.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to obtain sensitive information via the Port forwarding option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mrnmap/mrnmap-cve/ - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2024-28731%2C%20%20Cross%20Site%20Request%20Forgery%20vulnerability%20in%20DLink%20DWR%202000M%205G%20CPE
CVE ID: CVE-2024-28732 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-21T20:36:26.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OFPMatch in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/faucetsdn/ryu/issues/188 - https://gist.github.com/ErodedElk/1133d64dde2d92393a065edc9b243792
CVE ID: CVE-2024-28734 State: PUBLISHED Published: 2024-03-19T00:00:00 Last Updated: 2024-08-02T00:56:58.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://packetstormsecurity.com/files/177619/Financials-By-Coda-Cross-Site-Scripting.html - https://www.unit4.com/ - https://www.unit4.com/products/financial-management-software
CVE ID: CVE-2024-28735 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-08-02T00:56:58.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://financials.com - http://unit4.com - https://packetstormsecurity.com/files/177620/Financials-By-Coda-Authorization-Bypass.html - https://www.unit4.com/ - https://www.unit4.com/products/financial-man
620/Financials-By-Coda-Authorization-Bypass.html - https://www.unit4.com/ - https://www.unit4.com/products/financial-management-software
CVE ID: CVE-2024-28736 State: PUBLISHED Published: 2024-05-31T15:41:07.723Z Last Updated: 2025-02-13T15:47:37.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://packetstormsecurity.com/files/178794/Debezium-UI-2.5-Credential-Disclosure.html
CVE ID: CVE-2024-28739 State: PUBLISHED Published: 2024-08-06T00:00:00 Last Updated: 2024-08-06T20:54:07.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://febin0x4e4a.wordpress.com/2024/03/07/xss-to-one-click-rce-in-koha-ils/
CVE ID: CVE-2024-28740 State: PUBLISHED Published: 2024-08-06T00:00:00 Last Updated: 2024-08-21T17:34:11.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://febin0x4e4a.wordpress.com/2023/01/11/xss-vulnerability-in-koha-integrated-library-system/ - https://febin0x4e4a.wordpress.com/2024/03/07/xss-to-one-click-rce-in-koha-ils/
CVE ID: CVE-2024-28741 State: PUBLISHED Published: 2024-04-06T00:00:00 Last Updated: 2024-08-15T14:47:19.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/EnginDemirbilek/NorthStarC2 - https://packetstormsecurity.com/files/177542/NorthStar-C2-Agent-1.0-Cross-Site-Scripting-Remote-Command-Execution.html - https://blog.chebuya.com/posts/discovering-cve-2024-28741-remote-code-execution-on-northstar-c2-agents-via-pre-auth-stored
tps://blog.chebuya.com/posts/discovering-cve-2024-28741-remote-code-execution-on-northstar-c2-agents-via-pre-auth-stored-xss/
CVE ID: CVE-2024-28744 State: PUBLISHED Published: 2024-04-08T00:16:21.116Z Last Updated: 2024-08-02T00:56:58.148Z Vendors: FURUNO SYSTEMS Co.,Ltd. Products: ACERA 9010-08, ACERA 9010-24 Problem Types: Empty Password in Configuration File Description: The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: -
d only when running in non MS mode with the initial configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.furunosystems.co.jp/news/info/vulner20240401.html - https://jvn.jp/en/vu/JVNVU99285099/
CVE ID: CVE-2024-28745 State: PUBLISHED Published: 2024-03-18T03:18:21.948Z Last Updated: 2024-11-19T19:39:30.469Z Vendors: AbemaTV, Inc. Products: 'ABEMA' App for Android Problem Types: Improper Export of Android Application Components Description: Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displayed on the app, and as a result, the user may become a victim of a phishing attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
e user may become a victim of a phishing attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN70640802/
CVE ID: CVE-2024-28746 State: PUBLISHED Published: 2024-03-14T08:41:03.928Z Last Updated: 2025-03-20T19:04:18.928Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-281 Description: Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/a
ty Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/airflow/pull/37881 - https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7 - http://www.openwall.com/lists/oss-security/2024/03/13/5
CVE ID: CVE-2024-28747 State: PUBLISHED Published: 2024-07-09T07:10:18.739Z Last Updated: 2024-08-02T00:56:58.150Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ifm Products: Smart PLC AC14xx Firmware, Smart PLC AC4xxS Firmware Problem Types: CWE-798 Description: An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-012
CVE ID: CVE-2024-28748 State: PUBLISHED Published: 2024-07-09T07:10:32.244Z Last Updated: 2024-08-02T00:56:58.055Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ifm Products: Smart PLC AC14xx Firmware, Smart PLC AC4xxS Firmware Problem Types: CWE-78 Description: A remote attacker with high privileges may use a reading file function to inject OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-012
CVE ID: CVE-2024-28749 State: PUBLISHED Published: 2024-07-09T07:10:44.798Z Last Updated: 2024-08-02T00:56:58.043Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ifm Products: Smart PLC AC14xx Firmware, Smart PLC AC4xxS Firmware Problem Types: CWE-78 Description: A remote attacker with high privileges may use a writing file function to inject OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-012
CVE ID: CVE-2024-28750 State: PUBLISHED Published: 2024-07-09T07:10:57.362Z Last Updated: 2024-08-02T00:56:58.039Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ifm Products: Smart PLC AC14xx Firmware, Smart PLC AC4xxS Firmware Problem Types: CWE-78 Description: A remote attacker with high privileges may use a deleting file function to inject OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-012